2ddaf2e49ee4a36ead175a73738040586e4efb08894cceae249210cd5fc7a35c

Analysis

max time kernel
78s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
07/01/2024, 19:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a5cef94383975b7c20179bb868eaea6d.exe
Size 2.0MB
Sample240107-x2s8ssdcb4
SHA256 2ddaf2e49ee4a36ead175a73738040586e4efb08894cceae249210cd5fc7a35c
MD5 a5cef94383975b7c20179bb868eaea6d
SHA1 1cddad11f9b5a03011396675a2da62c6eab597b8
SHA512 4b78a862834c07c61174200809d918a59d9adcbdcadc6fa86c61415ed43cfc0935c5307b3863f440923d56f724811e1030bfc813666bb9defce3ccd58ad015f2
SSDEEP 24576:UuhajeZJ8NI8ueZJ8NI8ueZJ8NI8ueZJ8NI8ueZJ8NI8bSerQZb+md4wmM:bl8n8n8n8n8bSerQZbd24
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	regedit.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
29	1244	cmd.exe

Blocks application from running via registry modification 17 IoCs

Adds application to list of disallowed applications.

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\6 = "RavMon.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\8 = "RavService.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\12 = "KPFW32X.EXE"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\13 = "KAVPFW.EXE"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\15 = "KAVStart.EXE"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "RfwMain.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4 = "RavMoD.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\11 = "KPFW32.EXE"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\7 = "RavStub.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\10 = "rfwcfg.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "avp.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3 = "Rfwsrv.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\5 = "CCenter.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\9 = "Rav.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\14 = "KAV32.EXE"	regedit.exe

Sets file execution options in registry 2 TTPs 20 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "D:\\RECYCLER\\????8.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe\Debugger = "D:\\RECYCLER\\????8.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.EXE\Debugger = "D:\\RECYCLER\\????8.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe\Debugger = "D:\\RECYCLER\\????8.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RfwMain.exe\Debugger = "D:\\RECYCLER\\????8.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rfwsrv.exe\Debugger = "D:\\RECYCLER\\????8.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMoD.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMoD.exe\Debugger = "D:\\RECYCLER\\????8.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rfwsrv.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe\Debugger = "D:\\RECYCLER\\????8.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe\Debugger = "D:\\RECYCLER\\????8.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.EXE	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RfwMain.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "D:\\RECYCLER\\????8.exe"	regedit.exe

Executes dropped EXE 1 IoCs

pid	Process
836	KavUpda.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Autorun.inf	KavUpda.exe
File opened for modification	F:\Autorun.inf	KavUpda.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Option.bat	a5cef94383975b7c20179bb868eaea6d.exe
File opened for modification	C:\Windows\SysWOW64\Option.bat	KavUpda.exe

Drops file in Program Files directory 23 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	a5cef94383975b7c20179bb868eaea6d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	a5cef94383975b7c20179bb868eaea6d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	a5cef94383975b7c20179bb868eaea6d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	a5cef94383975b7c20179bb868eaea6d.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	a5cef94383975b7c20179bb868eaea6d.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	a5cef94383975b7c20179bb868eaea6d.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe	a5cef94383975b7c20179bb868eaea6d.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	a5cef94383975b7c20179bb868eaea6d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	a5cef94383975b7c20179bb868eaea6d.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	a5cef94383975b7c20179bb868eaea6d.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	a5cef94383975b7c20179bb868eaea6d.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	a5cef94383975b7c20179bb868eaea6d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	a5cef94383975b7c20179bb868eaea6d.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	a5cef94383975b7c20179bb868eaea6d.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\createdump.exe	a5cef94383975b7c20179bb868eaea6d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	a5cef94383975b7c20179bb868eaea6d.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	a5cef94383975b7c20179bb868eaea6d.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	a5cef94383975b7c20179bb868eaea6d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	a5cef94383975b7c20179bb868eaea6d.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	a5cef94383975b7c20179bb868eaea6d.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	a5cef94383975b7c20179bb868eaea6d.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	a5cef94383975b7c20179bb868eaea6d.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\createdump.exe	a5cef94383975b7c20179bb868eaea6d.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\system\KavUpda.exe	a5cef94383975b7c20179bb868eaea6d.exe
File created	C:\Windows\Help\HelpCat.exe	a5cef94383975b7c20179bb868eaea6d.exe
File opened for modification	C:\Windows\Help\HelpCat.exe	a5cef94383975b7c20179bb868eaea6d.exe
File opened for modification	C:\Windows\system\KavUpda.exe	KavUpda.exe
File opened for modification	C:\Windows\regedt32.sys	KavUpda.exe
File opened for modification	C:\Windows\system\KavUpda.exe	a5cef94383975b7c20179bb868eaea6d.exe
File created	C:\Windows\Sysinf.bat	a5cef94383975b7c20179bb868eaea6d.exe
File created	C:\Windows\regedt32.sys	a5cef94383975b7c20179bb868eaea6d.exe
File opened for modification	C:\Windows\Sysinf.bat	KavUpda.exe
File created	C:\Windows\regedt32.sys	KavUpda.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3904	sc.exe
3416	sc.exe
1284	sc.exe
2180	sc.exe
4368	sc.exe
4040	sc.exe
1180	sc.exe
4368	sc.exe

Runs net.exe

Runs regedit.exe 1 IoCs

pid	Process
2400	regedit.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: SeIncBasePriorityPrivilege	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: 33	836	KavUpda.exe
Token: SeIncBasePriorityPrivilege	836	KavUpda.exe
Token: 33	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: SeIncBasePriorityPrivilege	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: 33	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: SeIncBasePriorityPrivilege	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: 33	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: SeIncBasePriorityPrivilege	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: 33	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: SeIncBasePriorityPrivilege	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: 33	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: SeIncBasePriorityPrivilege	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: 33	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: SeIncBasePriorityPrivilege	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: 33	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: SeIncBasePriorityPrivilege	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: 33	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: SeIncBasePriorityPrivilege	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: 33	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: SeIncBasePriorityPrivilege	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: 33	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: SeIncBasePriorityPrivilege	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: 33	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: SeIncBasePriorityPrivilege	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: 33	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: SeIncBasePriorityPrivilege	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: 33	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: SeIncBasePriorityPrivilege	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: 33	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: SeIncBasePriorityPrivilege	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: 33	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: SeIncBasePriorityPrivilege	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: 33	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: SeIncBasePriorityPrivilege	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: 33	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: SeIncBasePriorityPrivilege	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: 33	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: SeIncBasePriorityPrivilege	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: 33	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: SeIncBasePriorityPrivilege	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: 33	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: SeIncBasePriorityPrivilege	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: 33	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: SeIncBasePriorityPrivilege	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: 33	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: SeIncBasePriorityPrivilege	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: 33	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: SeIncBasePriorityPrivilege	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: 33	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: SeIncBasePriorityPrivilege	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: 33	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: SeIncBasePriorityPrivilege	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: 33	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: SeIncBasePriorityPrivilege	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: 33	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: SeIncBasePriorityPrivilege	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: 33	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: SeIncBasePriorityPrivilege	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: 33	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: SeIncBasePriorityPrivilege	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: 33	3548	a5cef94383975b7c20179bb868eaea6d.exe
Token: SeIncBasePriorityPrivilege	3548	a5cef94383975b7c20179bb868eaea6d.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3548	a5cef94383975b7c20179bb868eaea6d.exe
836	KavUpda.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3548 wrote to memory of 5044	3548	a5cef94383975b7c20179bb868eaea6d.exe	24
PID 3548 wrote to memory of 5044	3548	a5cef94383975b7c20179bb868eaea6d.exe	24
PID 3548 wrote to memory of 5044	3548	a5cef94383975b7c20179bb868eaea6d.exe	24
PID 3548 wrote to memory of 4144	3548	a5cef94383975b7c20179bb868eaea6d.exe	18
PID 3548 wrote to memory of 4144	3548	a5cef94383975b7c20179bb868eaea6d.exe	18
PID 3548 wrote to memory of 4144	3548	a5cef94383975b7c20179bb868eaea6d.exe	18
PID 4144 wrote to memory of 2948	4144	net.exe	22
PID 4144 wrote to memory of 2948	4144	net.exe	22
PID 4144 wrote to memory of 2948	4144	net.exe	22
PID 3548 wrote to memory of 372	3548	a5cef94383975b7c20179bb868eaea6d.exe	111
PID 3548 wrote to memory of 372	3548	a5cef94383975b7c20179bb868eaea6d.exe	111
PID 3548 wrote to memory of 372	3548	a5cef94383975b7c20179bb868eaea6d.exe	111
PID 3548 wrote to memory of 4196	3548	a5cef94383975b7c20179bb868eaea6d.exe	206
PID 3548 wrote to memory of 4196	3548	a5cef94383975b7c20179bb868eaea6d.exe	206
PID 3548 wrote to memory of 4196	3548	a5cef94383975b7c20179bb868eaea6d.exe	206
PID 3548 wrote to memory of 3224	3548	a5cef94383975b7c20179bb868eaea6d.exe	108
PID 3548 wrote to memory of 3224	3548	a5cef94383975b7c20179bb868eaea6d.exe	108
PID 3548 wrote to memory of 3224	3548	a5cef94383975b7c20179bb868eaea6d.exe	108
PID 3548 wrote to memory of 1136	3548	a5cef94383975b7c20179bb868eaea6d.exe	122
PID 3548 wrote to memory of 1136	3548	a5cef94383975b7c20179bb868eaea6d.exe	122
PID 3548 wrote to memory of 1136	3548	a5cef94383975b7c20179bb868eaea6d.exe	122
PID 3548 wrote to memory of 5072	3548	a5cef94383975b7c20179bb868eaea6d.exe	106
PID 3548 wrote to memory of 5072	3548	a5cef94383975b7c20179bb868eaea6d.exe	106
PID 3548 wrote to memory of 5072	3548	a5cef94383975b7c20179bb868eaea6d.exe	106
PID 3548 wrote to memory of 1692	3548	a5cef94383975b7c20179bb868eaea6d.exe	105
PID 3548 wrote to memory of 1692	3548	a5cef94383975b7c20179bb868eaea6d.exe	105
PID 3548 wrote to memory of 1692	3548	a5cef94383975b7c20179bb868eaea6d.exe	105
PID 3548 wrote to memory of 1932	3548	a5cef94383975b7c20179bb868eaea6d.exe	188
PID 3548 wrote to memory of 1932	3548	a5cef94383975b7c20179bb868eaea6d.exe	188
PID 3548 wrote to memory of 1932	3548	a5cef94383975b7c20179bb868eaea6d.exe	188
PID 3548 wrote to memory of 3692	3548	a5cef94383975b7c20179bb868eaea6d.exe	207
PID 3548 wrote to memory of 3692	3548	a5cef94383975b7c20179bb868eaea6d.exe	207
PID 3548 wrote to memory of 3692	3548	a5cef94383975b7c20179bb868eaea6d.exe	207
PID 3548 wrote to memory of 4368	3548	a5cef94383975b7c20179bb868eaea6d.exe	146
PID 3548 wrote to memory of 4368	3548	a5cef94383975b7c20179bb868eaea6d.exe	146
PID 3548 wrote to memory of 4368	3548	a5cef94383975b7c20179bb868eaea6d.exe	146
PID 3548 wrote to memory of 2180	3548	a5cef94383975b7c20179bb868eaea6d.exe	95
PID 3548 wrote to memory of 2180	3548	a5cef94383975b7c20179bb868eaea6d.exe	95
PID 3548 wrote to memory of 2180	3548	a5cef94383975b7c20179bb868eaea6d.exe	95
PID 3548 wrote to memory of 1284	3548	a5cef94383975b7c20179bb868eaea6d.exe	92
PID 3548 wrote to memory of 1284	3548	a5cef94383975b7c20179bb868eaea6d.exe	92
PID 3548 wrote to memory of 1284	3548	a5cef94383975b7c20179bb868eaea6d.exe	92
PID 3548 wrote to memory of 3416	3548	a5cef94383975b7c20179bb868eaea6d.exe	91
PID 3548 wrote to memory of 3416	3548	a5cef94383975b7c20179bb868eaea6d.exe	91
PID 3548 wrote to memory of 3416	3548	a5cef94383975b7c20179bb868eaea6d.exe	91
PID 3548 wrote to memory of 2400	3548	a5cef94383975b7c20179bb868eaea6d.exe	68
PID 3548 wrote to memory of 2400	3548	a5cef94383975b7c20179bb868eaea6d.exe	68
PID 3548 wrote to memory of 2400	3548	a5cef94383975b7c20179bb868eaea6d.exe	68
PID 3548 wrote to memory of 4116	3548	a5cef94383975b7c20179bb868eaea6d.exe	89
PID 3548 wrote to memory of 4116	3548	a5cef94383975b7c20179bb868eaea6d.exe	89
PID 3548 wrote to memory of 4116	3548	a5cef94383975b7c20179bb868eaea6d.exe	89
PID 3548 wrote to memory of 4100	3548	a5cef94383975b7c20179bb868eaea6d.exe	136
PID 3548 wrote to memory of 4100	3548	a5cef94383975b7c20179bb868eaea6d.exe	136
PID 3548 wrote to memory of 4100	3548	a5cef94383975b7c20179bb868eaea6d.exe	136
PID 1932 wrote to memory of 3684	1932	Conhost.exe	127
PID 1932 wrote to memory of 3684	1932	Conhost.exe	127
PID 1932 wrote to memory of 3684	1932	Conhost.exe	127
PID 1692 wrote to memory of 2032	1692	net.exe	84
PID 1692 wrote to memory of 2032	1692	net.exe	84
PID 1692 wrote to memory of 2032	1692	net.exe	84
PID 1136 wrote to memory of 4664	1136	net1.exe	83
PID 1136 wrote to memory of 4664	1136	net1.exe	83
PID 1136 wrote to memory of 4664	1136	net1.exe	83
PID 3692 wrote to memory of 3804	3692	Conhost.exe	82

Views/modifies file attributes 1 TTPs 16 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4196	attrib.exe
1380	attrib.exe
3388	attrib.exe
1876	attrib.exe
3976	attrib.exe
4536	attrib.exe
1876	attrib.exe
3484	attrib.exe
1088	attrib.exe
4196	attrib.exe
2348	attrib.exe
3524	attrib.exe
4076	attrib.exe
2276	attrib.exe
876	attrib.exe
1148	attrib.exe

C:\Users\Admin\AppData\Local\Temp\a5cef94383975b7c20179bb868eaea6d.exe
"C:\Users\Admin\AppData\Local\Temp\a5cef94383975b7c20179bb868eaea6d.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3548
- C:\Windows\SysWOW64\net.exe
  net.exe start schedule /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4144
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 start schedule /y
    3⤵
    PID:2948
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
  2⤵
  PID:5044
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\Windows\regedt32.sys
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Blocks application from running via registry modification
  - Sets file execution options in registry
  - Runs regedit.exe
  PID:2400
- C:\Windows\system\KavUpda.exe
  C:\Windows\system\KavUpda.exe
  2⤵
  - Executes dropped EXE
  - Drops autorun.inf file
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:836
- - C:\Windows\SysWOW64\sc.exe
    C:\Windows\system32\sc.exe config wscsvc start= disabled
    3⤵
    - Launches sc.exe
    PID:4040
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:3912
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:1124
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
    3⤵
    PID:4100
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
    3⤵
    PID:2972
- - C:\Windows\SysWOW64\sc.exe
    C:\Windows\system32\sc.exe config srservice start= disabled
    3⤵
    - Launches sc.exe
    PID:1180
- - C:\Windows\SysWOW64\sc.exe
    C:\Windows\system32\sc.exe config SharedAccess start= disabled
    3⤵
    - Launches sc.exe
    PID:4368
- - C:\Windows\SysWOW64\sc.exe
    C:\Windows\system32\sc.exe config srservice start= disabled
    3⤵
    - Launches sc.exe
    PID:3904
- - C:\Windows\SysWOW64\net.exe
    net.exe stop 360timeprot /y
    3⤵
    PID:4708
- - C:\Windows\SysWOW64\net.exe
    net.exe stop srservice /y
    3⤵
    PID:3336
- - C:\Windows\SysWOW64\net.exe
    net.exe stop wuauserv /y
    3⤵
    PID:4680
- - C:\Windows\SysWOW64\net.exe
    net.exe stop sharedaccess /y
    3⤵
    PID:1560
- - C:\Windows\SysWOW64\net.exe
    net.exe stop wscsvc /y
    3⤵
    PID:3848
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c at 7:26:45 PM C:\Windows\Sysinf.bat
    3⤵
    PID:2216
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c at 7:23:45 PM C:\Windows\Sysinf.bat
    3⤵
    PID:1800
- - C:\Windows\SysWOW64\At.exe
    At.exe 7:24:43 PM C:\Windows\Help\HelpCat.exe
    3⤵
    PID:5104
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:1420
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:1064
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:2212
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:4308
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    - Blocklisted process makes network request
    PID:1244
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:2704
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:1700
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:2836
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:1784
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r C:\Autorun.inf\*.* /s /d
      4⤵
      Views/modifies file attributes
      PID:3484
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:4724
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:2212
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:3572
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:4856
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:5072
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:1800
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:3332
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:3792
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:3820
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:2252
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:4108
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:2116
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:1604
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:3388
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:3620
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:3804
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:4284
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:464
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:908
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:2116
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:1876
- C:\Windows\SysWOW64\reg.exe
  C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
  2⤵
  PID:4100
- C:\Windows\SysWOW64\reg.exe
  C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
  2⤵
  PID:4116
- C:\Windows\SysWOW64\sc.exe
  C:\Windows\system32\sc.exe config srservice start= disabled
  2⤵
  - Launches sc.exe
  PID:3416
- C:\Windows\SysWOW64\sc.exe
  C:\Windows\system32\sc.exe config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  PID:1284
- C:\Windows\SysWOW64\sc.exe
  C:\Windows\system32\sc.exe config SharedAccess start= disabled
  2⤵
  - Launches sc.exe
  PID:2180
- C:\Windows\SysWOW64\sc.exe
  C:\Windows\system32\sc.exe config srservice start= disabled
  2⤵
  - Launches sc.exe
  PID:4368
- C:\Windows\SysWOW64\net.exe
  net.exe stop 360timeprot /y
  2⤵
  PID:3692
- C:\Windows\SysWOW64\net.exe
  net.exe stop srservice /y
  2⤵
  PID:1932
- C:\Windows\SysWOW64\net.exe
  net.exe stop wuauserv /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1692
- C:\Windows\SysWOW64\net.exe
  net.exe stop sharedaccess /y
  2⤵
  PID:5072
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    - Views/modifies file attributes
    PID:1380
- C:\Windows\SysWOW64\net.exe
  net.exe stop wscsvc /y
  2⤵
  PID:1136
- C:\Windows\SysWOW64\cmd.exe
  cmd /c at 7:26:42 PM C:\Windows\Sysinf.bat
  2⤵
  PID:3224
- C:\Windows\SysWOW64\cmd.exe
  cmd /c at 7:23:42 PM C:\Windows\Sysinf.bat
  2⤵
  PID:4196
- C:\Windows\SysWOW64\At.exe
  At.exe 7:24:40 PM C:\Windows\Help\HelpCat.exe
  2⤵
  PID:372
- C:\Windows\SysWOW64\net.exe
  net.exe stop 360timeprot /y
  2⤵
  PID:1088
- C:\Windows\SysWOW64\net.exe
  net.exe stop srservice /y
  2⤵
  PID:2212
- C:\Windows\SysWOW64\net.exe
  net.exe stop wuauserv /y
  2⤵
  PID:2744
- C:\Windows\SysWOW64\net.exe
  net.exe stop sharedaccess /y
  2⤵
  PID:4564
- C:\Windows\SysWOW64\net.exe
  net.exe stop wscsvc /y
  2⤵
  PID:876

C:\Windows\SysWOW64\at.exe
at 7:26:42 PM C:\Windows\Sysinf.bat
1⤵
PID:232

C:\Windows\SysWOW64\at.exe
at 7:23:42 PM C:\Windows\Sysinf.bat
1⤵
PID:3696

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start schedule /y
1⤵
PID:4512

C:\Windows\SysWOW64\net.exe
net.exe start schedule /y
1⤵
PID:4948

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
1⤵
PID:4592

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sharedaccess /y
1⤵
PID:3528

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop 360timeprot /y
1⤵
PID:3804

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wscsvc /y
1⤵
PID:4664

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wuauserv /y
1⤵
PID:2032

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop srservice /y
1⤵
PID:3684

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:232

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wscsvc /y
1⤵
PID:4292

C:\Windows\SysWOW64\at.exe
at 7:26:45 PM C:\Windows\Sysinf.bat
1⤵
PID:1508

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:1876

C:\Windows\SysWOW64\at.exe
at 7:23:45 PM C:\Windows\Sysinf.bat
1⤵
PID:1700

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sharedaccess /y
1⤵
- Suspicious use of WriteProcessMemory
PID:1136

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wscsvc /y
1⤵
PID:3920

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop srservice /y
1⤵
PID:1892

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wuauserv /y
1⤵
PID:1932

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop 360timeprot /y
1⤵
PID:3760

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop srservice /y
1⤵
PID:3684

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wuauserv /y
1⤵
PID:3700

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sharedaccess /y
1⤵
PID:4792

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop 360timeprot /y
1⤵
PID:3244

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Suspicious use of WriteProcessMemory
PID:1932

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r C:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:3976

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:4196

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Suspicious use of WriteProcessMemory
PID:3692

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r C:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:4536

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv sKOy3FDWLE+M399mpxDEmw.0.2
1⤵
PID:3904

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:1876
- C:\Windows\SysWOW64\attrib.exe
  attrib -s -h -r C:\Autorun.inf\*.* /s /d
  2⤵
  - Views/modifies file attributes
  PID:4196

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:2276

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:876

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r C:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:1148

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:3388

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r C:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:2348

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:1088

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r C:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:3524

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:4076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Sysinf.bat

Path C:\Windows\Sysinf.bat
Size 460B
SHA256 a2778cb87fd88c7508ffd506a8ff8d58d0ffc02156f846956e5e99c6cb3d2f3f
MD5 7db3d565d6ddbe65a8b0e093910e7dcd
SHA1 d4804e6180c6e74ba79d3343f2f2ccb15e502f12
SHA512 0b3d1d0f44feba9dd78903ff77fdeaea834d930990a86641fb2e4ce04da280d33f6bee0ae0b1320e4070cbe20824062e45b52e5cad797c5985d8e31dce1ef82b
MD5 SHA1 SHA512

Submit Download

KavUpda.exe

Path C:\Windows\System\KavUpda.exe
Size 1.1MB
SHA256 55e37588c041d865d7b2b3f1f0c6103b1167522e7b7b4f1443fd18a42a104429
MD5 ded1a57c6bbbc8a003d777a78708ccf8
SHA1 5fb927ab6fef9202ddbd1b80efe96b40ec64d0c7
SHA512 040764e4aef9d1f264d7b9eba306f59f51dcf51877af86f4ff6b6cd39e13e800f3ef334ddd35d9f9e01e5e5736deb38de5128a44bf6f154ee6bf4bfddd0fa00b
SSDEEP 12288:UZWtI6RkjeZJys73dOvXDpNjNe8Nu0GOgeZJys73dOvXDpNjNe8Nu0GOgeZJys7T:UuhajeZJ8NI8ueZJ8NI8ueZJ8NI8G
MD5 SHA1 SHA512 SSDEEP

Submit Download

regedt32.sys

Path C:\Windows\regedt32.sys
Size 2KB
SHA256 6475d5ecc14fea090774be55723d2d52b7ec7670527a7dbd61edf28c77944cb8
MD5 e7d7ec66bd61fac3843c98650b0c68f6
SHA1 a15ae06e1be51038863650746368a71024539bac
SHA512 ac9e9893f5a0af03957731445f63279085f164e9a968d706a99d13012e4459314a7ccc32dc48f62379d69e21a0953c13543c9ded38b5ad5fbc346aa442af1ae6
MD5 SHA1 SHA512

Submit Download

KavUpda.exe

Path C:\Windows\system\KavUpda.exe
Size 93KB
SHA256 337854689ef8fb423e34d83072f29596a2ba6d2a07dfd0c135115ac77b234823
MD5 7082fd6c1ca3259e70887ede5aef4117
SHA1 3b704a09555b734f416d06f06c75ce3ca28a7cd9
SHA512 608f05b726f6b95d0674b4ab5c2943d72d7b5b7ef38711c75b59460eecc774766c35604d0e9482fa946ad81a19732b8fefa322afb76c843f4fce96df46176c3f
SSDEEP 768:Kndz1NOOsdBHWiNoXgPU3MGftWKpnW3HkxgTbeaWKCtVx0dQtaCLTUpFy6lQa02N:UdvOOsfHWiNocGftfQKAezdD4P
MD5 SHA1 SHA512 SSDEEP

Submit Download

Autorun.inf

Path F:\Autorun.inf
Size 237B
SHA256 5d9f41e4f886926dae2ed8a57807708110d3c6964ab462be21462bff0088d9a1
MD5 94bcd02c5afd5918b4446345e7a5ded9
SHA1 79839238e84be225132e1382fae6333dfc4906a1
SHA512 149f6bd49fc3b62fa5f41666bfb3a58060514eec1b61c6aa1ac4c75417c840b028e701eb5533460eb00e2fee8543379564bc47d7477264771d81b99a0caab500
MD5 SHA1 SHA512

Submit Download

memory/3548-0-0x0000000000400000-0x0000000000436000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads