Analysis
-
max time kernel
162s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
03/12/2022, 19:27
Static task
static1
Behavioral task
behavioral1
Sample
4f91dbb8d2b1978b4c23b4253fe492e4fa88d49e8d8ca67b0c64c2bb97f87c20.exe
Resource
win7-20220901-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
4f91dbb8d2b1978b4c23b4253fe492e4fa88d49e8d8ca67b0c64c2bb97f87c20.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
4f91dbb8d2b1978b4c23b4253fe492e4fa88d49e8d8ca67b0c64c2bb97f87c20.exe
-
Size
208KB
-
MD5
08038ca0710722b36ff7eabe5cf20530
-
SHA1
0adf74409cc1a76d0edd73378d679e6c000e688c
-
SHA256
4f91dbb8d2b1978b4c23b4253fe492e4fa88d49e8d8ca67b0c64c2bb97f87c20
-
SHA512
417fdcdee2a00d3e66715a55acc7cdaf374444075505be000b14311ac8f964649d7c3702912824fd48d463c81c34904ac90fab6ee42a54cb677e6d9f53947a06
-
SSDEEP
3072:AMPD2WwtpSeUteWvlBLswASQMy6nlNCX4iv:AztpFCLsuh+
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 4f91dbb8d2b1978b4c23b4253fe492e4fa88d49e8d8ca67b0c64c2bb97f87c20.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" kdcoan.exe -
Executes dropped EXE 1 IoCs
pid Process 1880 kdcoan.exe -
Loads dropped DLL 2 IoCs
pid Process 2032 4f91dbb8d2b1978b4c23b4253fe492e4fa88d49e8d8ca67b0c64c2bb97f87c20.exe 2032 4f91dbb8d2b1978b4c23b4253fe492e4fa88d49e8d8ca67b0c64c2bb97f87c20.exe -
Adds Run key to start application 2 TTPs 29 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\kdcoan = "C:\\Users\\Admin\\kdcoan.exe /d" kdcoan.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\kdcoan = "C:\\Users\\Admin\\kdcoan.exe /b" kdcoan.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\kdcoan = "C:\\Users\\Admin\\kdcoan.exe /t" kdcoan.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\kdcoan = "C:\\Users\\Admin\\kdcoan.exe /f" kdcoan.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\kdcoan = "C:\\Users\\Admin\\kdcoan.exe /i" kdcoan.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\kdcoan = "C:\\Users\\Admin\\kdcoan.exe /z" kdcoan.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\kdcoan = "C:\\Users\\Admin\\kdcoan.exe /g" 4f91dbb8d2b1978b4c23b4253fe492e4fa88d49e8d8ca67b0c64c2bb97f87c20.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\kdcoan = "C:\\Users\\Admin\\kdcoan.exe /s" kdcoan.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\kdcoan = "C:\\Users\\Admin\\kdcoan.exe /v" kdcoan.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\kdcoan = "C:\\Users\\Admin\\kdcoan.exe /y" kdcoan.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\kdcoan = "C:\\Users\\Admin\\kdcoan.exe /n" kdcoan.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\kdcoan = "C:\\Users\\Admin\\kdcoan.exe /p" kdcoan.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\kdcoan = "C:\\Users\\Admin\\kdcoan.exe /o" kdcoan.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\kdcoan = "C:\\Users\\Admin\\kdcoan.exe /x" kdcoan.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\kdcoan = "C:\\Users\\Admin\\kdcoan.exe /q" kdcoan.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ kdcoan.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\kdcoan = "C:\\Users\\Admin\\kdcoan.exe /r" kdcoan.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\kdcoan = "C:\\Users\\Admin\\kdcoan.exe /m" kdcoan.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\kdcoan = "C:\\Users\\Admin\\kdcoan.exe /k" kdcoan.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\kdcoan = "C:\\Users\\Admin\\kdcoan.exe /a" kdcoan.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\kdcoan = "C:\\Users\\Admin\\kdcoan.exe /e" kdcoan.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 4f91dbb8d2b1978b4c23b4253fe492e4fa88d49e8d8ca67b0c64c2bb97f87c20.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\kdcoan = "C:\\Users\\Admin\\kdcoan.exe /h" kdcoan.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\kdcoan = "C:\\Users\\Admin\\kdcoan.exe /g" kdcoan.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\kdcoan = "C:\\Users\\Admin\\kdcoan.exe /j" kdcoan.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\kdcoan = "C:\\Users\\Admin\\kdcoan.exe /l" kdcoan.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\kdcoan = "C:\\Users\\Admin\\kdcoan.exe /u" kdcoan.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\kdcoan = "C:\\Users\\Admin\\kdcoan.exe /w" kdcoan.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\kdcoan = "C:\\Users\\Admin\\kdcoan.exe /c" kdcoan.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2032 4f91dbb8d2b1978b4c23b4253fe492e4fa88d49e8d8ca67b0c64c2bb97f87c20.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe 1880 kdcoan.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2032 4f91dbb8d2b1978b4c23b4253fe492e4fa88d49e8d8ca67b0c64c2bb97f87c20.exe 1880 kdcoan.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2032 wrote to memory of 1880 2032 4f91dbb8d2b1978b4c23b4253fe492e4fa88d49e8d8ca67b0c64c2bb97f87c20.exe 26 PID 2032 wrote to memory of 1880 2032 4f91dbb8d2b1978b4c23b4253fe492e4fa88d49e8d8ca67b0c64c2bb97f87c20.exe 26 PID 2032 wrote to memory of 1880 2032 4f91dbb8d2b1978b4c23b4253fe492e4fa88d49e8d8ca67b0c64c2bb97f87c20.exe 26 PID 2032 wrote to memory of 1880 2032 4f91dbb8d2b1978b4c23b4253fe492e4fa88d49e8d8ca67b0c64c2bb97f87c20.exe 26
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f91dbb8d2b1978b4c23b4253fe492e4fa88d49e8d8ca67b0c64c2bb97f87c20.exe"C:\Users\Admin\AppData\Local\Temp\4f91dbb8d2b1978b4c23b4253fe492e4fa88d49e8d8ca67b0c64c2bb97f87c20.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\kdcoan.exe"C:\Users\Admin\kdcoan.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1880
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
208KB
MD5ec8a7b84be7e3941a9a812f26f154474
SHA1b3c824e241d8a8ad05112b9696da6dca4fa58159
SHA2568c56dc6da56e3d169ddb431e538f415eba86c82c539caf5ae1718f7fc4bee9a3
SHA51237831b9cd57483a85ab84489fa79e16c4b1e557b78a975c1486fe3368950305f99e8e0b8058f2b9f0351eba06915244c8f35c5c6a361256abadf9710740b0d7a
-
Filesize
208KB
MD5ec8a7b84be7e3941a9a812f26f154474
SHA1b3c824e241d8a8ad05112b9696da6dca4fa58159
SHA2568c56dc6da56e3d169ddb431e538f415eba86c82c539caf5ae1718f7fc4bee9a3
SHA51237831b9cd57483a85ab84489fa79e16c4b1e557b78a975c1486fe3368950305f99e8e0b8058f2b9f0351eba06915244c8f35c5c6a361256abadf9710740b0d7a
-
Filesize
208KB
MD5ec8a7b84be7e3941a9a812f26f154474
SHA1b3c824e241d8a8ad05112b9696da6dca4fa58159
SHA2568c56dc6da56e3d169ddb431e538f415eba86c82c539caf5ae1718f7fc4bee9a3
SHA51237831b9cd57483a85ab84489fa79e16c4b1e557b78a975c1486fe3368950305f99e8e0b8058f2b9f0351eba06915244c8f35c5c6a361256abadf9710740b0d7a
-
Filesize
208KB
MD5ec8a7b84be7e3941a9a812f26f154474
SHA1b3c824e241d8a8ad05112b9696da6dca4fa58159
SHA2568c56dc6da56e3d169ddb431e538f415eba86c82c539caf5ae1718f7fc4bee9a3
SHA51237831b9cd57483a85ab84489fa79e16c4b1e557b78a975c1486fe3368950305f99e8e0b8058f2b9f0351eba06915244c8f35c5c6a361256abadf9710740b0d7a