Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29-12-2023 21:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
04645eefb1ad7b96315acb36237387bb.exe
Resource
win7-20231215-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
04645eefb1ad7b96315acb36237387bb.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
04645eefb1ad7b96315acb36237387bb.exe
-
Size
41KB
-
MD5
04645eefb1ad7b96315acb36237387bb
-
SHA1
eff7a22113d9dc1ec901e900056daf44aa418c09
-
SHA256
210559ef8a6996297384b50d3b7a0e170ee3b24e23acd50f5a7d55252c513c6e
-
SHA512
68552f53f65b12a40b5e8db5d8b4c1b48a61c5b25ed0864c3eeb9bce649ec98ac1dcf11b0cda4e651865db4b70cc8a0d629bfa08c517234aa0739e7485c5f798
-
SSDEEP
768:ChILW5OyRstOCjdpChIuKiGMeHxIAbN8:ChIy5OyetOCZxuKiWHCAbN8
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts kav32.exe File created C:\Windows\system32\drivers\etc\hosts kav32.exe -
Modifies Installed Components in the registry 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{H8I22RB03-AB-B70-7-11d2-9CBD-0O00FS7AH6-9E2121BHJLK}\ = "360safe" kav32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{H8I22RB03-AB-B70-7-11d2-9CBD-0O00FS7AH6-9E2121BHJLK}\stubpath = "%windir%\\Tasks\\pig.vbs" kav32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{H8I22RB03-AB-B70-7-11d2-9CBD-0O00FS7AH6-9E2121BHJLK} kav32.exe -
Executes dropped EXE 1 IoCs
pid Process 3204 kav32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN kav32.exe -
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: kav32.exe File opened (read-only) \??\H: kav32.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\wsock32.dll kav32.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\1033\wsock32.dll kav32.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Resources\wsock32.dll kav32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\vi\wsock32.dll kav32.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\wsock32.dll kav32.exe File created C:\Program Files\Common Files\System\es-ES\wsock32.dll kav32.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\wsock32.dll kav32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\deploy\wsock32.dll kav32.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\wsock32.dll kav32.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\wsock32.dll kav32.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\fi\wsock32.dll kav32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\3082\wsock32.dll kav32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\wsock32.dll kav32.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\tr\wsock32.dll kav32.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\wsock32.dll kav32.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\wsock32.dll kav32.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\dtplugin\wsock32.dll kav32.exe File created C:\Program Files\Java\jdk-1.8\lib\wsock32.dll kav32.exe File created C:\Program Files\Java\jre-1.8\lib\security\policy\wsock32.dll kav32.exe File created C:\Program Files\Java\jre-1.8\wsock32.dll kav32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_w1\wsock32.dll kav32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\pt\wsock32.dll kav32.exe File opened for modification C:\Program Files\Common Files\System\ado\es-ES\wsock32.dll kav32.exe File created C:\Program Files\Common Files\System\ado\wsock32.dll kav32.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\wsock32.dll kav32.exe File created C:\Program Files\Common Files\System\ado\de-DE\wsock32.dll kav32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\wsock32.dll kav32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\he\wsock32.dll kav32.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\fr\wsock32.dll kav32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\wsock32.dll kav32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\zh-CN\wsock32.dll kav32.exe File created C:\Program Files\Microsoft Office\Office16\wsock32.dll kav32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\wsock32.dll kav32.exe File created C:\Program Files\Microsoft Office\root\Office15\wsock32.dll kav32.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_f2\wsock32.dll kav32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\tr-TR\wsock32.dll kav32.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\wsock32.dll kav32.exe File created C:\Program Files\Java\jre-1.8\lib\security\policy\limited\wsock32.dll kav32.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pt-BR\wsock32.dll kav32.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ru\wsock32.dll kav32.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\wsock32.dll kav32.exe File created C:\Program Files\Internet Explorer\fr-FR\wsock32.dll kav32.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000009\wsock32.dll kav32.exe File created C:\Program Files\Common Files\microsoft shared\ink\el-GR\wsock32.dll kav32.exe File created C:\Program Files\Common Files\microsoft shared\ink\ro-RO\wsock32.dll kav32.exe File created C:\Program Files\Common Files\microsoft shared\ink\tr-TR\wsock32.dll kav32.exe File created C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\wsock32.dll kav32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\lt\wsock32.dll kav32.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\wsock32.dll kav32.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\no\wsock32.dll kav32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\tr\wsock32.dll kav32.exe File created C:\Program Files\Common Files\microsoft shared\ink\nb-NO\wsock32.dll kav32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\wsock32.dll kav32.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\wsock32.dll kav32.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\wsock32.dll kav32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Configuration\wsock32.dll kav32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\wsock32.dll kav32.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ko\wsock32.dll kav32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\ro\wsock32.dll kav32.exe File created C:\Program Files\Common Files\System\msadc\en-US\wsock32.dll kav32.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\wsock32.dll kav32.exe File created C:\Program Files\Java\jdk-1.8\legal\wsock32.dll kav32.exe File opened for modification C:\Program Files\dotnet\host\wsock32.dll kav32.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\win32\wsock32.dll kav32.exe -
Drops file in Windows directory 7 IoCs
description ioc Process File opened for modification C:\Windows\Tasks\pig.vbs kav32.exe File created C:\Windows\Tasks\°²×°.bat kav32.exe File opened for modification C:\Windows\Tasks\°²×°.bat kav32.exe File created C:\Windows\Tasks\wsock32.dll kav32.exe File created C:\Windows\Tasks\kav32.exe 04645eefb1ad7b96315acb36237387bb.exe File opened for modification C:\Windows\Tasks\kav32.exe 04645eefb1ad7b96315acb36237387bb.exe File created C:\Windows\Tasks\pig.vbs kav32.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 2744 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2736 04645eefb1ad7b96315acb36237387bb.exe 2736 04645eefb1ad7b96315acb36237387bb.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe 3204 kav32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3204 kav32.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2736 wrote to memory of 3936 2736 04645eefb1ad7b96315acb36237387bb.exe 88 PID 2736 wrote to memory of 3936 2736 04645eefb1ad7b96315acb36237387bb.exe 88 PID 2736 wrote to memory of 3936 2736 04645eefb1ad7b96315acb36237387bb.exe 88 PID 3936 wrote to memory of 2744 3936 cmd.exe 91 PID 3936 wrote to memory of 2744 3936 cmd.exe 91 PID 3936 wrote to memory of 2744 3936 cmd.exe 91 PID 3936 wrote to memory of 3204 3936 cmd.exe 92 PID 3936 wrote to memory of 3204 3936 cmd.exe 92 PID 3936 wrote to memory of 3204 3936 cmd.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\04645eefb1ad7b96315acb36237387bb.exe"C:\Users\Admin\AppData\Local\Temp\04645eefb1ad7b96315acb36237387bb.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\dek.bat2⤵
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Windows\SysWOW64\ipconfig.exeipconfig3⤵
- Gathers network information
PID:2744
-
-
C:\Windows\Tasks\kav32.exeC:\Windows\Tasks\kav32.exe3⤵
- Drops file in Drivers directory
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:3204
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
918B
MD5fbfe75bd891ab82a2f89de108e132801
SHA18baa8430288717cccca5835ecd7b3844b317ac94
SHA2564806dbef798205ae2d7ac187fc3c095a3201df133bf3366398dccfc467260b02
SHA512da7941abb0f7bc628f7bc56b698c8ac4191d70f0c82fbf42c909daa83c40f3e51f2b6f84aef264fd9fd039e6d3dcd9fd02ee7ae055151a86ea243497f4d9ef14
-
Filesize
41KB
MD51dc4ce985376aa230e7fae40d9370131
SHA1ddfff66ad84d8009e7345c067452c58581d06ba1
SHA2562298b072adbcfa8551cd87c22df6ce1043056e9706cde7f4a72e27ccf7af2e1f
SHA512a86d348b35d530290ad673d33b56a4f4e2279c03d33b54122b827b1a207cec665c1841956a60f67a5dbc8c8d987f1fcef211f491223f2e8d521844ac37cd7065
-
Filesize
97B
MD593511c0c00557b8222622f1b1b94490d
SHA12fffbe81f874d1941efa9b6dc7735d88179c66bc
SHA256944dec2284cc789df1cd0d81dd65de6a39d5bd60be9317bdca93acd9359f16ff
SHA512e0cae4aab8ed14cd1e4c2372020f50cc28f93a99719eb9973b136bb38c05cef0da0f8d994e5af5e6fa7be64bb6b7fc8afab2e980563af51db9027fb67e759aef
-
Filesize
17KB
MD5adae0e605a8c0ef3dcdb6cacf80c413f
SHA1b0b0a2706f43fcc42a4c5d9b231ef8693e84e98a
SHA2566cdc83812d65c83753678fbbe2657fa83b13befcf3956332659aaaec13f4ff46
SHA512a185d966ff79cd15f03982e85cc32556ac9b10abc64f91e5b7d645bfe63775aea51a632e6c5079538a008fc74ac5260719bcfffd2437bea552f8ff91e63e8895
-
Filesize
131B
MD52adcfc7a015e549510d43b3779b15f36
SHA1e6ab4af78a332af3f27f448467b01ff84e3d43c3
SHA256a44a6802a9e75c76fc66339e3a562089a32290bd4a982eb86b04be706fc6fd60
SHA5124785fef3e2db29248dd8ab69b6963d6d39a783758757a878220ce140f24ad4fa8d3edac245ffa9e940c9bd40e9c9d13dcbd3ae1d7c40c57ab59fc3f14838d82c