Analysis
-
max time kernel
171s -
max time network
187s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29-12-2023 23:33
Static task
static1
Behavioral task
behavioral1
Sample
070e17329488a9a9632b2012fae4d486.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral2
Sample
070e17329488a9a9632b2012fae4d486.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
General
-
Target
070e17329488a9a9632b2012fae4d486.exe
-
Size
352KB
-
MD5
070e17329488a9a9632b2012fae4d486
-
SHA1
3ec546520c6f20052d78045c36cd205205baa3f7
-
SHA256
db2c1d0380533a7f2f1a5032ef2ee76595f2b849afaa128bac67e9a5e8fb14fb
-
SHA512
05a3236b90876650c38c204c64dc0d44c444e91b1ee7b61bf544b25c0147b1ac6b10fb803c9df2d00e917acba5aadfc27a1c1791bb65b24cb227e19cbe601371
-
SSDEEP
768:vtEJb96hxGRQrtxtgTVH7NHaurxmWXOQfwoObuPb77e:vtEuUQrzml5lXAoO+H7
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" kapef.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation 070e17329488a9a9632b2012fae4d486.exe -
Executes dropped EXE 1 IoCs
pid Process 964 kapef.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kapef = "C:\\Users\\Admin\\kapef.exe" kapef.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe 964 kapef.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4848 070e17329488a9a9632b2012fae4d486.exe 964 kapef.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4848 wrote to memory of 964 4848 070e17329488a9a9632b2012fae4d486.exe 92 PID 4848 wrote to memory of 964 4848 070e17329488a9a9632b2012fae4d486.exe 92 PID 4848 wrote to memory of 964 4848 070e17329488a9a9632b2012fae4d486.exe 92 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87 PID 964 wrote to memory of 4848 964 kapef.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\070e17329488a9a9632b2012fae4d486.exe"C:\Users\Admin\AppData\Local\Temp\070e17329488a9a9632b2012fae4d486.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\kapef.exe"C:\Users\Admin\kapef.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:964
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD5b513252d97991058db5deb82b8189979
SHA1909e02e720b3c43fddb51ee3f62526e5bb9d0e6d
SHA256d62541974d6864a3ceaf96a1ca34e7bce46087f1ed34cc65219eb00f7cd418a5
SHA51250fa2af308f848e3869a23c24f84b2300041d9e27985f69838fe3ed5ab88bcdec4a9e7ba179b017c3abe7d9f5b5d80817a7bed7574b318bc6c1b4553fa8049e8
-
Filesize
44KB
MD5241540558ce7dff84eac4ccd439186e9
SHA1cda65584bd4f216386b06ce41af7a82c524edfd2
SHA256eabeef4a84396113b81900c38ef4bde8a9f645985b31117ecb0553c3002c91ef
SHA512ee9d8a64dd47af2dc6ce544d4926cae466ec27746a6cc28b2867e352c93fe7faa466e26a3dfc8ba418d114c28224adf177e5b90e4a9059f2ed235e00d03aa7d8
-
Filesize
66KB
MD5fb1e5fa60a6ef3cd2decf33dd006624e
SHA11d52f99fd05fb5cf9bf28963ef9c14f07063d1e9
SHA2565036e725317880330bc09c6e87aff09435ee9c655d5b44486758c63ecea2f901
SHA51295e58117687bb07b2dd37541aaa5498a09bd9fd9ddcbbda22828b7a51437ac4de60cab8f7bf6c4ffdd5246fe5dd13abdb7a4342ad767e1509e1cba5170da141e