a73a8757e205e2504d3c92f81891985f9f6e1fc1c29642c968827c7cebb1fd80

Analysis

max time kernel
93s
max time network
91s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
23/04/2023, 14:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

kg.exe
Size

262KB
MD5

44fec34772267f083b7102b800697201
SHA1

dc21fe79533f9d28f9946017263c9bbc13b2374c
SHA256

a73a8757e205e2504d3c92f81891985f9f6e1fc1c29642c968827c7cebb1fd80
SHA512

9faaf252e31137148c242bdb8ad93eb94aad2aead8246567973ca3f16e62cce158a563c36a6cee36a1f7bad59a0c07423510c15ce487d2707188289ee4b9b4be
SSDEEP

6144:Ih8rP7hlkdB0fdJqxIcN3v2HOEEQBJoucxswHzBOsoSF:LrP73kT0FJQIcRyOnNuczBOsoS

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/700-123-0x0000000000400000-0x00000000004C0000-memory.dmp	upx
behavioral1/memory/700-125-0x0000000000400000-0x00000000004C0000-memory.dmp	upx
behavioral1/memory/700-126-0x0000000000400000-0x00000000004C0000-memory.dmp	upx
behavioral1/memory/700-127-0x0000000000400000-0x00000000004C0000-memory.dmp	upx
behavioral1/memory/700-128-0x0000000000400000-0x00000000004C0000-memory.dmp	upx
behavioral1/memory/700-129-0x0000000000400000-0x00000000004C0000-memory.dmp	upx

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10bae36eec75d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31028716"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00e6ea6eec75d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\LowRegistry\Shell Extensions\Cached	PaintStudio.View.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8F1D5709-E1DF-11ED-9346-6AF5EDCA6182} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31028716"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000af653a432a26840a7b5ec4575ca9dcc000000000200000000001066000000010000200000009f0206f812cd23a5ccb7e8cb7282dfc887b7b3b5da889d6b24017a42cde748b8000000000e8000000002000020000000cd4eb09e8f0d63a00ad628088e32b622923f16481f9855c5c88e07cea098299f200000001279959be593ed5742c75183b0bcb80634e86762a6d6fe9022f8a875104e911e40000000a4b92b35e07c0b047aff8448cc92c17d7e2f203815a005fdf1e74f470236da9dffd8b6c4b53b3ca59a7d62e1bd420add6b4d0bb5bf856dddd6a4ddc5e6cf9976	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000af653a432a26840a7b5ec4575ca9dcc00000000020000000000106600000001000020000000d7660836b14a8550f6faf4b37762d75203e02406d30120b82bcc8de1605d2716000000000e80000000020000200000002e72a40b5c509d5c5e3c7be08374a07885ba3c40d2d6ed416ab615e7a86e192d20000000e0a853557e14f6415e6baf1b3d79674e2c5683b94f88c3da55b4f93f6f25223d4000000083f60aa2b6a04e5679e79732a374769c3de6ebb5b68993d756734b92bc22f409b3962830c1688cc67150233926e5d42878df098797a955c6d544a7c24fd37ea9	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1683076731"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\LowRegistry	PaintStudio.View.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1683076731"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Internet Explorer\LowRegistry\Shell Extensions	PaintStudio.View.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4984	PaintStudio.View.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4136	mspaint.exe
4136	mspaint.exe
4984	PaintStudio.View.exe
4984	PaintStudio.View.exe
4984	PaintStudio.View.exe
4984	PaintStudio.View.exe
4984	PaintStudio.View.exe
4984	PaintStudio.View.exe
4984	PaintStudio.View.exe
4984	PaintStudio.View.exe
4984	PaintStudio.View.exe
4984	PaintStudio.View.exe
4984	PaintStudio.View.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: 33	1100	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1100	AUDIODG.EXE
Token: SeDebugPrivilege	4984	PaintStudio.View.exe
Token: SeDebugPrivilege	4984	PaintStudio.View.exe
Token: SeDebugPrivilege	4984	PaintStudio.View.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
700	kg.exe
700	kg.exe
2244	iexplore.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2244	iexplore.exe
2244	iexplore.exe
4588	IEXPLORE.EXE
4588	IEXPLORE.EXE
4588	IEXPLORE.EXE
4136	mspaint.exe
4984	PaintStudio.View.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 4588	2244	iexplore.exe	69
PID 2244 wrote to memory of 4588	2244	iexplore.exe	69
PID 2244 wrote to memory of 4588	2244	iexplore.exe	69

C:\Users\Admin\AppData\Local\Temp\kg.exe
"C:\Users\Admin\AppData\Local\Temp\kg.exe"
1⤵
- Suspicious use of FindShellTrayWindow
PID:700

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x328
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1100

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -nohome
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2244 CREDAT:82945 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:4588

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\UnprotectEnable.png" /ForceBootstrapPaint3D
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4136

C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe
"C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe" -ServerName:Microsoft.MSPaint.AppX437q68k2qc2asvaagas2prv9tjej6ja9.mca
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4984

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\Projects\Projects.json

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
memory/700-123-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/700-124-0x0000000000930000-0x0000000000931000-memory.dmp

Filesize
4KB

Download
memory/700-125-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/700-126-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/700-127-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/700-128-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/700-129-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download