f2de5420e4dcf465c0049205fdd71c1a37556eb64fe1e5d7c8866f8c62b9ae27

Analysis

max time kernel
43s
max time network
4s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/10/2022, 08:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f2de5420e4dcf465c0049205fdd71c1a37556eb64fe1e5d7c8866f8c62b9ae27.exe
Size

1.1MB
MD5

7937d360be3cbe69ce359a8364c8c1ae
SHA1

88cf0235f5cfcc071784c9c3989af84715a85cbe
SHA256

f2de5420e4dcf465c0049205fdd71c1a37556eb64fe1e5d7c8866f8c62b9ae27
SHA512

0b6d00b29bf164951b2dff3ffdbc39560f8163985da08bb88b42abc84b5cb071fa0485391bedd51d710328ef1c74eca10ba3c142c12752dbddf921682cbc6916
SSDEEP

12288:gONu9O6uJOB06GONu9O6uJOB06GONu9O6uJOB06G:NO/O/OW

Score

8^/10

upx

Malware Config

Signatures

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4868-133-0x0000000000400000-0x0000000000440000-memory.dmp	upx
behavioral2/files/0x0007000000022e2f-163.dat	upx
behavioral2/files/0x0007000000022e2f-164.dat	upx
behavioral2/memory/3396-171-0x0000000000400000-0x0000000000440000-memory.dmp	upx
behavioral2/memory/4868-192-0x0000000000400000-0x0000000000440000-memory.dmp	upx

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Option.bat	f2de5420e4dcf465c0049205fdd71c1a37556eb64fe1e5d7c8866f8c62b9ae27.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system\KavUpda.exe	f2de5420e4dcf465c0049205fdd71c1a37556eb64fe1e5d7c8866f8c62b9ae27.exe
File opened for modification	C:\Windows\system\KavUpda.exe	f2de5420e4dcf465c0049205fdd71c1a37556eb64fe1e5d7c8866f8c62b9ae27.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2304	sc.exe
4120	sc.exe
4700	sc.exe
4196	sc.exe
4488	sc.exe
3540	sc.exe
4724	sc.exe
2540	sc.exe

Runs net.exe

Runs regedit.exe 1 IoCs

pid	Process
2404	regedit.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4868	f2de5420e4dcf465c0049205fdd71c1a37556eb64fe1e5d7c8866f8c62b9ae27.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 1668	4868	f2de5420e4dcf465c0049205fdd71c1a37556eb64fe1e5d7c8866f8c62b9ae27.exe	87
PID 4868 wrote to memory of 1668	4868	f2de5420e4dcf465c0049205fdd71c1a37556eb64fe1e5d7c8866f8c62b9ae27.exe	87
PID 4868 wrote to memory of 1668	4868	f2de5420e4dcf465c0049205fdd71c1a37556eb64fe1e5d7c8866f8c62b9ae27.exe	87
PID 4868 wrote to memory of 2824	4868	f2de5420e4dcf465c0049205fdd71c1a37556eb64fe1e5d7c8866f8c62b9ae27.exe	84
PID 4868 wrote to memory of 2824	4868	f2de5420e4dcf465c0049205fdd71c1a37556eb64fe1e5d7c8866f8c62b9ae27.exe	84
PID 4868 wrote to memory of 2824	4868	f2de5420e4dcf465c0049205fdd71c1a37556eb64fe1e5d7c8866f8c62b9ae27.exe	84

C:\Users\Admin\AppData\Local\Temp\f2de5420e4dcf465c0049205fdd71c1a37556eb64fe1e5d7c8866f8c62b9ae27.exe
"C:\Users\Admin\AppData\Local\Temp\f2de5420e4dcf465c0049205fdd71c1a37556eb64fe1e5d7c8866f8c62b9ae27.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Windows\SysWOW64\net.exe
  net.exe start schedule /y
  2⤵
  PID:2824
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 start schedule /y
    3⤵
    PID:3184
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
  2⤵
  PID:1668
- C:\Windows\SysWOW64\net.exe
  net.exe stop srservice /y
  2⤵
  PID:1844
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop srservice /y
    3⤵
    PID:1620
- C:\Windows\SysWOW64\net.exe
  net.exe stop 360timeprot /y
  2⤵
  PID:4052
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop 360timeprot /y
    3⤵
    PID:3440
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\Windows\regedt32.sys
  2⤵
  - Runs regedit.exe
  PID:2404
- C:\Windows\SysWOW64\sc.exe
  C:\Windows\system32\sc.exe config srservice start= disabled
  2⤵
  - Launches sc.exe
  PID:3540
- C:\Windows\SysWOW64\sc.exe
  C:\Windows\system32\sc.exe config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  PID:4724
- C:\Windows\SysWOW64\sc.exe
  C:\Windows\system32\sc.exe config SharedAccess start= disabled
  2⤵
  - Launches sc.exe
  PID:2540
- C:\Windows\SysWOW64\sc.exe
  C:\Windows\system32\sc.exe config srservice start= disabled
  2⤵
  - Launches sc.exe
  PID:2304
- C:\Windows\SysWOW64\reg.exe
  C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
  2⤵
  PID:5040
- C:\Windows\SysWOW64\reg.exe
  C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
  2⤵
  PID:4996
- C:\Windows\SysWOW64\net.exe
  net.exe stop wuauserv /y
  2⤵
  PID:2000
- C:\Windows\SysWOW64\net.exe
  net.exe stop sharedaccess /y
  2⤵
  PID:3972
- C:\Windows\SysWOW64\net.exe
  net.exe stop wscsvc /y
  2⤵
  PID:3700
- C:\Windows\SysWOW64\cmd.exe
  cmd /c at 2:11:37 PM C:\Windows\Sysinf.bat
  2⤵
  PID:2108
- C:\Windows\SysWOW64\cmd.exe
  cmd /c at 2:08:37 PM C:\Windows\Sysinf.bat
  2⤵
  PID:8
- C:\Windows\SysWOW64\At.exe
  At.exe 2:09:35 PM C:\Windows\Help\HelpCat.exe
  2⤵
  PID:316
- C:\Windows\system\KavUpda.exe
  C:\Windows\system\KavUpda.exe
  2⤵
  PID:3396
- - C:\Windows\SysWOW64\net.exe
    net.exe start schedule /y
    3⤵
    PID:1800
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
    3⤵
    PID:3572
- - C:\Windows\SysWOW64\net.exe
    net.exe stop sharedaccess /y
    3⤵
    PID:556
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop sharedaccess /y
      4⤵
      PID:4716
- - C:\Windows\SysWOW64\sc.exe
    C:\Windows\system32\sc.exe config srservice start= disabled
    3⤵
    - Launches sc.exe
    PID:4120
- - C:\Windows\SysWOW64\sc.exe
    C:\Windows\system32\sc.exe config wscsvc start= disabled
    3⤵
    - Launches sc.exe
    PID:4700
- - C:\Windows\SysWOW64\sc.exe
    C:\Windows\system32\sc.exe config SharedAccess start= disabled
    3⤵
    - Launches sc.exe
    PID:4196
- - C:\Windows\SysWOW64\sc.exe
    C:\Windows\system32\sc.exe config srservice start= disabled
    3⤵
    - Launches sc.exe
    PID:4488
- - C:\Windows\SysWOW64\net.exe
    net.exe stop 360timeprot /y
    3⤵
    PID:2796
- - C:\Windows\SysWOW64\net.exe
    net.exe stop srservice /y
    3⤵
    PID:824
- - C:\Windows\SysWOW64\net.exe
    net.exe stop wuauserv /y
    3⤵
    PID:4524
- - C:\Windows\SysWOW64\net.exe
    net.exe stop wscsvc /y
    3⤵
    PID:2004
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c at 2:11:44 PM C:\Windows\Sysinf.bat
    3⤵
    PID:3888
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c at 2:08:44 PM C:\Windows\Sysinf.bat
    3⤵
    PID:3036
- - C:\Windows\SysWOW64\At.exe
    At.exe 2:09:42 PM C:\Windows\Help\HelpCat.exe
    3⤵
    PID:5008

C:\Windows\SysWOW64\at.exe
at 2:11:37 PM C:\Windows\Sysinf.bat
1⤵
PID:3596

C:\Windows\SysWOW64\at.exe
at 2:08:37 PM C:\Windows\Sysinf.bat
1⤵
PID:5104

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wuauserv /y
1⤵
PID:2952

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sharedaccess /y
1⤵
PID:3120

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wscsvc /y
1⤵
PID:5064

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start schedule /y
1⤵
PID:4680

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wuauserv /y
1⤵
PID:4332

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop srservice /y
1⤵
PID:1516

C:\Windows\SysWOW64\at.exe
at 2:11:44 PM C:\Windows\Sysinf.bat
1⤵
PID:2916

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop 360timeprot /y
1⤵
PID:1612

C:\Windows\SysWOW64\at.exe
at 2:08:44 PM C:\Windows\Sysinf.bat
1⤵
PID:4028

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wscsvc /y
1⤵
PID:1616

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Option.bat

Filesize
82B

MD5
3f7fbd2eb34892646e93fd5e6e343512

SHA1
265ac1061b54f62350fb7a5f57e566454d013a66

SHA256
e75e8d9bfc7a2876d908305186c3656e9de2a4af7f6927ccc6d8c812645abbc7

SHA512
53d40eb2f05a23464fbf06193868e7cb30cf0df3da53586a75123fb2c37b29cdddda287ce134809d16a559d87fb20aee0e8add22d396fcb7a55f9a753739b140

Download Submit
C:\Windows\SysWOW64\Option.bat

Filesize
82B

MD5
3f7fbd2eb34892646e93fd5e6e343512

SHA1
265ac1061b54f62350fb7a5f57e566454d013a66

SHA256
e75e8d9bfc7a2876d908305186c3656e9de2a4af7f6927ccc6d8c812645abbc7

SHA512
53d40eb2f05a23464fbf06193868e7cb30cf0df3da53586a75123fb2c37b29cdddda287ce134809d16a559d87fb20aee0e8add22d396fcb7a55f9a753739b140

Download Submit
C:\Windows\Sysinf.bat

Filesize
460B

MD5
7db3d565d6ddbe65a8b0e093910e7dcd

SHA1
d4804e6180c6e74ba79d3343f2f2ccb15e502f12

SHA256
a2778cb87fd88c7508ffd506a8ff8d58d0ffc02156f846956e5e99c6cb3d2f3f

SHA512
0b3d1d0f44feba9dd78903ff77fdeaea834d930990a86641fb2e4ce04da280d33f6bee0ae0b1320e4070cbe20824062e45b52e5cad797c5985d8e31dce1ef82b

Download Submit
C:\Windows\System\KavUpda.exe

Filesize
114KB

MD5
04af5a581aa5e2fa8e783db775777237

SHA1
df9006993a92e5bcf3822048fe38af3665412b9d

SHA256
d60b84122cb9c5c7e1dfde293eac886c7b3410aee201ec5323b727641c381a2f

SHA512
88d997b3033850f906136afd7f203fd10b1c55943d4404c819678c491c9debc38755f4782d142cfc972bac722739dd1aa7e7dfbab1ec0369a4fb354ae08e2c28

Download Submit
C:\Windows\regedt32.sys

Filesize
2KB

MD5
e7d7ec66bd61fac3843c98650b0c68f6

SHA1
a15ae06e1be51038863650746368a71024539bac

SHA256
6475d5ecc14fea090774be55723d2d52b7ec7670527a7dbd61edf28c77944cb8

SHA512
ac9e9893f5a0af03957731445f63279085f164e9a968d706a99d13012e4459314a7ccc32dc48f62379d69e21a0953c13543c9ded38b5ad5fbc346aa442af1ae6

Download Submit
C:\Windows\system\KavUpda.exe

Filesize
116KB

MD5
afd1e35d0ff57959871765aaf389cf58

SHA1
721fae7f82874ea98095f828771bcdde278bf90a

SHA256
0bfc268e5775ff7b7f1cb34d1ec07dc37ec66e7e5f352b6903a302c1280720ee

SHA512
b6b591818fc642e6811546dc3c3ac90d6987530c0b57a3d3b361bda071eeb723481824a09c2a72e8ae214855c51287081924b2fa272e1d31b7c8baf764054429

Download Submit
memory/3396-171-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4868-192-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4868-133-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download