Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29/12/2023, 23:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0729d893aeb17d01a61877855d52e33c.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
0729d893aeb17d01a61877855d52e33c.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
0729d893aeb17d01a61877855d52e33c.exe
-
Size
48KB
-
MD5
0729d893aeb17d01a61877855d52e33c
-
SHA1
37c44c6c8225a71eaf9506f1dddb8c0f2a288b85
-
SHA256
c6164eb23e75fac6ccbf82e4729d6b6b7d04f456e6ed8e2d23abe1acb9583520
-
SHA512
1c98736fa5865645ee06c63400c4f8090780f30c887d581066b410cae97519f5735be225e971ce339fca9171a900a9471aed9695bd8174080cd5a9a008376e6b
-
SSDEEP
768:ljNEhmygYfsdYC7v+6wH9H7MfygXaDMFQXD7e:ljam+EeCX6NNDsQXD7
Score
10/10
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" kapef.exe -
Executes dropped EXE 1 IoCs
pid Process 2300 kapef.exe -
Loads dropped DLL 2 IoCs
pid Process 2512 0729d893aeb17d01a61877855d52e33c.exe 2512 0729d893aeb17d01a61877855d52e33c.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\kapef = "C:\\Users\\Admin\\kapef.exe" kapef.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe 2300 kapef.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2512 0729d893aeb17d01a61877855d52e33c.exe 2300 kapef.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2512 wrote to memory of 2300 2512 0729d893aeb17d01a61877855d52e33c.exe 28 PID 2512 wrote to memory of 2300 2512 0729d893aeb17d01a61877855d52e33c.exe 28 PID 2512 wrote to memory of 2300 2512 0729d893aeb17d01a61877855d52e33c.exe 28 PID 2512 wrote to memory of 2300 2512 0729d893aeb17d01a61877855d52e33c.exe 28 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27 PID 2300 wrote to memory of 2512 2300 kapef.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\0729d893aeb17d01a61877855d52e33c.exe"C:\Users\Admin\AppData\Local\Temp\0729d893aeb17d01a61877855d52e33c.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\kapef.exe"C:\Users\Admin\kapef.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2300
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD5e99ec43d03689b367c2a063b9afdd32d
SHA1927dd64c12760a18b9ca8410a543c07fa7dbfe61
SHA256c0e5c185fc0c5f7b0e0e2dd5e5226eb2c47125915135801257cd77852670a38b
SHA51293cbe40bc0ef9ef0e852d74b16339534e02599e4162346b7f5011ae3de05c5220cd1cf048da4c74064f7dee87e572ac0c079a983b032d4e19caa3f7d484973b2