9ad338fd84c70a692d80b8db75ec0901af7bd97fac8faed09ca0b29a13d090c7

General

Target

9ad338fd84c70a692d80b8db75ec0901af7bd97fac8faed09ca0b29a13d090c7.exe
Size

260KB
MD5

6ec60db3890454a860914148a768a451
SHA1

89d1609150580514695d86bcf709ac5dc3e0c8b0
SHA256

9ad338fd84c70a692d80b8db75ec0901af7bd97fac8faed09ca0b29a13d090c7
SHA512

78a32d35333320f06e1db498439135a42667f6584bd1d85b73d6cd3757e34a0a22e23791a04d5c4a944bf9c36b8b22ff0fdf97df2a5a72af3396dc4d210db9f5
SSDEEP

6144:2dsQgTSrMaIl/jcLijfHFEHWzXvjT85R:2cTSrMaIqLlI/H85R

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

kaafu.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	kaafu.exe

Executes dropped EXE 1 IoCs

Processes:

kaafu.exe

pid process

4900 kaafu.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

9ad338fd84c70a692d80b8db75ec0901af7bd97fac8faed09ca0b29a13d090c7.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	9ad338fd84c70a692d80b8db75ec0901af7bd97fac8faed09ca0b29a13d090c7.exe

Adds Run key to start application 2 TTPs 51 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

kaafu.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kaafu = "C:\\Users\\Admin\\kaafu.exe /Q"	kaafu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kaafu = "C:\\Users\\Admin\\kaafu.exe /F"	kaafu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kaafu = "C:\\Users\\Admin\\kaafu.exe /B"	kaafu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kaafu = "C:\\Users\\Admin\\kaafu.exe /Y"	kaafu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kaafu = "C:\\Users\\Admin\\kaafu.exe /I"	kaafu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kaafu = "C:\\Users\\Admin\\kaafu.exe /w"	kaafu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kaafu = "C:\\Users\\Admin\\kaafu.exe /Z"	kaafu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kaafu = "C:\\Users\\Admin\\kaafu.exe /M"	kaafu.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run\	kaafu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kaafu = "C:\\Users\\Admin\\kaafu.exe /N"	kaafu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kaafu = "C:\\Users\\Admin\\kaafu.exe /l"	kaafu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kaafu = "C:\\Users\\Admin\\kaafu.exe /U"	kaafu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kaafu = "C:\\Users\\Admin\\kaafu.exe /e"	kaafu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kaafu = "C:\\Users\\Admin\\kaafu.exe /G"	kaafu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kaafu = "C:\\Users\\Admin\\kaafu.exe /j"	kaafu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kaafu = "C:\\Users\\Admin\\kaafu.exe /J"	kaafu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kaafu = "C:\\Users\\Admin\\kaafu.exe /f"	kaafu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kaafu = "C:\\Users\\Admin\\kaafu.exe /b"	kaafu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kaafu = "C:\\Users\\Admin\\kaafu.exe /k"	kaafu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kaafu = "C:\\Users\\Admin\\kaafu.exe /W"	kaafu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kaafu = "C:\\Users\\Admin\\kaafu.exe /K"	kaafu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kaafu = "C:\\Users\\Admin\\kaafu.exe /X"	kaafu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kaafu = "C:\\Users\\Admin\\kaafu.exe /V"	kaafu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kaafu = "C:\\Users\\Admin\\kaafu.exe /T"	kaafu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kaafu = "C:\\Users\\Admin\\kaafu.exe /S"	kaafu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kaafu = "C:\\Users\\Admin\\kaafu.exe /t"	kaafu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kaafu = "C:\\Users\\Admin\\kaafu.exe /L"	kaafu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kaafu = "C:\\Users\\Admin\\kaafu.exe /s"	kaafu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kaafu = "C:\\Users\\Admin\\kaafu.exe /C"	kaafu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kaafu = "C:\\Users\\Admin\\kaafu.exe /O"	kaafu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kaafu = "C:\\Users\\Admin\\kaafu.exe /n"	kaafu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kaafu = "C:\\Users\\Admin\\kaafu.exe /i"	kaafu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kaafu = "C:\\Users\\Admin\\kaafu.exe /r"	kaafu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kaafu = "C:\\Users\\Admin\\kaafu.exe /a"	kaafu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kaafu = "C:\\Users\\Admin\\kaafu.exe /P"	kaafu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kaafu = "C:\\Users\\Admin\\kaafu.exe /d"	kaafu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kaafu = "C:\\Users\\Admin\\kaafu.exe /q"	kaafu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kaafu = "C:\\Users\\Admin\\kaafu.exe /m"	kaafu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kaafu = "C:\\Users\\Admin\\kaafu.exe /D"	kaafu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kaafu = "C:\\Users\\Admin\\kaafu.exe /c"	kaafu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kaafu = "C:\\Users\\Admin\\kaafu.exe /y"	kaafu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kaafu = "C:\\Users\\Admin\\kaafu.exe /A"	kaafu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kaafu = "C:\\Users\\Admin\\kaafu.exe /v"	kaafu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kaafu = "C:\\Users\\Admin\\kaafu.exe /g"	kaafu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kaafu = "C:\\Users\\Admin\\kaafu.exe /u"	kaafu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kaafu = "C:\\Users\\Admin\\kaafu.exe /R"	kaafu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kaafu = "C:\\Users\\Admin\\kaafu.exe /p"	kaafu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kaafu = "C:\\Users\\Admin\\kaafu.exe /o"	kaafu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kaafu = "C:\\Users\\Admin\\kaafu.exe /E"	kaafu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kaafu = "C:\\Users\\Admin\\kaafu.exe /h"	kaafu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kaafu = "C:\\Users\\Admin\\kaafu.exe /x"	kaafu.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

kaafu.exe

pid	process
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe
4900	kaafu.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

9ad338fd84c70a692d80b8db75ec0901af7bd97fac8faed09ca0b29a13d090c7.exekaafu.exe

pid process

3692 9ad338fd84c70a692d80b8db75ec0901af7bd97fac8faed09ca0b29a13d090c7.exe
4900 kaafu.exe

pid	process
3692	9ad338fd84c70a692d80b8db75ec0901af7bd97fac8faed09ca0b29a13d090c7.exe
4900	kaafu.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

9ad338fd84c70a692d80b8db75ec0901af7bd97fac8faed09ca0b29a13d090c7.exe

description	pid	process	target process
PID 3692 wrote to memory of 4900	3692	9ad338fd84c70a692d80b8db75ec0901af7bd97fac8faed09ca0b29a13d090c7.exe	kaafu.exe
PID 3692 wrote to memory of 4900	3692	9ad338fd84c70a692d80b8db75ec0901af7bd97fac8faed09ca0b29a13d090c7.exe	kaafu.exe
PID 3692 wrote to memory of 4900	3692	9ad338fd84c70a692d80b8db75ec0901af7bd97fac8faed09ca0b29a13d090c7.exe	kaafu.exe

C:\Users\Admin\AppData\Local\Temp\9ad338fd84c70a692d80b8db75ec0901af7bd97fac8faed09ca0b29a13d090c7.exe
"C:\Users\Admin\AppData\Local\Temp\9ad338fd84c70a692d80b8db75ec0901af7bd97fac8faed09ca0b29a13d090c7.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3692

C:\Users\Admin\kaafu.exe
"C:\Users\Admin\kaafu.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4900

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

1

T1158

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\kaafu.exe
Filesize
260KB

MD5
99b21a69b90162c10fd68922932362d0

SHA1
6a3470a620dff7eb3eb434fa940046e56fcdfe0a

SHA256
ae80f0e368d98e1bef021ed35d0943c436577d4bfa9f7181ae1a6341c0d0a09a

SHA512
148661db84f409ff90bab28d5385ae46be317b35a28d27ce0c5570857a5cc40ca99107719a63d28b809c7f20efb8c2ee7c0a6f180ce9825a66481948c8e4f171

Download Submit
C:\Users\Admin\kaafu.exe
Filesize
260KB

MD5
99b21a69b90162c10fd68922932362d0

SHA1
6a3470a620dff7eb3eb434fa940046e56fcdfe0a

SHA256
ae80f0e368d98e1bef021ed35d0943c436577d4bfa9f7181ae1a6341c0d0a09a

SHA512
148661db84f409ff90bab28d5385ae46be317b35a28d27ce0c5570857a5cc40ca99107719a63d28b809c7f20efb8c2ee7c0a6f180ce9825a66481948c8e4f171

Download Submit
memory/4900-134-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads