Overview

overview

10

Static

static

e787844eb3...09.exe

windows7_x64

10

e787844eb3...09.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    154s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    20-05-2022 03:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e787844eb32181370dd1eea2c0340a7bbdf1b45ca84119ab2835419b2d435609.exe

  • Size

    1.6MB

  • MD5

    be0f8e6d545ddc8c2cfedb76ad965a19

  • SHA1

    37fbc96b83ad23e9d8102351c18944e58450f927

  • SHA256

    e787844eb32181370dd1eea2c0340a7bbdf1b45ca84119ab2835419b2d435609

  • SHA512

    cb7619971f232c4976b8cdd8cb3116a981e1b5433a87fffdda74880e6b29f9d7fc32bc1f30bb425ee000af6a48cc982ede2e693976631cd4fc989daa048c3589

Score
10/10
bootkitdiscoveryevasionpersistencesuricatatrojanupx

Malware Config

Signatures

  • Modifies system executable filetype association 2 TTPs 4 IoCs
    persistence
  • Registers COM server for autorun 1 TTPs
    persistence
  • suricata: ET MALWARE Possible Windows executable sent when remote host claims to send a Text File

    suricata: ET MALWARE Possible Windows executable sent when remote host claims to send a Text File

    suricata
  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Downloads MZ/PE file
  • Drops file in Drivers directory 35 IoCs
  • Sets file execution options in registry 2 TTPs
    persistence
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in Program Files directory 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e787844eb32181370dd1eea2c0340a7bbdf1b45ca84119ab2835419b2d435609.exe
    "C:\Users\Admin\AppData\Local\Temp\e787844eb32181370dd1eea2c0340a7bbdf1b45ca84119ab2835419b2d435609.exe"
    1⤵
    • Modifies system executable filetype association
    • Drops file in Drivers directory
    • Loads dropped DLL
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Writes to the Master Boot Record (MBR)
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4828

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1
T1042

Registry Run Keys / Startup Folder

3
T1060

Bootkit

1
T1067

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\kingsoft\kingsoft antivirus\kavmenu.dll
    Filesize

    2.9MB

    MD5

    0a8ed28246ab6e4a7c8996ffa911addf

    SHA1

    37cc881422d778d6089047a61e37ca1551409819

    SHA256

    0dd924ccb8bbe0115a521576062333118f85eb45dc8d9b2ae3b16d04f5bb6b75

    SHA512

    5f3feec601f8b075af7fc082104ba781ec7b650093ba9a6f571a1ab6d65133ba6ebfc877adce51c48003f6cbcb954b0b423fafeb8c3ed76a4d0ef6f744b7a0ba

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\kdb_semrjgj.dll
    Filesize

    92.1MB

    MD5

    0d95bc52e08ff367d76f03fa00c15e0e

    SHA1

    9ca670e9e33ae58f74afcf5fa0eec81a317a6e81

    SHA256

    70b96250bfceb83b811dcfa7446161b17f668468695dea8a1ec58f62df421e17

    SHA512

    71b79757889ecf19d5cd8e20b13c2770077ba99d4ee3fa0deeb93856f8f7c09ed0d33e34190351d838e39e4652592d3e265bfdd799d09e0001836086109aa8cf

    Download Submit