Analysis
-
max time kernel
78s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
07/01/2024, 19:21
Static task
static1
Behavioral task
behavioral1
Sample
a5cef94383975b7c20179bb868eaea6d.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
a5cef94383975b7c20179bb868eaea6d.exe
Resource
win10v2004-20231222-en
General
-
Target
a5cef94383975b7c20179bb868eaea6d.exe
-
Size
2.0MB
-
MD5
a5cef94383975b7c20179bb868eaea6d
-
SHA1
1cddad11f9b5a03011396675a2da62c6eab597b8
-
SHA256
2ddaf2e49ee4a36ead175a73738040586e4efb08894cceae249210cd5fc7a35c
-
SHA512
4b78a862834c07c61174200809d918a59d9adcbdcadc6fa86c61415ed43cfc0935c5307b3863f440923d56f724811e1030bfc813666bb9defce3ccd58ad015f2
-
SSDEEP
24576:UuhajeZJ8NI8ueZJ8NI8ueZJ8NI8ueZJ8NI8ueZJ8NI8bSerQZb+md4wmM:bl8n8n8n8n8bSerQZbd24
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" regedit.exe -
Blocklisted process makes network request 1 IoCs
flow pid Process 29 1244 cmd.exe -
Blocks application from running via registry modification 17 IoCs
Adds application to list of disallowed applications.
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\6 = "RavMon.exe" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\8 = "RavService.exe" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\12 = "KPFW32X.EXE" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\13 = "KAVPFW.EXE" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\15 = "KAVStart.EXE" regedit.exe Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "RfwMain.exe" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4 = "RavMoD.exe" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\11 = "KPFW32.EXE" regedit.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\7 = "RavStub.exe" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\10 = "rfwcfg.exe" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "avp.exe" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3 = "Rfwsrv.exe" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\5 = "CCenter.exe" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\9 = "Rav.exe" regedit.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\14 = "KAV32.EXE" regedit.exe -
Sets file execution options in registry 2 TTPs 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.EXE\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RfwMain.exe\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rfwsrv.exe\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMoD.exe regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMoD.exe\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rfwsrv.exe regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.EXE regedit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RfwMain.exe regedit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "D:\\RECYCLER\\????8.exe" regedit.exe -
Executes dropped EXE 1 IoCs
pid Process 836 KavUpda.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Autorun.inf KavUpda.exe File opened for modification F:\Autorun.inf KavUpda.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\Option.bat a5cef94383975b7c20179bb868eaea6d.exe File opened for modification C:\Windows\SysWOW64\Option.bat KavUpda.exe -
Drops file in Program Files directory 23 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe a5cef94383975b7c20179bb868eaea6d.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe a5cef94383975b7c20179bb868eaea6d.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe a5cef94383975b7c20179bb868eaea6d.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe a5cef94383975b7c20179bb868eaea6d.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe a5cef94383975b7c20179bb868eaea6d.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe a5cef94383975b7c20179bb868eaea6d.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe a5cef94383975b7c20179bb868eaea6d.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe a5cef94383975b7c20179bb868eaea6d.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe a5cef94383975b7c20179bb868eaea6d.exe File opened for modification C:\Program Files\7-Zip\7z.exe a5cef94383975b7c20179bb868eaea6d.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe a5cef94383975b7c20179bb868eaea6d.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe a5cef94383975b7c20179bb868eaea6d.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe a5cef94383975b7c20179bb868eaea6d.exe File opened for modification C:\Program Files\7-Zip\7zG.exe a5cef94383975b7c20179bb868eaea6d.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\createdump.exe a5cef94383975b7c20179bb868eaea6d.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe a5cef94383975b7c20179bb868eaea6d.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe a5cef94383975b7c20179bb868eaea6d.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe a5cef94383975b7c20179bb868eaea6d.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe a5cef94383975b7c20179bb868eaea6d.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe a5cef94383975b7c20179bb868eaea6d.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe a5cef94383975b7c20179bb868eaea6d.exe File opened for modification C:\Program Files\dotnet\dotnet.exe a5cef94383975b7c20179bb868eaea6d.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\createdump.exe a5cef94383975b7c20179bb868eaea6d.exe -
Drops file in Windows directory 10 IoCs
description ioc Process File created C:\Windows\system\KavUpda.exe a5cef94383975b7c20179bb868eaea6d.exe File created C:\Windows\Help\HelpCat.exe a5cef94383975b7c20179bb868eaea6d.exe File opened for modification C:\Windows\Help\HelpCat.exe a5cef94383975b7c20179bb868eaea6d.exe File opened for modification C:\Windows\system\KavUpda.exe KavUpda.exe File opened for modification C:\Windows\regedt32.sys KavUpda.exe File opened for modification C:\Windows\system\KavUpda.exe a5cef94383975b7c20179bb868eaea6d.exe File created C:\Windows\Sysinf.bat a5cef94383975b7c20179bb868eaea6d.exe File created C:\Windows\regedt32.sys a5cef94383975b7c20179bb868eaea6d.exe File opened for modification C:\Windows\Sysinf.bat KavUpda.exe File created C:\Windows\regedt32.sys KavUpda.exe -
Launches sc.exe 8 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3904 sc.exe 3416 sc.exe 1284 sc.exe 2180 sc.exe 4368 sc.exe 4040 sc.exe 1180 sc.exe 4368 sc.exe -
Runs net.exe
-
Runs regedit.exe 1 IoCs
pid Process 2400 regedit.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: 33 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: SeIncBasePriorityPrivilege 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: 33 836 KavUpda.exe Token: SeIncBasePriorityPrivilege 836 KavUpda.exe Token: 33 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: SeIncBasePriorityPrivilege 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: 33 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: SeIncBasePriorityPrivilege 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: 33 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: SeIncBasePriorityPrivilege 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: 33 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: SeIncBasePriorityPrivilege 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: 33 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: SeIncBasePriorityPrivilege 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: 33 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: SeIncBasePriorityPrivilege 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: 33 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: SeIncBasePriorityPrivilege 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: 33 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: SeIncBasePriorityPrivilege 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: 33 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: SeIncBasePriorityPrivilege 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: 33 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: SeIncBasePriorityPrivilege 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: 33 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: SeIncBasePriorityPrivilege 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: 33 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: SeIncBasePriorityPrivilege 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: 33 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: SeIncBasePriorityPrivilege 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: 33 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: SeIncBasePriorityPrivilege 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: 33 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: SeIncBasePriorityPrivilege 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: 33 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: SeIncBasePriorityPrivilege 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: 33 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: SeIncBasePriorityPrivilege 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: 33 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: SeIncBasePriorityPrivilege 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: 33 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: SeIncBasePriorityPrivilege 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: 33 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: SeIncBasePriorityPrivilege 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: 33 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: SeIncBasePriorityPrivilege 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: 33 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: SeIncBasePriorityPrivilege 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: 33 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: SeIncBasePriorityPrivilege 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: 33 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: SeIncBasePriorityPrivilege 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: 33 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: SeIncBasePriorityPrivilege 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: 33 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: SeIncBasePriorityPrivilege 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: 33 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: SeIncBasePriorityPrivilege 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: 33 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: SeIncBasePriorityPrivilege 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: 33 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: SeIncBasePriorityPrivilege 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: 33 3548 a5cef94383975b7c20179bb868eaea6d.exe Token: SeIncBasePriorityPrivilege 3548 a5cef94383975b7c20179bb868eaea6d.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3548 a5cef94383975b7c20179bb868eaea6d.exe 836 KavUpda.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3548 wrote to memory of 5044 3548 a5cef94383975b7c20179bb868eaea6d.exe 24 PID 3548 wrote to memory of 5044 3548 a5cef94383975b7c20179bb868eaea6d.exe 24 PID 3548 wrote to memory of 5044 3548 a5cef94383975b7c20179bb868eaea6d.exe 24 PID 3548 wrote to memory of 4144 3548 a5cef94383975b7c20179bb868eaea6d.exe 18 PID 3548 wrote to memory of 4144 3548 a5cef94383975b7c20179bb868eaea6d.exe 18 PID 3548 wrote to memory of 4144 3548 a5cef94383975b7c20179bb868eaea6d.exe 18 PID 4144 wrote to memory of 2948 4144 net.exe 22 PID 4144 wrote to memory of 2948 4144 net.exe 22 PID 4144 wrote to memory of 2948 4144 net.exe 22 PID 3548 wrote to memory of 372 3548 a5cef94383975b7c20179bb868eaea6d.exe 111 PID 3548 wrote to memory of 372 3548 a5cef94383975b7c20179bb868eaea6d.exe 111 PID 3548 wrote to memory of 372 3548 a5cef94383975b7c20179bb868eaea6d.exe 111 PID 3548 wrote to memory of 4196 3548 a5cef94383975b7c20179bb868eaea6d.exe 206 PID 3548 wrote to memory of 4196 3548 a5cef94383975b7c20179bb868eaea6d.exe 206 PID 3548 wrote to memory of 4196 3548 a5cef94383975b7c20179bb868eaea6d.exe 206 PID 3548 wrote to memory of 3224 3548 a5cef94383975b7c20179bb868eaea6d.exe 108 PID 3548 wrote to memory of 3224 3548 a5cef94383975b7c20179bb868eaea6d.exe 108 PID 3548 wrote to memory of 3224 3548 a5cef94383975b7c20179bb868eaea6d.exe 108 PID 3548 wrote to memory of 1136 3548 a5cef94383975b7c20179bb868eaea6d.exe 122 PID 3548 wrote to memory of 1136 3548 a5cef94383975b7c20179bb868eaea6d.exe 122 PID 3548 wrote to memory of 1136 3548 a5cef94383975b7c20179bb868eaea6d.exe 122 PID 3548 wrote to memory of 5072 3548 a5cef94383975b7c20179bb868eaea6d.exe 106 PID 3548 wrote to memory of 5072 3548 a5cef94383975b7c20179bb868eaea6d.exe 106 PID 3548 wrote to memory of 5072 3548 a5cef94383975b7c20179bb868eaea6d.exe 106 PID 3548 wrote to memory of 1692 3548 a5cef94383975b7c20179bb868eaea6d.exe 105 PID 3548 wrote to memory of 1692 3548 a5cef94383975b7c20179bb868eaea6d.exe 105 PID 3548 wrote to memory of 1692 3548 a5cef94383975b7c20179bb868eaea6d.exe 105 PID 3548 wrote to memory of 1932 3548 a5cef94383975b7c20179bb868eaea6d.exe 188 PID 3548 wrote to memory of 1932 3548 a5cef94383975b7c20179bb868eaea6d.exe 188 PID 3548 wrote to memory of 1932 3548 a5cef94383975b7c20179bb868eaea6d.exe 188 PID 3548 wrote to memory of 3692 3548 a5cef94383975b7c20179bb868eaea6d.exe 207 PID 3548 wrote to memory of 3692 3548 a5cef94383975b7c20179bb868eaea6d.exe 207 PID 3548 wrote to memory of 3692 3548 a5cef94383975b7c20179bb868eaea6d.exe 207 PID 3548 wrote to memory of 4368 3548 a5cef94383975b7c20179bb868eaea6d.exe 146 PID 3548 wrote to memory of 4368 3548 a5cef94383975b7c20179bb868eaea6d.exe 146 PID 3548 wrote to memory of 4368 3548 a5cef94383975b7c20179bb868eaea6d.exe 146 PID 3548 wrote to memory of 2180 3548 a5cef94383975b7c20179bb868eaea6d.exe 95 PID 3548 wrote to memory of 2180 3548 a5cef94383975b7c20179bb868eaea6d.exe 95 PID 3548 wrote to memory of 2180 3548 a5cef94383975b7c20179bb868eaea6d.exe 95 PID 3548 wrote to memory of 1284 3548 a5cef94383975b7c20179bb868eaea6d.exe 92 PID 3548 wrote to memory of 1284 3548 a5cef94383975b7c20179bb868eaea6d.exe 92 PID 3548 wrote to memory of 1284 3548 a5cef94383975b7c20179bb868eaea6d.exe 92 PID 3548 wrote to memory of 3416 3548 a5cef94383975b7c20179bb868eaea6d.exe 91 PID 3548 wrote to memory of 3416 3548 a5cef94383975b7c20179bb868eaea6d.exe 91 PID 3548 wrote to memory of 3416 3548 a5cef94383975b7c20179bb868eaea6d.exe 91 PID 3548 wrote to memory of 2400 3548 a5cef94383975b7c20179bb868eaea6d.exe 68 PID 3548 wrote to memory of 2400 3548 a5cef94383975b7c20179bb868eaea6d.exe 68 PID 3548 wrote to memory of 2400 3548 a5cef94383975b7c20179bb868eaea6d.exe 68 PID 3548 wrote to memory of 4116 3548 a5cef94383975b7c20179bb868eaea6d.exe 89 PID 3548 wrote to memory of 4116 3548 a5cef94383975b7c20179bb868eaea6d.exe 89 PID 3548 wrote to memory of 4116 3548 a5cef94383975b7c20179bb868eaea6d.exe 89 PID 3548 wrote to memory of 4100 3548 a5cef94383975b7c20179bb868eaea6d.exe 136 PID 3548 wrote to memory of 4100 3548 a5cef94383975b7c20179bb868eaea6d.exe 136 PID 3548 wrote to memory of 4100 3548 a5cef94383975b7c20179bb868eaea6d.exe 136 PID 1932 wrote to memory of 3684 1932 Conhost.exe 127 PID 1932 wrote to memory of 3684 1932 Conhost.exe 127 PID 1932 wrote to memory of 3684 1932 Conhost.exe 127 PID 1692 wrote to memory of 2032 1692 net.exe 84 PID 1692 wrote to memory of 2032 1692 net.exe 84 PID 1692 wrote to memory of 2032 1692 net.exe 84 PID 1136 wrote to memory of 4664 1136 net1.exe 83 PID 1136 wrote to memory of 4664 1136 net1.exe 83 PID 1136 wrote to memory of 4664 1136 net1.exe 83 PID 3692 wrote to memory of 3804 3692 Conhost.exe 82 -
Views/modifies file attributes 1 TTPs 16 IoCs
pid Process 4196 attrib.exe 1380 attrib.exe 3388 attrib.exe 1876 attrib.exe 3976 attrib.exe 4536 attrib.exe 1876 attrib.exe 3484 attrib.exe 1088 attrib.exe 4196 attrib.exe 2348 attrib.exe 3524 attrib.exe 4076 attrib.exe 2276 attrib.exe 876 attrib.exe 1148 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5cef94383975b7c20179bb868eaea6d.exe"C:\Users\Admin\AppData\Local\Temp\a5cef94383975b7c20179bb868eaea6d.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Windows\SysWOW64\net.exenet.exe start schedule /y2⤵
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start schedule /y3⤵PID:2948
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat2⤵PID:5044
-
-
C:\Windows\SysWOW64\regedit.exeregedit.exe /s C:\Windows\regedt32.sys2⤵
- Modifies visibility of file extensions in Explorer
- Blocks application from running via registry modification
- Sets file execution options in registry
- Runs regedit.exe
PID:2400
-
-
C:\Windows\system\KavUpda.exeC:\Windows\system\KavUpda.exe2⤵
- Executes dropped EXE
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:836 -
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config wscsvc start= disabled3⤵
- Launches sc.exe
PID:4040
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:3912
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:1124
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f3⤵PID:4100
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f3⤵PID:2972
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config srservice start= disabled3⤵
- Launches sc.exe
PID:1180
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config SharedAccess start= disabled3⤵
- Launches sc.exe
PID:4368
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config srservice start= disabled3⤵
- Launches sc.exe
PID:3904
-
-
C:\Windows\SysWOW64\net.exenet.exe stop 360timeprot /y3⤵PID:4708
-
-
C:\Windows\SysWOW64\net.exenet.exe stop srservice /y3⤵PID:3336
-
-
C:\Windows\SysWOW64\net.exenet.exe stop wuauserv /y3⤵PID:4680
-
-
C:\Windows\SysWOW64\net.exenet.exe stop sharedaccess /y3⤵PID:1560
-
-
C:\Windows\SysWOW64\net.exenet.exe stop wscsvc /y3⤵PID:3848
-
-
C:\Windows\SysWOW64\cmd.execmd /c at 7:26:45 PM C:\Windows\Sysinf.bat3⤵PID:2216
-
-
C:\Windows\SysWOW64\cmd.execmd /c at 7:23:45 PM C:\Windows\Sysinf.bat3⤵PID:1800
-
-
C:\Windows\SysWOW64\At.exeAt.exe 7:24:43 PM C:\Windows\Help\HelpCat.exe3⤵PID:5104
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:1420
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:1064
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:2212
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:4308
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵
- Blocklisted process makes network request
PID:1244
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:2704
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:1700
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:2836
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:1784
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d4⤵
- Views/modifies file attributes
PID:3484
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:4724
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:2212
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:3572
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:4856
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:5072
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:1800
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:3332
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:3792
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:3820
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:2252
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:4108
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:2116
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:1604
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:3388
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:3620
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:3804
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:4284
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir F:\Autorun.inf /s /q3⤵PID:464
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d3⤵PID:908
-
-
C:\Windows\SysWOW64\cmd.execmd /c rmdir C:\Autorun.inf /s /q3⤵PID:2116
-
-
C:\Windows\SysWOW64\cmd.execmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵PID:1876
-
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f2⤵PID:4100
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f2⤵PID:4116
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config srservice start= disabled2⤵
- Launches sc.exe
PID:3416
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config wscsvc start= disabled2⤵
- Launches sc.exe
PID:1284
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config SharedAccess start= disabled2⤵
- Launches sc.exe
PID:2180
-
-
C:\Windows\SysWOW64\sc.exeC:\Windows\system32\sc.exe config srservice start= disabled2⤵
- Launches sc.exe
PID:4368
-
-
C:\Windows\SysWOW64\net.exenet.exe stop 360timeprot /y2⤵PID:3692
-
-
C:\Windows\SysWOW64\net.exenet.exe stop srservice /y2⤵PID:1932
-
-
C:\Windows\SysWOW64\net.exenet.exe stop wuauserv /y2⤵
- Suspicious use of WriteProcessMemory
PID:1692
-
-
C:\Windows\SysWOW64\net.exenet.exe stop sharedaccess /y2⤵PID:5072
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d3⤵
- Views/modifies file attributes
PID:1380
-
-
-
C:\Windows\SysWOW64\net.exenet.exe stop wscsvc /y2⤵PID:1136
-
-
C:\Windows\SysWOW64\cmd.execmd /c at 7:26:42 PM C:\Windows\Sysinf.bat2⤵PID:3224
-
-
C:\Windows\SysWOW64\cmd.execmd /c at 7:23:42 PM C:\Windows\Sysinf.bat2⤵PID:4196
-
-
C:\Windows\SysWOW64\At.exeAt.exe 7:24:40 PM C:\Windows\Help\HelpCat.exe2⤵PID:372
-
-
C:\Windows\SysWOW64\net.exenet.exe stop 360timeprot /y2⤵PID:1088
-
-
C:\Windows\SysWOW64\net.exenet.exe stop srservice /y2⤵PID:2212
-
-
C:\Windows\SysWOW64\net.exenet.exe stop wuauserv /y2⤵PID:2744
-
-
C:\Windows\SysWOW64\net.exenet.exe stop sharedaccess /y2⤵PID:4564
-
-
C:\Windows\SysWOW64\net.exenet.exe stop wscsvc /y2⤵PID:876
-
-
C:\Windows\SysWOW64\at.exeat 7:26:42 PM C:\Windows\Sysinf.bat1⤵PID:232
-
C:\Windows\SysWOW64\at.exeat 7:23:42 PM C:\Windows\Sysinf.bat1⤵PID:3696
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start schedule /y1⤵PID:4512
-
C:\Windows\SysWOW64\net.exenet.exe start schedule /y1⤵PID:4948
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat1⤵PID:4592
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess /y1⤵PID:3528
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop 360timeprot /y1⤵PID:3804
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wscsvc /y1⤵PID:4664
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wuauserv /y1⤵PID:2032
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop srservice /y1⤵PID:3684
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵PID:232
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wscsvc /y1⤵PID:4292
-
C:\Windows\SysWOW64\at.exeat 7:26:45 PM C:\Windows\Sysinf.bat1⤵PID:1508
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:1876
-
C:\Windows\SysWOW64\at.exeat 7:23:45 PM C:\Windows\Sysinf.bat1⤵PID:1700
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess /y1⤵
- Suspicious use of WriteProcessMemory
PID:1136
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wscsvc /y1⤵PID:3920
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop srservice /y1⤵PID:1892
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wuauserv /y1⤵PID:1932
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop 360timeprot /y1⤵PID:3760
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop srservice /y1⤵PID:3684
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop wuauserv /y1⤵PID:3700
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess /y1⤵PID:4792
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop 360timeprot /y1⤵PID:3244
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Suspicious use of WriteProcessMemory
PID:1932
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:3976
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:4196
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Suspicious use of WriteProcessMemory
PID:3692
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:4536
-
C:\Windows\System32\sihclient.exeC:\Windows\System32\sihclient.exe /cv sKOy3FDWLE+M399mpxDEmw.0.21⤵PID:3904
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:1876 -
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d2⤵
- Views/modifies file attributes
PID:4196
-
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:2276
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:876
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:1148
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:3388
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:2348
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:1088
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r C:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:3524
-
C:\Windows\SysWOW64\attrib.exeattrib -s -h -r F:\Autorun.inf\*.* /s /d1⤵
- Views/modifies file attributes
PID:4076
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
460B
MD57db3d565d6ddbe65a8b0e093910e7dcd
SHA1d4804e6180c6e74ba79d3343f2f2ccb15e502f12
SHA256a2778cb87fd88c7508ffd506a8ff8d58d0ffc02156f846956e5e99c6cb3d2f3f
SHA5120b3d1d0f44feba9dd78903ff77fdeaea834d930990a86641fb2e4ce04da280d33f6bee0ae0b1320e4070cbe20824062e45b52e5cad797c5985d8e31dce1ef82b
-
Filesize
1.1MB
MD5ded1a57c6bbbc8a003d777a78708ccf8
SHA15fb927ab6fef9202ddbd1b80efe96b40ec64d0c7
SHA25655e37588c041d865d7b2b3f1f0c6103b1167522e7b7b4f1443fd18a42a104429
SHA512040764e4aef9d1f264d7b9eba306f59f51dcf51877af86f4ff6b6cd39e13e800f3ef334ddd35d9f9e01e5e5736deb38de5128a44bf6f154ee6bf4bfddd0fa00b
-
Filesize
2KB
MD5e7d7ec66bd61fac3843c98650b0c68f6
SHA1a15ae06e1be51038863650746368a71024539bac
SHA2566475d5ecc14fea090774be55723d2d52b7ec7670527a7dbd61edf28c77944cb8
SHA512ac9e9893f5a0af03957731445f63279085f164e9a968d706a99d13012e4459314a7ccc32dc48f62379d69e21a0953c13543c9ded38b5ad5fbc346aa442af1ae6
-
Filesize
93KB
MD57082fd6c1ca3259e70887ede5aef4117
SHA13b704a09555b734f416d06f06c75ce3ca28a7cd9
SHA256337854689ef8fb423e34d83072f29596a2ba6d2a07dfd0c135115ac77b234823
SHA512608f05b726f6b95d0674b4ab5c2943d72d7b5b7ef38711c75b59460eecc774766c35604d0e9482fa946ad81a19732b8fefa322afb76c843f4fce96df46176c3f
-
Filesize
237B
MD594bcd02c5afd5918b4446345e7a5ded9
SHA179839238e84be225132e1382fae6333dfc4906a1
SHA2565d9f41e4f886926dae2ed8a57807708110d3c6964ab462be21462bff0088d9a1
SHA512149f6bd49fc3b62fa5f41666bfb3a58060514eec1b61c6aa1ac4c75417c840b028e701eb5533460eb00e2fee8543379564bc47d7477264771d81b99a0caab500