Analysis
-
max time kernel
174s -
max time network
170s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29/12/2023, 22:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0603ddeeb302c435ce20f09420c544ff.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
0603ddeeb302c435ce20f09420c544ff.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
0603ddeeb302c435ce20f09420c544ff.exe
-
Size
196KB
-
MD5
0603ddeeb302c435ce20f09420c544ff
-
SHA1
34eb59b56ba654549829cd4f6ce16a5a86d08a8d
-
SHA256
8331b4a7b2988102bb80d4ae56e73fa45506130d198728bcff96760df078770c
-
SHA512
8e6299c6214d82b09719333cf2385705acdd9c0c5c1069124044bbfe844c6e261261cbedb8fa0e708b9fc8ed19ce32db6b4f5e1f4374f9d03c179adaca236083
-
SSDEEP
6144:+NU4K16oTJWvfU4+bOl8femcK/fObT/bGimszUf7WqW:W0AoTMvs4+bOlNK/fObT/bGipE7I
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 0603ddeeb302c435ce20f09420c544ff.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" kykoup.exe -
Executes dropped EXE 1 IoCs
pid Process 1412 kykoup.exe -
Loads dropped DLL 2 IoCs
pid Process 2376 0603ddeeb302c435ce20f09420c544ff.exe 2376 0603ddeeb302c435ce20f09420c544ff.exe -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\kykoup = "C:\\Users\\Admin\\kykoup.exe /D" kykoup.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\kykoup = "C:\\Users\\Admin\\kykoup.exe /K" kykoup.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\kykoup = "C:\\Users\\Admin\\kykoup.exe /x" kykoup.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\kykoup = "C:\\Users\\Admin\\kykoup.exe /t" kykoup.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\kykoup = "C:\\Users\\Admin\\kykoup.exe /A" kykoup.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\kykoup = "C:\\Users\\Admin\\kykoup.exe /O" kykoup.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\kykoup = "C:\\Users\\Admin\\kykoup.exe /h" kykoup.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\kykoup = "C:\\Users\\Admin\\kykoup.exe /z" kykoup.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\kykoup = "C:\\Users\\Admin\\kykoup.exe /E" kykoup.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\kykoup = "C:\\Users\\Admin\\kykoup.exe /u" kykoup.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\kykoup = "C:\\Users\\Admin\\kykoup.exe /M" kykoup.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\kykoup = "C:\\Users\\Admin\\kykoup.exe /B" kykoup.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\kykoup = "C:\\Users\\Admin\\kykoup.exe /o" kykoup.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\kykoup = "C:\\Users\\Admin\\kykoup.exe /l" kykoup.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\kykoup = "C:\\Users\\Admin\\kykoup.exe /T" kykoup.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\kykoup = "C:\\Users\\Admin\\kykoup.exe /U" kykoup.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\kykoup = "C:\\Users\\Admin\\kykoup.exe /N" kykoup.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\kykoup = "C:\\Users\\Admin\\kykoup.exe /H" kykoup.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\kykoup = "C:\\Users\\Admin\\kykoup.exe /J" kykoup.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\kykoup = "C:\\Users\\Admin\\kykoup.exe /e" kykoup.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\kykoup = "C:\\Users\\Admin\\kykoup.exe /Z" kykoup.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\kykoup = "C:\\Users\\Admin\\kykoup.exe /F" kykoup.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\kykoup = "C:\\Users\\Admin\\kykoup.exe /i" kykoup.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\kykoup = "C:\\Users\\Admin\\kykoup.exe /G" kykoup.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\kykoup = "C:\\Users\\Admin\\kykoup.exe /p" kykoup.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\kykoup = "C:\\Users\\Admin\\kykoup.exe /c" kykoup.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\kykoup = "C:\\Users\\Admin\\kykoup.exe /s" kykoup.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\kykoup = "C:\\Users\\Admin\\kykoup.exe /Q" kykoup.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\kykoup = "C:\\Users\\Admin\\kykoup.exe /q" kykoup.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\kykoup = "C:\\Users\\Admin\\kykoup.exe /b" kykoup.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\kykoup = "C:\\Users\\Admin\\kykoup.exe /U" 0603ddeeb302c435ce20f09420c544ff.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\kykoup = "C:\\Users\\Admin\\kykoup.exe /k" kykoup.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\kykoup = "C:\\Users\\Admin\\kykoup.exe /n" kykoup.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\kykoup = "C:\\Users\\Admin\\kykoup.exe /W" kykoup.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\kykoup = "C:\\Users\\Admin\\kykoup.exe /m" kykoup.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\kykoup = "C:\\Users\\Admin\\kykoup.exe /L" kykoup.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\kykoup = "C:\\Users\\Admin\\kykoup.exe /I" kykoup.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\kykoup = "C:\\Users\\Admin\\kykoup.exe /a" kykoup.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\kykoup = "C:\\Users\\Admin\\kykoup.exe /r" kykoup.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\kykoup = "C:\\Users\\Admin\\kykoup.exe /V" kykoup.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\kykoup = "C:\\Users\\Admin\\kykoup.exe /R" kykoup.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\kykoup = "C:\\Users\\Admin\\kykoup.exe /y" kykoup.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\kykoup = "C:\\Users\\Admin\\kykoup.exe /d" kykoup.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\kykoup = "C:\\Users\\Admin\\kykoup.exe /S" kykoup.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\kykoup = "C:\\Users\\Admin\\kykoup.exe /w" kykoup.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\kykoup = "C:\\Users\\Admin\\kykoup.exe /v" kykoup.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\kykoup = "C:\\Users\\Admin\\kykoup.exe /X" kykoup.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\kykoup = "C:\\Users\\Admin\\kykoup.exe /j" kykoup.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\kykoup = "C:\\Users\\Admin\\kykoup.exe /P" kykoup.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\kykoup = "C:\\Users\\Admin\\kykoup.exe /f" kykoup.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\kykoup = "C:\\Users\\Admin\\kykoup.exe /C" kykoup.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\kykoup = "C:\\Users\\Admin\\kykoup.exe /g" kykoup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2376 0603ddeeb302c435ce20f09420c544ff.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe 1412 kykoup.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2376 0603ddeeb302c435ce20f09420c544ff.exe 1412 kykoup.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2376 wrote to memory of 1412 2376 0603ddeeb302c435ce20f09420c544ff.exe 29 PID 2376 wrote to memory of 1412 2376 0603ddeeb302c435ce20f09420c544ff.exe 29 PID 2376 wrote to memory of 1412 2376 0603ddeeb302c435ce20f09420c544ff.exe 29 PID 2376 wrote to memory of 1412 2376 0603ddeeb302c435ce20f09420c544ff.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\0603ddeeb302c435ce20f09420c544ff.exe"C:\Users\Admin\AppData\Local\Temp\0603ddeeb302c435ce20f09420c544ff.exe"1⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\kykoup.exe"C:\Users\Admin\kykoup.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1412
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
196KB
MD571897a2e067f5c25bd2ec5e5610aab61
SHA142e8a215ba78ce51ee7d0412bb7f32d80e0816fe
SHA256b3485064ac454551669ee65b773780497ea571439a765055587ee76cedd4d166
SHA5120966998a32dda57ee593974a2022288b46b00bcef7ba76f2c6c54a42459b930de637dd8b2b1966d2ec0968f95bbb582cc24061e9d59c8a23ca08c8f6939303c0