e6a4d8b6d7aff9da51b3cecc9a09d9e8034801373c5137a1f53e57eb4bec1e29

Analysis

max time kernel
21s
max time network
50s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 02:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e6a4d8b6d7aff9da51b3cecc9a09d9e8034801373c5137a1f53e57eb4bec1e29.exe
Size

699KB
MD5

a5aa82a4ec9ea85ca1f098c2c76b6fa0
SHA1

20cc4efde66be8362c1725817c7cd56e0f5892e3
SHA256

e6a4d8b6d7aff9da51b3cecc9a09d9e8034801373c5137a1f53e57eb4bec1e29
SHA512

97da9d19e9e11d0cc751fa1b0ef84e1cba829603e1132fb63a5d632ecb52a594974e54e5e74f3a46b3a20a374ddf140244b00c7f9a99d6357dab3efb7d12b5e0
SSDEEP

12288:gOzerQZb+md4w1UXYeZJys73dOvXDpNjNe8mKut:9erQZb+md4wmoeZJ8NI80

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1988-59-0x0000000000400000-0x0000000000440000-memory.dmp	upx
behavioral1/files/0x0007000000012767-89.dat	upx
behavioral1/files/0x0007000000012767-91.dat	upx
behavioral1/files/0x0007000000012767-95.dat	upx
behavioral1/files/0x0007000000012767-88.dat	upx
behavioral1/memory/2032-101-0x0000000000400000-0x0000000000440000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Option.bat	e6a4d8b6d7aff9da51b3cecc9a09d9e8034801373c5137a1f53e57eb4bec1e29.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system\KavUpda.exe	e6a4d8b6d7aff9da51b3cecc9a09d9e8034801373c5137a1f53e57eb4bec1e29.exe
File opened for modification	C:\Windows\system\KavUpda.exe	e6a4d8b6d7aff9da51b3cecc9a09d9e8034801373c5137a1f53e57eb4bec1e29.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1764	sc.exe
1128	sc.exe
1168	sc.exe
860	sc.exe
856	sc.exe
928	sc.exe
1564	sc.exe
1724	sc.exe

Runs net.exe

Runs regedit.exe 1 IoCs

pid	Process
992	regedit.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1988	e6a4d8b6d7aff9da51b3cecc9a09d9e8034801373c5137a1f53e57eb4bec1e29.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 904	1988	e6a4d8b6d7aff9da51b3cecc9a09d9e8034801373c5137a1f53e57eb4bec1e29.exe	31
PID 1988 wrote to memory of 904	1988	e6a4d8b6d7aff9da51b3cecc9a09d9e8034801373c5137a1f53e57eb4bec1e29.exe	31
PID 1988 wrote to memory of 904	1988	e6a4d8b6d7aff9da51b3cecc9a09d9e8034801373c5137a1f53e57eb4bec1e29.exe	31
PID 1988 wrote to memory of 904	1988	e6a4d8b6d7aff9da51b3cecc9a09d9e8034801373c5137a1f53e57eb4bec1e29.exe	31
PID 1988 wrote to memory of 1600	1988	e6a4d8b6d7aff9da51b3cecc9a09d9e8034801373c5137a1f53e57eb4bec1e29.exe	62
PID 1988 wrote to memory of 1600	1988	e6a4d8b6d7aff9da51b3cecc9a09d9e8034801373c5137a1f53e57eb4bec1e29.exe	62
PID 1988 wrote to memory of 1600	1988	e6a4d8b6d7aff9da51b3cecc9a09d9e8034801373c5137a1f53e57eb4bec1e29.exe	62
PID 1988 wrote to memory of 1600	1988	e6a4d8b6d7aff9da51b3cecc9a09d9e8034801373c5137a1f53e57eb4bec1e29.exe	62

C:\Users\Admin\AppData\Local\Temp\e6a4d8b6d7aff9da51b3cecc9a09d9e8034801373c5137a1f53e57eb4bec1e29.exe
"C:\Users\Admin\AppData\Local\Temp\e6a4d8b6d7aff9da51b3cecc9a09d9e8034801373c5137a1f53e57eb4bec1e29.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\SysWOW64\net.exe
  net.exe start schedule /y
  2⤵
  PID:1600
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\system32\Option.bat
  2⤵
  PID:904
- C:\Windows\SysWOW64\At.exe
  At.exe 8:09:05 AM C:\Windows\Help\HelpCat.exe
  2⤵
  PID:848
- C:\Windows\SysWOW64\sc.exe
  C:\Windows\system32\sc.exe config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  PID:1168
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\Windows\regedt32.sys
  2⤵
  - Runs regedit.exe
  PID:992
- C:\Windows\SysWOW64\sc.exe
  C:\Windows\system32\sc.exe config srservice start= disabled
  2⤵
  - Launches sc.exe
  PID:860
- C:\Windows\SysWOW64\sc.exe
  C:\Windows\system32\sc.exe config SharedAccess start= disabled
  2⤵
  - Launches sc.exe
  PID:856
- C:\Windows\SysWOW64\sc.exe
  C:\Windows\system32\sc.exe config srservice start= disabled
  2⤵
  - Launches sc.exe
  PID:928
- C:\Windows\SysWOW64\net.exe
  net.exe stop 360timeprot /y
  2⤵
  PID:1532
- C:\Windows\SysWOW64\net.exe
  net.exe stop srservice /y
  2⤵
  PID:108
- C:\Windows\SysWOW64\net.exe
  net.exe stop wuauserv /y
  2⤵
  PID:1408
- C:\Windows\SysWOW64\net.exe
  net.exe stop sharedaccess /y
  2⤵
  PID:1872
- C:\Windows\SysWOW64\net.exe
  net.exe stop wscsvc /y
  2⤵
  PID:268
- C:\Windows\SysWOW64\reg.exe
  C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
  2⤵
  PID:1328
- C:\Windows\SysWOW64\reg.exe
  C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
  2⤵
  PID:1504
- C:\Windows\SysWOW64\cmd.exe
  cmd /c at 8:11:08 AM C:\Windows\Sysinf.bat
  2⤵
  PID:1288
- C:\Windows\SysWOW64\cmd.exe
  cmd /c at 8:08:08 AM C:\Windows\Sysinf.bat
  2⤵
  PID:1720
- C:\Windows\system\KavUpda.exe
  C:\Windows\system\KavUpda.exe
  2⤵
  PID:2032
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c at 8:11:16 AM C:\Windows\Sysinf.bat
    3⤵
    PID:1304
  - - C:\Windows\SysWOW64\at.exe
      at 8:11:16 AM C:\Windows\Sysinf.bat
      4⤵
      PID:1052
- - C:\Windows\SysWOW64\sc.exe
    C:\Windows\system32\sc.exe config srservice start= disabled
    3⤵
    - Launches sc.exe
    PID:1564
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:576
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:1972
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop sharedaccess /y
      4⤵
      PID:1640
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
    3⤵
    PID:2000
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
    3⤵
    PID:856
- - C:\Windows\SysWOW64\sc.exe
    C:\Windows\system32\sc.exe config wscsvc start= disabled
    3⤵
    - Launches sc.exe
    PID:1724
- - C:\Windows\SysWOW64\sc.exe
    C:\Windows\system32\sc.exe config SharedAccess start= disabled
    3⤵
    - Launches sc.exe
    PID:1764
- - C:\Windows\SysWOW64\sc.exe
    C:\Windows\system32\sc.exe config srservice start= disabled
    3⤵
    - Launches sc.exe
    PID:1128
- - C:\Windows\SysWOW64\net.exe
    net.exe stop 360timeprot /y
    3⤵
    PID:2004
- - C:\Windows\SysWOW64\net.exe
    net.exe stop srservice /y
    3⤵
    PID:1616
- - C:\Windows\SysWOW64\net.exe
    net.exe stop wuauserv /y
    3⤵
    PID:1740
- - C:\Windows\SysWOW64\net.exe
    net.exe stop sharedaccess /y
    3⤵
    PID:1700
- - C:\Windows\SysWOW64\net.exe
    net.exe stop wscsvc /y
    3⤵
    PID:692
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c at 8:08:16 AM C:\Windows\Sysinf.bat
    3⤵
    PID:1544
- - C:\Windows\SysWOW64\At.exe
    At.exe 8:09:13 AM C:\Windows\Help\HelpCat.exe
    3⤵
    PID:1372
- C:\Windows\SysWOW64\net.exe
  net.exe stop wscsvc /y
  2⤵
  PID:1532
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop wscsvc /y
    3⤵
    PID:1564
- C:\Windows\SysWOW64\net.exe
  net.exe stop 360timeprot /y
  2⤵
  PID:1204
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop 360timeprot /y
    3⤵
    PID:1756
- C:\Windows\SysWOW64\net.exe
  net.exe stop srservice /y
  2⤵
  PID:1324
- C:\Windows\SysWOW64\net.exe
  net.exe stop wuauserv /y
  2⤵
  PID:880
- C:\Windows\SysWOW64\net.exe
  net.exe stop sharedaccess /y
  2⤵
  PID:1972

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start schedule /y
1⤵
PID:1756

C:\Windows\SysWOW64\at.exe
at 8:11:08 AM C:\Windows\Sysinf.bat
1⤵
PID:1156

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sharedaccess /y
1⤵
PID:1524

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop 360timeprot /y
1⤵
PID:1064

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop srservice /y
1⤵
PID:364

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wuauserv /y
1⤵
PID:956

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wscsvc /y
1⤵
PID:604

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1197857122-993414154-4829633775780333117887133411771820332-5706301982053907168"
1⤵
PID:1600

C:\Windows\SysWOW64\at.exe
at 8:08:08 AM C:\Windows\Sysinf.bat
1⤵
PID:1152

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start schedule /y
1⤵
PID:1068

C:\Windows\SysWOW64\net.exe
net.exe start schedule /y
1⤵
PID:968

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Windows\system32\Option.bat
1⤵
PID:1020

C:\Windows\SysWOW64\at.exe
at 8:08:16 AM C:\Windows\Sysinf.bat
1⤵
PID:1256

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop srservice /y
1⤵
PID:956

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop 360timeprot /y
1⤵
PID:1748

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wuauserv /y
1⤵
PID:1164

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop srservice /y
1⤵
PID:268

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wuauserv /y
1⤵
PID:1344

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sharedaccess /y
1⤵
PID:616

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wscsvc /y
1⤵
PID:596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Option.bat

Filesize
82B

MD5
3f7fbd2eb34892646e93fd5e6e343512

SHA1
265ac1061b54f62350fb7a5f57e566454d013a66

SHA256
e75e8d9bfc7a2876d908305186c3656e9de2a4af7f6927ccc6d8c812645abbc7

SHA512
53d40eb2f05a23464fbf06193868e7cb30cf0df3da53586a75123fb2c37b29cdddda287ce134809d16a559d87fb20aee0e8add22d396fcb7a55f9a753739b140

Download Submit
C:\Windows\SysWOW64\Option.bat

Filesize
82B

MD5
3f7fbd2eb34892646e93fd5e6e343512

SHA1
265ac1061b54f62350fb7a5f57e566454d013a66

SHA256
e75e8d9bfc7a2876d908305186c3656e9de2a4af7f6927ccc6d8c812645abbc7

SHA512
53d40eb2f05a23464fbf06193868e7cb30cf0df3da53586a75123fb2c37b29cdddda287ce134809d16a559d87fb20aee0e8add22d396fcb7a55f9a753739b140

Download Submit
C:\Windows\Sysinf.bat

Filesize
460B

MD5
7db3d565d6ddbe65a8b0e093910e7dcd

SHA1
d4804e6180c6e74ba79d3343f2f2ccb15e502f12

SHA256
a2778cb87fd88c7508ffd506a8ff8d58d0ffc02156f846956e5e99c6cb3d2f3f

SHA512
0b3d1d0f44feba9dd78903ff77fdeaea834d930990a86641fb2e4ce04da280d33f6bee0ae0b1320e4070cbe20824062e45b52e5cad797c5985d8e31dce1ef82b

Download Submit
C:\Windows\regedt32.sys

Filesize
2KB

MD5
e7d7ec66bd61fac3843c98650b0c68f6

SHA1
a15ae06e1be51038863650746368a71024539bac

SHA256
6475d5ecc14fea090774be55723d2d52b7ec7670527a7dbd61edf28c77944cb8

SHA512
ac9e9893f5a0af03957731445f63279085f164e9a968d706a99d13012e4459314a7ccc32dc48f62379d69e21a0953c13543c9ded38b5ad5fbc346aa442af1ae6

Download Submit
C:\Windows\system\KavUpda.exe

Filesize
294KB

MD5
6123d15899fb0ef37e14400dc006be70

SHA1
f5086290ccec222653ba738e33e36f24184567a3

SHA256
e2ba5d51f924182107fc00178cfd53c98c65dd4c4af94565ef30f34560c6bcca

SHA512
bc2ee4e496c07f53a96202cac816c64d7366c5425201cc215df01e2e8d40ee216ae718c4c1bcebc17f5ce175da588a83eb814aa10edb704a73a5d777bcbab799

Download Submit
C:\Windows\system\KavUpda.exe

Filesize
321KB

MD5
9928cbe29059ea3d44083dbe36384da0

SHA1
79e18b7395330eb40671bae580c6a9c45ed6da67

SHA256
e4670ea4329365b72991d5451b155ed23654f7592b26e1e2c28fd9a5965db56c

SHA512
9072daec2052e824cafba180614482fd382e9a7d225cccce0c4e3a46d0c2cf35d44c331af78529f34da3a5d3af4dc83f237c14a97e990977146ce2f7874cc6e9

Download Submit
\Windows\system\KavUpda.exe

Filesize
46KB

MD5
59f32ff974e391dc2337ebd0bbc3c677

SHA1
d24455f065640d4f57aba33a990a63ebac7b45b9

SHA256
9a99a0ca10bef9733b71ce61efdb8ec248e7696ba78fd1af037da7d9404f0932

SHA512
827db4f2f99b86b94d446f11b85501d8c94b19922089852f518899d7aa1bc8579c009bf6b071946adc67b64c5aed828b3fff134011d53fd6a31f264f8adcb9b2

Download Submit
\Windows\system\KavUpda.exe

Filesize
4KB

MD5
2cd6f2f78f702e34ac532a3afd9096bc

SHA1
a3a5d6c85f10e699ef9549a9b73055fbc52383ea

SHA256
bbbf83f7b2473b93bdc03160253fc2ef3729d24b94f224699e96cb768b14eb7f

SHA512
23bc1f9b7c3b8b546c9477ae7f2dc6439dea8afbe64b272634caa08806eacb1f55d24c7d6d0820b21743e6830c7dda6f390f388e99b2ab9160152bfc0b9761c7

Download Submit
memory/848-63-0x0000000075281000-0x0000000075283000-memory.dmp

Filesize
8KB

Download
memory/1988-100-0x0000000000280000-0x00000000002C0000-memory.dmp

Filesize
256KB

Download
memory/1988-99-0x0000000000280000-0x00000000002C0000-memory.dmp

Filesize
256KB

Download
memory/1988-59-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2032-101-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download