Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 00:13
Static task
static1
Behavioral task
behavioral1
Sample
4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
Resource
win7-20220414-en
General
-
Target
4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
-
Size
1.6MB
-
MD5
58cf8209f97252b8126cf3ba13f6cb92
-
SHA1
954fddb2a43eef8f0a4f16d02e8599b2b2ea81fe
-
SHA256
4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe
-
SHA512
f6cb4a9aee03420c085b6e13fcdca5512512dc8cd7ceae4429e4a5140b6ba673b80f496b92c296a39879386e758a4ae27a0bf1a7462e2f3202f2cf64221d2e06
Malware Config
Signatures
-
suricata: ET MALWARE Possible Windows executable sent when remote host claims to send a Text File
suricata: ET MALWARE Possible Windows executable sent when remote host claims to send a Text File
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\kdb_semrjgj.dll acprotect -
Downloads MZ/PE file
-
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\kdb_semrjgj.dll upx -
Loads dropped DLL 1 IoCs
Processes:
4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exepid process 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe -
Processes:
4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exedescription ioc process File opened for modification \??\PhysicalDrive0 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe -
Modifies registry class 14 IoCs
Processes:
4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idex = "302687f198c0193af948af0cc1b0a486" 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79B5BC47-CEA1-4772-B433-7D1B3139F278}\Implemented Categories 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79B5BC47-CEA1-4772-B433-7D1B3139F278}\Implemented Categories\{607568DD-B059-434b-B7E7-38EC51998F8E} 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79B5BC47-CEA1-4772-B433-7D1B3139F278}\Implemented Categories\{607568DD-B059-434b-B7E7-38EC51998F8E}\PacketPath_0_0_1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kdb_semrjgj.dll" 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\svrid 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5} 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0} 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idno = "1" 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79B5BC47-CEA1-4772-B433-7D1B3139F278} 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79B5BC47-CEA1-4772-B433-7D1B3139F278}\Implemented Categories\{607568DD-B059-434b-B7E7-38EC51998F8E}\did = "742CC7051C47CD8A5906B4FEAB3B96BB" 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\svrid = "9wo4xjfx2vmi2wcgy7ypgmkltzob" 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exepid process 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exedescription pid process Token: SeDebugPrivilege 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exepid process 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exepid process 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe 1808 4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe"C:\Users\Admin\AppData\Local\Temp\4619b93690b485ea54369d0379e3a8ffc367cff19438a46be124e39c871a0cfe.exe"1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\kdb_semrjgj.dllFilesize
36.6MB
MD5cf20e3f69ae844fd027ce759f0aa560c
SHA12d5079bf74c4cdc226c605a9e82bd803ff577648
SHA256f9cce6e4026f7be00fbf665bdc9e433baf0932ddf8bf660bcacbc61a4b44748a
SHA51249dae81fe0b2a47c548674ec2dea8c4a9a956308daf6ee6a7448ec373ca07094e0d04cd9dc88c527778d91aa8b13ecd6045eddf60d79a8c061f9530ac1b70015
-
memory/1808-54-0x0000000075BD1000-0x0000000075BD3000-memory.dmpFilesize
8KB