gh0strat | 872372928f197725ff8d10148f26189f4fe4c58122c0066905549254fc52cb3e

Analysis

max time kernel
132s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/12/2023, 20:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f6db15cdbb2137131ba70aa0e63b0603.exe
Size

1.2MB
MD5

f6db15cdbb2137131ba70aa0e63b0603
SHA1

13c5f75ed3e3aa10d7aa283cdc70c8250f92e73a
SHA256

872372928f197725ff8d10148f26189f4fe4c58122c0066905549254fc52cb3e
SHA512

a6ef54fb8ba9a8a52a88f4b43937dd53e7cdc2c507e5168ebc106adc57db2e6087364f1c1690005ba5979c31f07514076c5dc19bf18f9d2dfbe8bf70fc0e3f86
SSDEEP

12288:UZWtI6RkZBlOB0JuROB0tyJP7jVOWBuOB0JuROB0WLyBwYhxMJROuD6:UuhaZBlOtOuydjpBuOtOJyBXM7Zu

Score

10^/10

gh0strat evasion persistence rat

Malware Config

Signatures

Gh0st RAT payload 4 IoCs

resource	yara_rule
behavioral1/files/0x0007000000016d80-42.dat	family_gh0strat
behavioral1/files/0x0007000000016d80-31.dat	family_gh0strat
behavioral1/files/0x0007000000016d80-27.dat	family_gh0strat
behavioral1/files/0x0007000000016d80-25.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	regedit.exe

Blocks application from running via registry modification 17 IoCs

Adds application to list of disallowed applications.

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\7 = "RavStub.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\12 = "KPFW32X.EXE"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "avp.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "RfwMain.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\5 = "CCenter.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\6 = "RavMon.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\8 = "RavService.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\13 = "KAVPFW.EXE"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4 = "RavMoD.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\10 = "rfwcfg.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\14 = "KAV32.EXE"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\15 = "KAVStart.EXE"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3 = "Rfwsrv.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\9 = "Rav.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\11 = "KPFW32.EXE"	regedit.exe

Sets file execution options in registry 2 TTPs 20 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.EXE	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "D:\\RECYCLER\\????8.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rfwsrv.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe\Debugger = "D:\\RECYCLER\\????8.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMoD.exe\Debugger = "D:\\RECYCLER\\????8.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RfwMain.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe\Debugger = "D:\\RECYCLER\\????8.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe\Debugger = "D:\\RECYCLER\\????8.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.EXE\Debugger = "D:\\RECYCLER\\????8.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "D:\\RECYCLER\\????8.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RfwMain.exe\Debugger = "D:\\RECYCLER\\????8.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rfwsrv.exe\Debugger = "D:\\RECYCLER\\????8.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMoD.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe\Debugger = "D:\\RECYCLER\\????8.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	regedit.exe

Executes dropped EXE 1 IoCs

pid	Process
2168	KavUpda.exe

Loads dropped DLL 2 IoCs

pid	Process
1984	f6db15cdbb2137131ba70aa0e63b0603.exe
1984	f6db15cdbb2137131ba70aa0e63b0603.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	F:\Autorun.inf	KavUpda.exe
File opened for modification	C:\Autorun.inf	KavUpda.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Option.bat	f6db15cdbb2137131ba70aa0e63b0603.exe
File opened for modification	C:\Windows\SysWOW64\Option.bat	KavUpda.exe
File opened for modification	C:\Windows\SysWOW64\Folderdir	f6db15cdbb2137131ba70aa0e63b0603.exe

Drops file in Program Files directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	f6db15cdbb2137131ba70aa0e63b0603.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe	f6db15cdbb2137131ba70aa0e63b0603.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe	f6db15cdbb2137131ba70aa0e63b0603.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\java.exe	f6db15cdbb2137131ba70aa0e63b0603.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	f6db15cdbb2137131ba70aa0e63b0603.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	f6db15cdbb2137131ba70aa0e63b0603.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe	f6db15cdbb2137131ba70aa0e63b0603.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe	f6db15cdbb2137131ba70aa0e63b0603.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe	f6db15cdbb2137131ba70aa0e63b0603.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe	f6db15cdbb2137131ba70aa0e63b0603.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	f6db15cdbb2137131ba70aa0e63b0603.exe
File opened for modification	C:\Program Files\DVD Maker\DVDMaker.exe	f6db15cdbb2137131ba70aa0e63b0603.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	f6db15cdbb2137131ba70aa0e63b0603.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	f6db15cdbb2137131ba70aa0e63b0603.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe	f6db15cdbb2137131ba70aa0e63b0603.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe	f6db15cdbb2137131ba70aa0e63b0603.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe	f6db15cdbb2137131ba70aa0e63b0603.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	f6db15cdbb2137131ba70aa0e63b0603.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe	f6db15cdbb2137131ba70aa0e63b0603.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe	f6db15cdbb2137131ba70aa0e63b0603.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe	f6db15cdbb2137131ba70aa0e63b0603.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	f6db15cdbb2137131ba70aa0e63b0603.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	f6db15cdbb2137131ba70aa0e63b0603.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	f6db15cdbb2137131ba70aa0e63b0603.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe	f6db15cdbb2137131ba70aa0e63b0603.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Help\HelpCat.exe	f6db15cdbb2137131ba70aa0e63b0603.exe
File created	C:\Windows\regedt32.sys	f6db15cdbb2137131ba70aa0e63b0603.exe
File created	C:\Windows\Sysinf.bat	f6db15cdbb2137131ba70aa0e63b0603.exe
File opened for modification	C:\Windows\system\KavUpda.exe	KavUpda.exe
File opened for modification	C:\Windows\Sysinf.bat	KavUpda.exe
File opened for modification	C:\Windows\regedt32.sys	KavUpda.exe
File created	C:\Windows\regedt32.sys	KavUpda.exe
File created	C:\Windows\system\KavUpda.exe	f6db15cdbb2137131ba70aa0e63b0603.exe
File opened for modification	C:\Windows\system\KavUpda.exe	f6db15cdbb2137131ba70aa0e63b0603.exe
File created	C:\Windows\Help\HelpCat.exe	f6db15cdbb2137131ba70aa0e63b0603.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1768	sc.exe
1300	sc.exe
1816	sc.exe
1568	sc.exe
2516	sc.exe
2768	sc.exe
2480	sc.exe
2116	sc.exe

Runs net.exe

Runs regedit.exe 1 IoCs

pid	Process
3052	regedit.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: SeIncBasePriorityPrivilege	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: 33	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: SeIncBasePriorityPrivilege	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: 33	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: SeIncBasePriorityPrivilege	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: 33	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: SeIncBasePriorityPrivilege	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: 33	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: SeIncBasePriorityPrivilege	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: 33	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: SeIncBasePriorityPrivilege	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: 33	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: SeIncBasePriorityPrivilege	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: 33	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: SeIncBasePriorityPrivilege	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: 33	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: SeIncBasePriorityPrivilege	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: 33	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: SeIncBasePriorityPrivilege	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: 33	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: SeIncBasePriorityPrivilege	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: 33	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: SeIncBasePriorityPrivilege	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: 33	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: SeIncBasePriorityPrivilege	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: 33	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: SeIncBasePriorityPrivilege	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: 33	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: SeIncBasePriorityPrivilege	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: 33	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: SeIncBasePriorityPrivilege	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: 33	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: SeIncBasePriorityPrivilege	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: 33	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: SeIncBasePriorityPrivilege	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: 33	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: SeIncBasePriorityPrivilege	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: 33	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: SeIncBasePriorityPrivilege	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: 33	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: SeIncBasePriorityPrivilege	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: 33	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: SeIncBasePriorityPrivilege	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: 33	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: SeIncBasePriorityPrivilege	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: 33	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: SeIncBasePriorityPrivilege	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: 33	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: SeIncBasePriorityPrivilege	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: 33	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: SeIncBasePriorityPrivilege	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: 33	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: SeIncBasePriorityPrivilege	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: 33	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: SeIncBasePriorityPrivilege	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: 33	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: SeIncBasePriorityPrivilege	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: 33	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: SeIncBasePriorityPrivilege	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: 33	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: SeIncBasePriorityPrivilege	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: 33	1984	f6db15cdbb2137131ba70aa0e63b0603.exe
Token: SeIncBasePriorityPrivilege	1984	f6db15cdbb2137131ba70aa0e63b0603.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1984	f6db15cdbb2137131ba70aa0e63b0603.exe
2168	KavUpda.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 3012	1984	f6db15cdbb2137131ba70aa0e63b0603.exe	18
PID 1984 wrote to memory of 3012	1984	f6db15cdbb2137131ba70aa0e63b0603.exe	18
PID 1984 wrote to memory of 3012	1984	f6db15cdbb2137131ba70aa0e63b0603.exe	18
PID 1984 wrote to memory of 3012	1984	f6db15cdbb2137131ba70aa0e63b0603.exe	18
PID 1984 wrote to memory of 2876	1984	f6db15cdbb2137131ba70aa0e63b0603.exe	131
PID 1984 wrote to memory of 2876	1984	f6db15cdbb2137131ba70aa0e63b0603.exe	131
PID 1984 wrote to memory of 2876	1984	f6db15cdbb2137131ba70aa0e63b0603.exe	131
PID 1984 wrote to memory of 2876	1984	f6db15cdbb2137131ba70aa0e63b0603.exe	131
PID 2876 wrote to memory of 680	2876	attrib.exe	14
PID 2876 wrote to memory of 680	2876	attrib.exe	14
PID 2876 wrote to memory of 680	2876	attrib.exe	14
PID 2876 wrote to memory of 680	2876	attrib.exe	14
PID 1984 wrote to memory of 1072	1984	f6db15cdbb2137131ba70aa0e63b0603.exe	74
PID 1984 wrote to memory of 1072	1984	f6db15cdbb2137131ba70aa0e63b0603.exe	74
PID 1984 wrote to memory of 1072	1984	f6db15cdbb2137131ba70aa0e63b0603.exe	74
PID 1984 wrote to memory of 1072	1984	f6db15cdbb2137131ba70aa0e63b0603.exe	74
PID 1984 wrote to memory of 832	1984	f6db15cdbb2137131ba70aa0e63b0603.exe	73
PID 1984 wrote to memory of 832	1984	f6db15cdbb2137131ba70aa0e63b0603.exe	73
PID 1984 wrote to memory of 832	1984	f6db15cdbb2137131ba70aa0e63b0603.exe	73
PID 1984 wrote to memory of 832	1984	f6db15cdbb2137131ba70aa0e63b0603.exe	73
PID 1984 wrote to memory of 2244	1984	f6db15cdbb2137131ba70aa0e63b0603.exe	70
PID 1984 wrote to memory of 2244	1984	f6db15cdbb2137131ba70aa0e63b0603.exe	70
PID 1984 wrote to memory of 2244	1984	f6db15cdbb2137131ba70aa0e63b0603.exe	70
PID 1984 wrote to memory of 2244	1984	f6db15cdbb2137131ba70aa0e63b0603.exe	70
PID 1984 wrote to memory of 856	1984	f6db15cdbb2137131ba70aa0e63b0603.exe	69
PID 1984 wrote to memory of 856	1984	f6db15cdbb2137131ba70aa0e63b0603.exe	69
PID 1984 wrote to memory of 856	1984	f6db15cdbb2137131ba70aa0e63b0603.exe	69
PID 1984 wrote to memory of 856	1984	f6db15cdbb2137131ba70aa0e63b0603.exe	69
PID 832 wrote to memory of 2608	832	cmd.exe	66
PID 832 wrote to memory of 2608	832	cmd.exe	66
PID 832 wrote to memory of 2608	832	cmd.exe	66
PID 832 wrote to memory of 2608	832	cmd.exe	66
PID 1984 wrote to memory of 2596	1984	f6db15cdbb2137131ba70aa0e63b0603.exe	33
PID 1984 wrote to memory of 2596	1984	f6db15cdbb2137131ba70aa0e63b0603.exe	33
PID 1984 wrote to memory of 2596	1984	f6db15cdbb2137131ba70aa0e63b0603.exe	33
PID 1984 wrote to memory of 2596	1984	f6db15cdbb2137131ba70aa0e63b0603.exe	33
PID 1984 wrote to memory of 2304	1984	f6db15cdbb2137131ba70aa0e63b0603.exe	65
PID 1984 wrote to memory of 2304	1984	f6db15cdbb2137131ba70aa0e63b0603.exe	65
PID 1984 wrote to memory of 2304	1984	f6db15cdbb2137131ba70aa0e63b0603.exe	65
PID 1984 wrote to memory of 2304	1984	f6db15cdbb2137131ba70aa0e63b0603.exe	65
PID 856 wrote to memory of 2404	856	net.exe	64
PID 856 wrote to memory of 2404	856	net.exe	64
PID 856 wrote to memory of 2404	856	net.exe	64
PID 856 wrote to memory of 2404	856	net.exe	64
PID 2244 wrote to memory of 2728	2244	cmd.exe	62
PID 2244 wrote to memory of 2728	2244	cmd.exe	62
PID 2244 wrote to memory of 2728	2244	cmd.exe	62
PID 2244 wrote to memory of 2728	2244	cmd.exe	62
PID 1984 wrote to memory of 2764	1984	f6db15cdbb2137131ba70aa0e63b0603.exe	60
PID 1984 wrote to memory of 2764	1984	f6db15cdbb2137131ba70aa0e63b0603.exe	60
PID 1984 wrote to memory of 2764	1984	f6db15cdbb2137131ba70aa0e63b0603.exe	60
PID 1984 wrote to memory of 2764	1984	f6db15cdbb2137131ba70aa0e63b0603.exe	60
PID 1984 wrote to memory of 1608	1984	f6db15cdbb2137131ba70aa0e63b0603.exe	59
PID 1984 wrote to memory of 1608	1984	f6db15cdbb2137131ba70aa0e63b0603.exe	59
PID 1984 wrote to memory of 1608	1984	f6db15cdbb2137131ba70aa0e63b0603.exe	59
PID 1984 wrote to memory of 1608	1984	f6db15cdbb2137131ba70aa0e63b0603.exe	59
PID 2596 wrote to memory of 2800	2596	net.exe	57
PID 2596 wrote to memory of 2800	2596	net.exe	57
PID 2596 wrote to memory of 2800	2596	net.exe	57
PID 2596 wrote to memory of 2800	2596	net.exe	57
PID 1984 wrote to memory of 2116	1984	f6db15cdbb2137131ba70aa0e63b0603.exe	56
PID 1984 wrote to memory of 2116	1984	f6db15cdbb2137131ba70aa0e63b0603.exe	56
PID 1984 wrote to memory of 2116	1984	f6db15cdbb2137131ba70aa0e63b0603.exe	56
PID 1984 wrote to memory of 2116	1984	f6db15cdbb2137131ba70aa0e63b0603.exe	56

Views/modifies file attributes 1 TTPs 16 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2624	attrib.exe
292	attrib.exe
1772	attrib.exe
1904	attrib.exe
2820	attrib.exe
904	attrib.exe
1744	attrib.exe
2700	attrib.exe
2640	attrib.exe
2916	attrib.exe
1668	attrib.exe
2132	attrib.exe
2876	attrib.exe
832	attrib.exe
2940	attrib.exe
1276	attrib.exe

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start schedule /y
1⤵
PID:680

C:\Windows\SysWOW64\net.exe
net.exe start schedule /y
1⤵
PID:2876

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Windows\system32\Option.bat
1⤵
PID:3012

C:\Users\Admin\AppData\Local\Temp\f6db15cdbb2137131ba70aa0e63b0603.exe
"C:\Users\Admin\AppData\Local\Temp\f6db15cdbb2137131ba70aa0e63b0603.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\SysWOW64\net.exe
  net.exe stop sharedaccess /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2596
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop sharedaccess /y
    3⤵
    PID:2800
- C:\Windows\SysWOW64\reg.exe
  C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
  2⤵
  PID:3060
- C:\Windows\SysWOW64\reg.exe
  C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
  2⤵
  PID:3048
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\Windows\regedt32.sys
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Blocks application from running via registry modification
  - Sets file execution options in registry
  - Runs regedit.exe
  PID:3052
- C:\Windows\SysWOW64\sc.exe
  C:\Windows\system32\sc.exe config srservice start= disabled
  2⤵
  - Launches sc.exe
  PID:2516
- C:\Windows\SysWOW64\sc.exe
  C:\Windows\system32\sc.exe config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  PID:2768
- C:\Windows\system\KavUpda.exe
  C:\Windows\system\KavUpda.exe
  2⤵
  - Executes dropped EXE
  - Drops autorun.inf file
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:2168
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
    3⤵
    PID:2312
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:1648
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:1772
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
    3⤵
    PID:2072
- - C:\Windows\SysWOW64\sc.exe
    C:\Windows\system32\sc.exe config srservice start= disabled
    3⤵
    - Launches sc.exe
    PID:1768
- - C:\Windows\SysWOW64\sc.exe
    C:\Windows\system32\sc.exe config wscsvc start= disabled
    3⤵
    - Launches sc.exe
    PID:1300
- - C:\Windows\SysWOW64\sc.exe
    C:\Windows\system32\sc.exe config SharedAccess start= disabled
    3⤵
    - Launches sc.exe
    PID:1816
- - C:\Windows\SysWOW64\sc.exe
    C:\Windows\system32\sc.exe config srservice start= disabled
    3⤵
    - Launches sc.exe
    PID:1568
- - C:\Windows\SysWOW64\net.exe
    net.exe stop 360timeprot /y
    3⤵
    PID:1932
- - C:\Windows\SysWOW64\net.exe
    net.exe stop srservice /y
    3⤵
    PID:2928
- - C:\Windows\SysWOW64\net.exe
    net.exe stop wuauserv /y
    3⤵
    PID:2620
- - C:\Windows\SysWOW64\net.exe
    net.exe stop sharedaccess /y
    3⤵
    PID:2504
- - C:\Windows\SysWOW64\net.exe
    net.exe stop wscsvc /y
    3⤵
    PID:1376
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c at 11:45:44 AM C:\Windows\Sysinf.bat
    3⤵
    PID:552
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c at 11:42:44 AM C:\Windows\Sysinf.bat
    3⤵
    PID:1496
- - C:\Windows\SysWOW64\At.exe
    At.exe 11:43:42 AM C:\Windows\Help\HelpCat.exe
    3⤵
    PID:292
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:2112
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r C:\Autorun.inf\*.* /s /d
      4⤵
      Suspicious use of WriteProcessMemory
      Views/modifies file attributes
      PID:2876
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:1552
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:2308
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r F:\Autorun.inf\*.* /s /d
      4⤵
      Views/modifies file attributes
      PID:2640
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:2548
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:2796
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r C:\Autorun.inf\*.* /s /d
      4⤵
      Views/modifies file attributes
      PID:832
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:1744
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:2196
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:2728
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:1580
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:780
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:2504
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r F:\Autorun.inf\*.* /s /d
      4⤵
      Views/modifies file attributes
      PID:2916
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:2740
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:1344
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r C:\Autorun.inf\*.* /s /d
      4⤵
      Views/modifies file attributes
      PID:2820
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:968
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:1780
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r F:\Autorun.inf\*.* /s /d
      4⤵
      Views/modifies file attributes
      PID:904
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:2192
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:2200
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r C:\Autorun.inf\*.* /s /d
      4⤵
      Views/modifies file attributes
      PID:1772
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:900
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:1212
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r F:\Autorun.inf\*.* /s /d
      4⤵
      Views/modifies file attributes
      PID:1668
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:592
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:1980
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r C:\Autorun.inf\*.* /s /d
      4⤵
      Views/modifies file attributes
      PID:2624
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:1504
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:2816
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r F:\Autorun.inf\*.* /s /d
      4⤵
      Views/modifies file attributes
      PID:1744
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:2136
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:2552
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:992
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:1288
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:908
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:280
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:2616
- C:\Windows\SysWOW64\sc.exe
  C:\Windows\system32\sc.exe config SharedAccess start= disabled
  2⤵
  - Launches sc.exe
  PID:2480
- C:\Windows\SysWOW64\sc.exe
  C:\Windows\system32\sc.exe config srservice start= disabled
  2⤵
  - Launches sc.exe
  PID:2116
- C:\Windows\SysWOW64\net.exe
  net.exe stop 360timeprot /y
  2⤵
  PID:1608
- C:\Windows\SysWOW64\net.exe
  net.exe stop srservice /y
  2⤵
  PID:2764
- C:\Windows\SysWOW64\net.exe
  net.exe stop wuauserv /y
  2⤵
  PID:2304
- C:\Windows\SysWOW64\net.exe
  net.exe stop wscsvc /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:856
- C:\Windows\SysWOW64\cmd.exe
  cmd /c at 11:45:41 AM C:\Windows\Sysinf.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2244
- C:\Windows\SysWOW64\cmd.exe
  cmd /c at 11:42:41 AM C:\Windows\Sysinf.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:832
- C:\Windows\SysWOW64\At.exe
  At.exe 11:43:39 AM C:\Windows\Help\HelpCat.exe
  2⤵
  PID:1072
- C:\Windows\SysWOW64\net.exe
  net.exe stop 360timeprot /y
  2⤵
  PID:3008
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop 360timeprot /y
    3⤵
    PID:2340
- C:\Windows\SysWOW64\net.exe
  net.exe stop srservice /y
  2⤵
  PID:2828
- C:\Windows\SysWOW64\net.exe
  net.exe stop wuauserv /y
  2⤵
  PID:2756
- C:\Windows\SysWOW64\net.exe
  net.exe stop sharedaccess /y
  2⤵
  PID:2616
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    - Views/modifies file attributes
    PID:2700
- C:\Windows\SysWOW64\net.exe
  net.exe stop wscsvc /y
  2⤵
  PID:2416

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Windows\system32\Option.bat
1⤵
PID:1728

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start schedule /y
1⤵
PID:780
- C:\Windows\SysWOW64\attrib.exe
  attrib -s -h -r C:\Autorun.inf\*.* /s /d
  2⤵
  - Views/modifies file attributes
  PID:2132

C:\Windows\SysWOW64\net.exe
net.exe start schedule /y
1⤵
PID:1572

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop 360timeprot /y
1⤵
PID:2692

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop srservice /y
1⤵
PID:2036

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wuauserv /y
1⤵
PID:2552

C:\Windows\SysWOW64\at.exe
at 11:45:41 AM C:\Windows\Sysinf.bat
1⤵
PID:2728
- C:\Windows\SysWOW64\attrib.exe
  attrib -s -h -r F:\Autorun.inf\*.* /s /d
  2⤵
  - Views/modifies file attributes
  PID:1904

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wscsvc /y
1⤵
PID:2404

C:\Windows\SysWOW64\at.exe
at 11:42:41 AM C:\Windows\Sysinf.bat
1⤵
PID:2608

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop 360timeprot /y
1⤵
PID:2208

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop srservice /y
1⤵
PID:1704

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:1276

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop srservice /y
1⤵
PID:1592

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wuauserv /y
1⤵
PID:3036

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wuauserv /y
1⤵
PID:2436

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wscsvc /y
1⤵
PID:2736

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sharedaccess /y
1⤵
PID:2320

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sharedaccess /y
1⤵
PID:2740

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wscsvc /y
1⤵
PID:2700

C:\Windows\SysWOW64\at.exe
at 11:45:44 AM C:\Windows\Sysinf.bat
1⤵
PID:2912

C:\Windows\SysWOW64\at.exe
at 11:42:44 AM C:\Windows\Sysinf.bat
1⤵
PID:1464

C:\Windows\system32\taskeng.exe
taskeng.exe {BD43D1B4-570A-461E-AC0C-416DBFDE8C24} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:1196

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r C:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:2940

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Sysinf.bat

Filesize
460B

MD5
7db3d565d6ddbe65a8b0e093910e7dcd

SHA1
d4804e6180c6e74ba79d3343f2f2ccb15e502f12

SHA256
a2778cb87fd88c7508ffd506a8ff8d58d0ffc02156f846956e5e99c6cb3d2f3f

SHA512
0b3d1d0f44feba9dd78903ff77fdeaea834d930990a86641fb2e4ce04da280d33f6bee0ae0b1320e4070cbe20824062e45b52e5cad797c5985d8e31dce1ef82b

Download Submit
C:\Windows\regedt32.sys

Filesize
2KB

MD5
e7d7ec66bd61fac3843c98650b0c68f6

SHA1
a15ae06e1be51038863650746368a71024539bac

SHA256
6475d5ecc14fea090774be55723d2d52b7ec7670527a7dbd61edf28c77944cb8

SHA512
ac9e9893f5a0af03957731445f63279085f164e9a968d706a99d13012e4459314a7ccc32dc48f62379d69e21a0953c13543c9ded38b5ad5fbc346aa442af1ae6

Download Submit
C:\Windows\system\KavUpda.exe

Filesize
93KB

MD5
7082fd6c1ca3259e70887ede5aef4117

SHA1
3b704a09555b734f416d06f06c75ce3ca28a7cd9

SHA256
337854689ef8fb423e34d83072f29596a2ba6d2a07dfd0c135115ac77b234823

SHA512
608f05b726f6b95d0674b4ab5c2943d72d7b5b7ef38711c75b59460eecc774766c35604d0e9482fa946ad81a19732b8fefa322afb76c843f4fce96df46176c3f

Download Submit
C:\Windows\system\KavUpda.exe

Filesize
92KB

MD5
9253be46af98a0b40c26d6bdd6a13107

SHA1
e5c93a9d400921734c8ef43472432f5735d9a429

SHA256
af5b86a2ec44ebd362552ba20cf8bdcaceab76c83d962a54b4c36b59dc9eb759

SHA512
b6e2b37e962c2e17c38a519203e8817252cb53f812fb0722f52029dafa50ccc3a921db9707d7249d732d30b8359ecfa74c18e998b985792d265eb76c2c7b8589

Download Submit
\Windows\system\KavUpda.exe

Filesize
1.1MB

MD5
ef007059254d8e2a482ab3c894627686

SHA1
194df188cb4eb947f75b57ab5beb6feff7c1046e

SHA256
3ef2e9de3acc35155cb7fdad8a12328b5fc5c4e1a669bd3cef5e52e293343232

SHA512
7f4dc26785212def8cf9dac334b48ac60b58745246ce359352e22bca51880460d5f5b67d8ac8b92fa14ee510824f544bd5200b3f8e9beb0d6e3316ad5bfd3a3a

Download Submit
\Windows\system\KavUpda.exe

Filesize
385KB

MD5
8c08b27cd837aa932fc963955e604504

SHA1
ede4269ecfebbfbd92914cf288726d7b47a9969d

SHA256
9a827c8bff26d66fcd15e66a740e02f9854d2cac08c39ef2efacc5061f2be43d

SHA512
178d822f43b99e5626a623274e919517b061bc16650a0f250fcfd033eec0d1591a630aaf158ea7b7c5bb2d13db691d0029e1e585b116d63f6cbc23588357527b

Download Submit
memory/1984-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads