8ef4b7b9c40b8ce7ff9377f58e140a5ea5d2095341f19bed21be35f9660472ec

Analysis

max time kernel
7s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
06/01/2024, 10:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
61af14a1ae5503a5979c85590c8d2fb3.exe
Size 3.4MB
Sample240106-mxe59sefak
SHA256 8ef4b7b9c40b8ce7ff9377f58e140a5ea5d2095341f19bed21be35f9660472ec
MD5 61af14a1ae5503a5979c85590c8d2fb3
SHA1 d25f468635333d8dad3bd49c84729f118c514b1b
SHA512 7e50c328c92cd8c17455542271de78bf265b954713bf9420ce5a5fe236e0336bf276a73bbe4d600b65e8a73cb0f3145fca280b37476f5fee26a9162b7d91e9ca
SSDEEP 12288:UZWtI6RkbGOFSwO9GOFSwO9GOFSwO9GOFSwO9GOFS2rRZORGOFSwO9GOFSwO9GOt:UuhaQ8888sp8888sNerQZb+md4wmm
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Option.bat	61af14a1ae5503a5979c85590c8d2fb3.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\Help\HelpCat.exe	61af14a1ae5503a5979c85590c8d2fb3.exe
File opened for modification	C:\Windows\Help\HelpCat.exe	61af14a1ae5503a5979c85590c8d2fb3.exe
File created	C:\Windows\Sysinf.bat	61af14a1ae5503a5979c85590c8d2fb3.exe
File created	C:\Windows\regedt32.sys	61af14a1ae5503a5979c85590c8d2fb3.exe
File created	C:\Windows\system\KavUpda.exe	61af14a1ae5503a5979c85590c8d2fb3.exe
File opened for modification	C:\Windows\system\KavUpda.exe	61af14a1ae5503a5979c85590c8d2fb3.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1168	sc.exe
1996	sc.exe
1168	sc.exe
1892	sc.exe
5116	sc.exe
4204	sc.exe
4060	sc.exe
5084	sc.exe

Runs net.exe

Runs regedit.exe 1 IoCs

pid	Process
2888	regedit.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
952	61af14a1ae5503a5979c85590c8d2fb3.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 952 wrote to memory of 4724	952	61af14a1ae5503a5979c85590c8d2fb3.exe	91
PID 952 wrote to memory of 4724	952	61af14a1ae5503a5979c85590c8d2fb3.exe	91
PID 952 wrote to memory of 4724	952	61af14a1ae5503a5979c85590c8d2fb3.exe	91
PID 952 wrote to memory of 4088	952	61af14a1ae5503a5979c85590c8d2fb3.exe	94
PID 952 wrote to memory of 4088	952	61af14a1ae5503a5979c85590c8d2fb3.exe	94
PID 952 wrote to memory of 4088	952	61af14a1ae5503a5979c85590c8d2fb3.exe	94
PID 4088 wrote to memory of 1352	4088	net.exe	95
PID 4088 wrote to memory of 1352	4088	net.exe	95
PID 4088 wrote to memory of 1352	4088	net.exe	95
PID 952 wrote to memory of 1644	952	61af14a1ae5503a5979c85590c8d2fb3.exe	138
PID 952 wrote to memory of 1644	952	61af14a1ae5503a5979c85590c8d2fb3.exe	138
PID 952 wrote to memory of 1644	952	61af14a1ae5503a5979c85590c8d2fb3.exe	138
PID 952 wrote to memory of 3968	952	61af14a1ae5503a5979c85590c8d2fb3.exe	136
PID 952 wrote to memory of 3968	952	61af14a1ae5503a5979c85590c8d2fb3.exe	136
PID 952 wrote to memory of 3968	952	61af14a1ae5503a5979c85590c8d2fb3.exe	136
PID 952 wrote to memory of 3300	952	61af14a1ae5503a5979c85590c8d2fb3.exe	135
PID 952 wrote to memory of 3300	952	61af14a1ae5503a5979c85590c8d2fb3.exe	135
PID 952 wrote to memory of 3300	952	61af14a1ae5503a5979c85590c8d2fb3.exe	135
PID 952 wrote to memory of 3188	952	61af14a1ae5503a5979c85590c8d2fb3.exe	134
PID 952 wrote to memory of 3188	952	61af14a1ae5503a5979c85590c8d2fb3.exe	134
PID 952 wrote to memory of 3188	952	61af14a1ae5503a5979c85590c8d2fb3.exe	134
PID 952 wrote to memory of 3768	952	61af14a1ae5503a5979c85590c8d2fb3.exe	133
PID 952 wrote to memory of 3768	952	61af14a1ae5503a5979c85590c8d2fb3.exe	133
PID 952 wrote to memory of 3768	952	61af14a1ae5503a5979c85590c8d2fb3.exe	133
PID 952 wrote to memory of 2876	952	61af14a1ae5503a5979c85590c8d2fb3.exe	132
PID 952 wrote to memory of 2876	952	61af14a1ae5503a5979c85590c8d2fb3.exe	132
PID 952 wrote to memory of 2876	952	61af14a1ae5503a5979c85590c8d2fb3.exe	132
PID 952 wrote to memory of 3452	952	61af14a1ae5503a5979c85590c8d2fb3.exe	131
PID 952 wrote to memory of 3452	952	61af14a1ae5503a5979c85590c8d2fb3.exe	131
PID 952 wrote to memory of 3452	952	61af14a1ae5503a5979c85590c8d2fb3.exe	131
PID 952 wrote to memory of 3644	952	61af14a1ae5503a5979c85590c8d2fb3.exe	97
PID 952 wrote to memory of 3644	952	61af14a1ae5503a5979c85590c8d2fb3.exe	97
PID 952 wrote to memory of 3644	952	61af14a1ae5503a5979c85590c8d2fb3.exe	97
PID 952 wrote to memory of 4204	952	61af14a1ae5503a5979c85590c8d2fb3.exe	123
PID 952 wrote to memory of 4204	952	61af14a1ae5503a5979c85590c8d2fb3.exe	123
PID 952 wrote to memory of 4204	952	61af14a1ae5503a5979c85590c8d2fb3.exe	123
PID 952 wrote to memory of 1168	952	61af14a1ae5503a5979c85590c8d2fb3.exe	169
PID 952 wrote to memory of 1168	952	61af14a1ae5503a5979c85590c8d2fb3.exe	169
PID 952 wrote to memory of 1168	952	61af14a1ae5503a5979c85590c8d2fb3.exe	169
PID 952 wrote to memory of 5116	952	61af14a1ae5503a5979c85590c8d2fb3.exe	205
PID 952 wrote to memory of 5116	952	61af14a1ae5503a5979c85590c8d2fb3.exe	205
PID 952 wrote to memory of 5116	952	61af14a1ae5503a5979c85590c8d2fb3.exe	205
PID 952 wrote to memory of 1892	952	61af14a1ae5503a5979c85590c8d2fb3.exe	120
PID 952 wrote to memory of 1892	952	61af14a1ae5503a5979c85590c8d2fb3.exe	120
PID 952 wrote to memory of 1892	952	61af14a1ae5503a5979c85590c8d2fb3.exe	120
PID 952 wrote to memory of 2888	952	61af14a1ae5503a5979c85590c8d2fb3.exe	101
PID 952 wrote to memory of 2888	952	61af14a1ae5503a5979c85590c8d2fb3.exe	101
PID 952 wrote to memory of 2888	952	61af14a1ae5503a5979c85590c8d2fb3.exe	101
PID 3188 wrote to memory of 1708	3188	net.exe	103
PID 3188 wrote to memory of 1708	3188	net.exe	103
PID 3188 wrote to memory of 1708	3188	net.exe	103
PID 3644 wrote to memory of 3356	3644	net.exe	119
PID 3644 wrote to memory of 3356	3644	net.exe	119
PID 3644 wrote to memory of 3356	3644	net.exe	119
PID 3768 wrote to memory of 1532	3768	net.exe	118
PID 3768 wrote to memory of 1532	3768	net.exe	118
PID 3768 wrote to memory of 1532	3768	net.exe	118

Views/modifies file attributes 1 TTPs 14 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
5084	attrib.exe
4468	attrib.exe
3060	attrib.exe
2420	attrib.exe
8	attrib.exe
1384	attrib.exe
1968	attrib.exe
1040	attrib.exe
1812	attrib.exe
3860	attrib.exe
2608	attrib.exe
4956	attrib.exe
208	attrib.exe
1744	attrib.exe

C:\Users\Admin\AppData\Local\Temp\61af14a1ae5503a5979c85590c8d2fb3.exe
"C:\Users\Admin\AppData\Local\Temp\61af14a1ae5503a5979c85590c8d2fb3.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:952
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
  2⤵
  PID:4724
- C:\Windows\SysWOW64\net.exe
  net.exe start schedule /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4088
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 start schedule /y
    3⤵
    PID:1352
- C:\Windows\SysWOW64\net.exe
  net.exe stop 360timeprot /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3644
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop 360timeprot /y
    3⤵
    PID:3356
- C:\Windows\SysWOW64\sc.exe
  C:\Windows\system32\sc.exe config SharedAccess start= disabled
  2⤵
  - Launches sc.exe
  PID:1168
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\Windows\regedt32.sys
  2⤵
  - Runs regedit.exe
  PID:2888
- C:\Windows\SysWOW64\reg.exe
  C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
  2⤵
  PID:1016
- C:\Windows\SysWOW64\reg.exe
  C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
  2⤵
  PID:1428
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    - Views/modifies file attributes
    PID:5084
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r C:\Autorun.inf\*.* /s /d
      4⤵
      Views/modifies file attributes
      PID:3860
- C:\Windows\system\KavUpda.exe
  C:\Windows\system\KavUpda.exe
  2⤵
  PID:4644
- - C:\Windows\SysWOW64\net.exe
    net.exe start schedule /y
    3⤵
    PID:3692
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start schedule /y
      4⤵
      PID:3664
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib -s -h -r F:\Autorun.inf\*.* /s /d
        5⤵
        Views/modifies file attributes
        
        PID:4468
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
    3⤵
    PID:1912
- - C:\Windows\SysWOW64\net.exe
    net.exe stop sharedaccess /y
    3⤵
    PID:488
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop sharedaccess /y
      4⤵
      PID:4836
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
    3⤵
    PID:4180
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:4404
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:4564
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
    3⤵
    PID:1536
- - C:\Windows\SysWOW64\sc.exe
    C:\Windows\system32\sc.exe config srservice start= disabled
    3⤵
    - Launches sc.exe
    PID:4060
- - C:\Windows\SysWOW64\sc.exe
    C:\Windows\system32\sc.exe config wscsvc start= disabled
    3⤵
    - Launches sc.exe
    PID:5084
- - C:\Windows\SysWOW64\sc.exe
    C:\Windows\system32\sc.exe config SharedAccess start= disabled
    3⤵
    - Launches sc.exe
    PID:1168
- - C:\Windows\SysWOW64\sc.exe
    C:\Windows\system32\sc.exe config srservice start= disabled
    3⤵
    - Launches sc.exe
    PID:1996
- - C:\Windows\SysWOW64\net.exe
    net.exe stop 360timeprot /y
    3⤵
    PID:3456
- - C:\Windows\SysWOW64\net.exe
    net.exe stop srservice /y
    3⤵
    PID:3816
- - C:\Windows\SysWOW64\net.exe
    net.exe stop wuauserv /y
    3⤵
    PID:3812
- - C:\Windows\SysWOW64\net.exe
    net.exe stop wscsvc /y
    3⤵
    PID:5100
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c at 10:57:27 AM C:\Windows\Sysinf.bat
    3⤵
    PID:808
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c at 10:54:27 AM C:\Windows\Sysinf.bat
    3⤵
    PID:380
- - C:\Windows\SysWOW64\At.exe
    At.exe 10:55:25 AM C:\Windows\Help\HelpCat.exe
    3⤵
    PID:2964
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:3368
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:1428
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:3680
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:3696
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:2260
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:5084
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:4912
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:3664
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:3896
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:320
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:3860
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:2644
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:2560
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:1580
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r C:\Autorun.inf\*.* /s /d
      4⤵
      Views/modifies file attributes
      PID:4956
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:4144
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:916
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:3604
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:3708
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r C:\Autorun.inf\*.* /s /d
      4⤵
      Views/modifies file attributes
      PID:1040
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:2580
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:4108
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r F:\Autorun.inf\*.* /s /d
      4⤵
      Views/modifies file attributes
      PID:8
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:4088
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:3140
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r C:\Autorun.inf\*.* /s /d
      4⤵
      Views/modifies file attributes
      PID:1744
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:428
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:3192
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r F:\Autorun.inf\*.* /s /d
      4⤵
      Views/modifies file attributes
      PID:1384
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:4732
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r C:\Autorun.inf\*.* /s /d
      4⤵
      Views/modifies file attributes
      PID:1968
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:3816
- C:\Windows\SysWOW64\sc.exe
  C:\Windows\system32\sc.exe config srservice start= disabled
  2⤵
  - Launches sc.exe
  PID:1892
- C:\Windows\SysWOW64\sc.exe
  C:\Windows\system32\sc.exe config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  PID:5116
- C:\Windows\SysWOW64\sc.exe
  C:\Windows\system32\sc.exe config srservice start= disabled
  2⤵
  - Launches sc.exe
  PID:4204
- C:\Windows\SysWOW64\net.exe
  net.exe stop srservice /y
  2⤵
  PID:3452
- C:\Windows\SysWOW64\net.exe
  net.exe stop wuauserv /y
  2⤵
  PID:2876
- C:\Windows\SysWOW64\net.exe
  net.exe stop sharedaccess /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3768
- C:\Windows\SysWOW64\net.exe
  net.exe stop wscsvc /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3188
- C:\Windows\SysWOW64\cmd.exe
  cmd /c at 10:57:23 AM C:\Windows\Sysinf.bat
  2⤵
  PID:3300
- C:\Windows\SysWOW64\cmd.exe
  cmd /c at 10:54:23 AM C:\Windows\Sysinf.bat
  2⤵
  PID:3968
- C:\Windows\SysWOW64\At.exe
  At.exe 10:55:21 AM C:\Windows\Help\HelpCat.exe
  2⤵
  PID:1644
- C:\Windows\SysWOW64\net.exe
  net.exe stop 360timeprot /y
  2⤵
  PID:3184
- C:\Windows\SysWOW64\net.exe
  net.exe stop srservice /y
  2⤵
  PID:4840
- C:\Windows\SysWOW64\net.exe
  net.exe stop wuauserv /y
  2⤵
  PID:2568
- C:\Windows\SysWOW64\net.exe
  net.exe stop sharedaccess /y
  2⤵
  PID:2580
- C:\Windows\SysWOW64\net.exe
  net.exe stop wscsvc /y
  2⤵
  PID:2572

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wscsvc /y
1⤵
PID:1708

C:\Windows\SysWOW64\at.exe
at 10:57:23 AM C:\Windows\Sysinf.bat
1⤵
PID:4320

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop srservice /y
1⤵
PID:4472

C:\Windows\SysWOW64\at.exe
at 10:54:23 AM C:\Windows\Sysinf.bat
1⤵
PID:220

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wuauserv /y
1⤵
PID:1864

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sharedaccess /y
1⤵
PID:1532

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wscsvc /y
1⤵
PID:4600

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wscsvc /y
1⤵
PID:4176

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop 360timeprot /y
1⤵
PID:3600

C:\Windows\SysWOW64\at.exe
at 10:54:27 AM C:\Windows\Sysinf.bat
1⤵
PID:3264

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:2420

C:\Windows\SysWOW64\at.exe
at 10:57:27 AM C:\Windows\Sysinf.bat
1⤵
PID:2748

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop 360timeprot /y
1⤵
PID:4848

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wuauserv /y
1⤵
PID:3232

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wuauserv /y
1⤵
PID:264

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop srservice /y
1⤵
PID:4672

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop srservice /y
1⤵
PID:5012

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sharedaccess /y
1⤵
PID:3928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:5116

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:1812

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r C:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:2608

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:3060

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Option.bat

Path C:\Windows\SysWOW64\Option.bat
Size 82B
SHA256 e75e8d9bfc7a2876d908305186c3656e9de2a4af7f6927ccc6d8c812645abbc7
MD5 3f7fbd2eb34892646e93fd5e6e343512
SHA1 265ac1061b54f62350fb7a5f57e566454d013a66
SHA512 53d40eb2f05a23464fbf06193868e7cb30cf0df3da53586a75123fb2c37b29cdddda287ce134809d16a559d87fb20aee0e8add22d396fcb7a55f9a753739b140
MD5 SHA1 SHA512

Submit Download

Sysinf.bat

Path C:\Windows\Sysinf.bat
Size 460B
SHA256 a2778cb87fd88c7508ffd506a8ff8d58d0ffc02156f846956e5e99c6cb3d2f3f
MD5 7db3d565d6ddbe65a8b0e093910e7dcd
SHA1 d4804e6180c6e74ba79d3343f2f2ccb15e502f12
SHA512 0b3d1d0f44feba9dd78903ff77fdeaea834d930990a86641fb2e4ce04da280d33f6bee0ae0b1320e4070cbe20824062e45b52e5cad797c5985d8e31dce1ef82b
MD5 SHA1 SHA512

Submit Download

KavUpda.exe

Path C:\Windows\System\KavUpda.exe
Size 138KB
SHA256 d2502e28a151194bc2ec36c0218984ef4e6175da72f1dbb6f73a42312b3c16b7
MD5 3e882d56d14a41d3e24040486c54b0e9
SHA1 e88c1eb9e7f5ae6eb0e4aac9edb88d43cc366ffb
SHA512 fe8b427549d8681e3e638477d4603399b1f692ce048a384931b0054a4b1e5330b09294b72a4199c08026d7b45313a9e18501385e65ee5bc164b403411b0dd501
SSDEEP 1536:UdvOOsfHWiNocGftfQKAezdD4/3G2h9vcWLQQxw8w0QZRA34ctSyNk6RD:USHWiNo/ftfQKAc94/3bXZ3Nk6RD
MD5 SHA1 SHA512 SSDEEP

Submit Download

KavUpda.exe

Path C:\Windows\System\KavUpda.exe
Size 53KB
SHA256 b6ee119b5755eb4ab50b99c42d621a7bd92b3f6f75631fbc1a5c8622f0d8ef16
MD5 156cb5f1ba68002747db65e508dda8d0
SHA1 f485eaefb7743743bfcab88ecfda84005ad36776
SHA512 9d77a6fe74c2584ba9193f7d6988fc636ef3faec24520412fcda006750846a49f5cbb8f7b35c9b58d5946cf4c7ae08f89d7d5b9efe330b374548114798d76c4d
SSDEEP 384:Kndh1/EkNOO7PgDMPVAUN4fbYwm+8cWYjNo4:Kndz1NOOsdBHWiNo4
MD5 SHA1 SHA512 SSDEEP

Submit Download

regedt32.sys

Path C:\Windows\regedt32.sys
Size 2KB
SHA256 6475d5ecc14fea090774be55723d2d52b7ec7670527a7dbd61edf28c77944cb8
MD5 e7d7ec66bd61fac3843c98650b0c68f6
SHA1 a15ae06e1be51038863650746368a71024539bac
SHA512 ac9e9893f5a0af03957731445f63279085f164e9a968d706a99d13012e4459314a7ccc32dc48f62379d69e21a0953c13543c9ded38b5ad5fbc346aa442af1ae6
MD5 SHA1 SHA512

Submit Download

regedt32.sys

Path C:\Windows\regedt32.sys
Size 1KB
SHA256 7b965346446e66a3efac56457bd40e2ec9791dfae9d693fec04aafd2e4e92660
MD5 0d8a1f285b7891a2c790824fbf2e4392
SHA1 6c761d2c3f3931560cc5e57d106cd0bb5db3a555
SHA512 805282dc69a8315e2e05eaf2bcee27858fe2a2f2258b83305110a1f9a217144f06e299b3c4c11b38a7b258c2c54cd54f0623d39f72c97b5898defeccbad7c50a
MD5 SHA1 SHA512

Submit Download

KavUpda.exe

Path C:\Windows\system\KavUpda.exe
Size 14KB
SHA256 67e8dd8cddd757e27e02220ac942ad43672a39d3dcd632ffbea610b2f98bd823
MD5 b0216ccdf57c3155f3e859285406f0e9
SHA1 2cec37106633545da77cc5c7a32bd5443241d4a4
SHA512 f2e33d8e7578bf6eaa804e25ddee70cd19b1f6c67c21b26111f73f9d6934928928c8b1f10bf7038ea7d4c60ec50ce285ef18d366a95322e7b65a5e86105bf4ad
SSDEEP 96:PqWYzJvzNXZxdAeNZM+ZgIDiwjrYhGEuoFw3r4MtwszOOEb2SdoXDbPO/Iu99PJE:e1NndhNZ5/El+1bOOECqYbPO/zV+Yg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Autorun.inf

Path F:\Autorun.inf
Size 237B
SHA256 5d9f41e4f886926dae2ed8a57807708110d3c6964ab462be21462bff0088d9a1
MD5 94bcd02c5afd5918b4446345e7a5ded9
SHA1 79839238e84be225132e1382fae6333dfc4906a1
SHA512 149f6bd49fc3b62fa5f41666bfb3a58060514eec1b61c6aa1ac4c75417c840b028e701eb5533460eb00e2fee8543379564bc47d7477264771d81b99a0caab500
MD5 SHA1 SHA512

Submit Download

memory/952-0-0x0000000000400000-0x0000000000436000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads