9a9e962f5ffbf83bcd4c4e75a968986d77bddeb11fea7e74534673e93e99c20e

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09-01-2024 12:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4e430563a138c5fd55d7f7a7ea561806.exe
Size

2.0MB
MD5

4e430563a138c5fd55d7f7a7ea561806
SHA1

58a2f0061dc12629ea6a8113b1ee78fd4703c93a
SHA256

9a9e962f5ffbf83bcd4c4e75a968986d77bddeb11fea7e74534673e93e99c20e
SHA512

2ca274c002ebb6fba19d8cc043e0f758d1498c37b4970e351ce0d0ac60fa9b858213f2d475629778b6996014f1ee8d7b71a8153aaee483d97660713ca530cb4f
SSDEEP

49152:ACOxOJTYTGDqc6dGomH6gOT9dkwZMfxPUTqn9ic6f:HOx0pD36wo0f+hS30cc

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2824	cmd.exe

Executes dropped EXE 5 IoCs

pid	Process
1760	mightkak.exe
2196	mightkak.exe
1496	systray.exe
1980	mightkak.exe
2492	mightkak.exe

Loads dropped DLL 2 IoCs

pid	Process
2824	cmd.exe
2824	cmd.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\Index = "C:\\Windows\\system32\\wbem\\systray.exe"	4e430563a138c5fd55d7f7a7ea561806.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\Index = "C:\\Windows\\system32\\wbem\\systray.exe"	systray.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wbem\systray.exe	4e430563a138c5fd55d7f7a7ea561806.exe
File opened for modification	C:\Windows\SysWOW64\wbem\systray.exe	4e430563a138c5fd55d7f7a7ea561806.exe
File created	\??\c:\windows\SysWOW64\tmp0101.bat	4e430563a138c5fd55d7f7a7ea561806.exe
File created	C:\Windows\SysWOW64\wbem\systray.exe	systray.exe
File opened for modification	C:\Windows\SysWOW64\wbem\systray.exe	systray.exe
File created	\??\c:\windows\SysWOW64\tmp0101.bat	systray.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\windows\mightkak.exe	systray.exe
File opened for modification	\??\c:\windows\kak2.bat	systray.exe
File created	\??\c:\windows\ntldr.txt	4e430563a138c5fd55d7f7a7ea561806.exe
File created	\??\c:\windows\kak.bat	4e430563a138c5fd55d7f7a7ea561806.exe
File opened for modification	\??\c:\windows\kak.bat	4e430563a138c5fd55d7f7a7ea561806.exe
File created	\??\c:\windows\kak2.bat	4e430563a138c5fd55d7f7a7ea561806.exe
File opened for modification	\??\c:\windows\kak2.bat	4e430563a138c5fd55d7f7a7ea561806.exe
File created	C:\windows\mightkak.reg	systray.exe
File created	C:\windows\mightkak.exe	4e430563a138c5fd55d7f7a7ea561806.exe
File created	C:\windows\mightkak.reg	4e430563a138c5fd55d7f7a7ea561806.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 8 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1628	schtasks.exe
1300	schtasks.exe
2708	schtasks.exe
2848	schtasks.exe
2816	schtasks.exe
2800	schtasks.exe
320	schtasks.exe
1872	schtasks.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TypedURLs	systray.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TypedURLs	4e430563a138c5fd55d7f7a7ea561806.exe

Runs .reg file with regedit 2 IoCs

pid	Process
2180	regedit.exe
2544	regedit.exe

Runs ping.exe 1 TTPs 12 IoCs

Remote System Discovery

T1018

pid	Process
1148	PING.EXE
1176	PING.EXE
1044	PING.EXE
3044	PING.EXE
2400	PING.EXE
2228	PING.EXE
2600	PING.EXE
544	PING.EXE
2848	PING.EXE
3040	PING.EXE
1504	PING.EXE
656	PING.EXE

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
1684	4e430563a138c5fd55d7f7a7ea561806.exe
1684	4e430563a138c5fd55d7f7a7ea561806.exe
1684	4e430563a138c5fd55d7f7a7ea561806.exe
1684	4e430563a138c5fd55d7f7a7ea561806.exe
1684	4e430563a138c5fd55d7f7a7ea561806.exe
1684	4e430563a138c5fd55d7f7a7ea561806.exe
1684	4e430563a138c5fd55d7f7a7ea561806.exe
1496	systray.exe
1496	systray.exe
1496	systray.exe
1496	systray.exe
1496	systray.exe
1496	systray.exe
1496	systray.exe
1496	systray.exe
1496	systray.exe
1496	systray.exe
1496	systray.exe
1496	systray.exe
1496	systray.exe
1496	systray.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeBackupPrivilege	1760	mightkak.exe
Token: SeRestorePrivilege	1760	mightkak.exe
Token: SeBackupPrivilege	2196	mightkak.exe
Token: SeRestorePrivilege	2196	mightkak.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1684	4e430563a138c5fd55d7f7a7ea561806.exe
1684	4e430563a138c5fd55d7f7a7ea561806.exe
1496	systray.exe
1496	systray.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 1760	1684	4e430563a138c5fd55d7f7a7ea561806.exe	28
PID 1684 wrote to memory of 1760	1684	4e430563a138c5fd55d7f7a7ea561806.exe	28
PID 1684 wrote to memory of 1760	1684	4e430563a138c5fd55d7f7a7ea561806.exe	28
PID 1684 wrote to memory of 1760	1684	4e430563a138c5fd55d7f7a7ea561806.exe	28
PID 1684 wrote to memory of 2180	1684	4e430563a138c5fd55d7f7a7ea561806.exe	30
PID 1684 wrote to memory of 2180	1684	4e430563a138c5fd55d7f7a7ea561806.exe	30
PID 1684 wrote to memory of 2180	1684	4e430563a138c5fd55d7f7a7ea561806.exe	30
PID 1684 wrote to memory of 2180	1684	4e430563a138c5fd55d7f7a7ea561806.exe	30
PID 1684 wrote to memory of 2196	1684	4e430563a138c5fd55d7f7a7ea561806.exe	31
PID 1684 wrote to memory of 2196	1684	4e430563a138c5fd55d7f7a7ea561806.exe	31
PID 1684 wrote to memory of 2196	1684	4e430563a138c5fd55d7f7a7ea561806.exe	31
PID 1684 wrote to memory of 2196	1684	4e430563a138c5fd55d7f7a7ea561806.exe	31
PID 1684 wrote to memory of 2120	1684	4e430563a138c5fd55d7f7a7ea561806.exe	52
PID 1684 wrote to memory of 2120	1684	4e430563a138c5fd55d7f7a7ea561806.exe	52
PID 1684 wrote to memory of 2120	1684	4e430563a138c5fd55d7f7a7ea561806.exe	52
PID 1684 wrote to memory of 2120	1684	4e430563a138c5fd55d7f7a7ea561806.exe	52
PID 1684 wrote to memory of 2796	1684	4e430563a138c5fd55d7f7a7ea561806.exe	50
PID 1684 wrote to memory of 2796	1684	4e430563a138c5fd55d7f7a7ea561806.exe	50
PID 1684 wrote to memory of 2796	1684	4e430563a138c5fd55d7f7a7ea561806.exe	50
PID 1684 wrote to memory of 2796	1684	4e430563a138c5fd55d7f7a7ea561806.exe	50
PID 1684 wrote to memory of 2800	1684	4e430563a138c5fd55d7f7a7ea561806.exe	49
PID 1684 wrote to memory of 2800	1684	4e430563a138c5fd55d7f7a7ea561806.exe	49
PID 1684 wrote to memory of 2800	1684	4e430563a138c5fd55d7f7a7ea561806.exe	49
PID 1684 wrote to memory of 2800	1684	4e430563a138c5fd55d7f7a7ea561806.exe	49
PID 1684 wrote to memory of 2816	1684	4e430563a138c5fd55d7f7a7ea561806.exe	47
PID 1684 wrote to memory of 2816	1684	4e430563a138c5fd55d7f7a7ea561806.exe	47
PID 1684 wrote to memory of 2816	1684	4e430563a138c5fd55d7f7a7ea561806.exe	47
PID 1684 wrote to memory of 2816	1684	4e430563a138c5fd55d7f7a7ea561806.exe	47
PID 1684 wrote to memory of 2848	1684	4e430563a138c5fd55d7f7a7ea561806.exe	39
PID 1684 wrote to memory of 2848	1684	4e430563a138c5fd55d7f7a7ea561806.exe	39
PID 1684 wrote to memory of 2848	1684	4e430563a138c5fd55d7f7a7ea561806.exe	39
PID 1684 wrote to memory of 2848	1684	4e430563a138c5fd55d7f7a7ea561806.exe	39
PID 1684 wrote to memory of 2708	1684	4e430563a138c5fd55d7f7a7ea561806.exe	38
PID 1684 wrote to memory of 2708	1684	4e430563a138c5fd55d7f7a7ea561806.exe	38
PID 1684 wrote to memory of 2708	1684	4e430563a138c5fd55d7f7a7ea561806.exe	38
PID 1684 wrote to memory of 2708	1684	4e430563a138c5fd55d7f7a7ea561806.exe	38
PID 1684 wrote to memory of 2824	1684	4e430563a138c5fd55d7f7a7ea561806.exe	36
PID 1684 wrote to memory of 2824	1684	4e430563a138c5fd55d7f7a7ea561806.exe	36
PID 1684 wrote to memory of 2824	1684	4e430563a138c5fd55d7f7a7ea561806.exe	36
PID 1684 wrote to memory of 2824	1684	4e430563a138c5fd55d7f7a7ea561806.exe	36
PID 2120 wrote to memory of 2608	2120	cmd.exe	35
PID 2120 wrote to memory of 2608	2120	cmd.exe	35
PID 2120 wrote to memory of 2608	2120	cmd.exe	35
PID 2120 wrote to memory of 2608	2120	cmd.exe	35
PID 2796 wrote to memory of 2580	2796	cmd.exe	44
PID 2796 wrote to memory of 2580	2796	cmd.exe	44
PID 2796 wrote to memory of 2580	2796	cmd.exe	44
PID 2796 wrote to memory of 2580	2796	cmd.exe	44
PID 2796 wrote to memory of 2580	2796	cmd.exe	44
PID 2796 wrote to memory of 2580	2796	cmd.exe	44
PID 2796 wrote to memory of 2580	2796	cmd.exe	44
PID 2796 wrote to memory of 2488	2796	cmd.exe	43
PID 2796 wrote to memory of 2488	2796	cmd.exe	43
PID 2796 wrote to memory of 2488	2796	cmd.exe	43
PID 2796 wrote to memory of 2488	2796	cmd.exe	43
PID 2796 wrote to memory of 2488	2796	cmd.exe	43
PID 2796 wrote to memory of 2488	2796	cmd.exe	43
PID 2796 wrote to memory of 2488	2796	cmd.exe	43
PID 2796 wrote to memory of 3048	2796	cmd.exe	40
PID 2796 wrote to memory of 3048	2796	cmd.exe	40
PID 2796 wrote to memory of 3048	2796	cmd.exe	40
PID 2796 wrote to memory of 3048	2796	cmd.exe	40
PID 2796 wrote to memory of 3048	2796	cmd.exe	40
PID 2796 wrote to memory of 3048	2796	cmd.exe	40

C:\Users\Admin\AppData\Local\Temp\4e430563a138c5fd55d7f7a7ea561806.exe
"C:\Users\Admin\AppData\Local\Temp\4e430563a138c5fd55d7f7a7ea561806.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\mightkak.exe
  mightkak.exe -on "hklm\SYSTEM\CurrentControlSet\Control\Session Manager" -ot reg -actn ace -ace "n:todos;p:full" -ace "n:todos;p:create_subkey;m:deny;i:np"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1760
- C:\Windows\SysWOW64\regedit.exe
  regedit /S c:\Windows\mightkak.reg
  2⤵
  - Runs .reg file with regedit
  PID:2180
- C:\Windows\mightkak.exe
  mightkak.exe -on "hklm\SYSTEM\CurrentControlSet\Control\Session Manager" -ot reg -actn ace -ace "n:todos;p:full" -ace "n:system;p:create_subkey;m:deny;i:np"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2196
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\system32\tmp0101.bat
  2⤵
  - Deletes itself
  - Loads dropped DLL
  PID:2824
- - C:\Windows\SysWOW64\PING.EXE
    PING -n 3 -w 000
    3⤵
    - Runs ping.exe
    PID:1044
- - C:\Windows\SysWOW64\wbem\systray.exe
    C:\Windows\system32\wbem\systray.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies Internet Explorer settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1496
- - C:\Windows\SysWOW64\PING.EXE
    PING -n 3 -w 000
    3⤵
    - Runs ping.exe
    PID:1504
- - C:\Windows\SysWOW64\PING.EXE
    PING -n 1 -w 000
    3⤵
    - Runs ping.exe
    PID:544
- - C:\Windows\SysWOW64\PING.EXE
    PING -n 1 -w 000
    3⤵
    - Runs ping.exe
    PID:656
- - C:\Windows\SysWOW64\PING.EXE
    PING -n 1 -w 000
    3⤵
    - Runs ping.exe
    PID:1148
- - C:\Windows\SysWOW64\PING.EXE
    PING -n 1 -w 000
    3⤵
    - Runs ping.exe
    PID:1176
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn initia4 /tr c:\windows\kak2.bat /sc ONLOGON /ru system
  2⤵
  - Creates scheduled task(s)
  PID:2708
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn initia3 /tr c:\windows\kak2.bat /sc onstart /ru system
  2⤵
  - Creates scheduled task(s)
  PID:2848
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn initia2 /tr c:\windows\kak.bat /sc ONLOGON /ru system
  2⤵
  - Creates scheduled task(s)
  PID:2816
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn initia /tr c:\windows\kak.bat /sc onstart /ru system
  2⤵
  - Creates scheduled task(s)
  PID:2800
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\kak.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s /u c:\windows\downlo~1\gbiehuni.dll
    3⤵
    PID:2396
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s /u c:\windows\downlo~1\gbiehabn.dll
    3⤵
    PID:2480
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s /u c:\windows\downlo~1\gbiehcef.dll
    3⤵
    PID:3056
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s /u c:\arquiv~1\GbPlugin\gbiehuni.dll
    3⤵
    PID:2156
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s /u c:\arquiv~1\GbPlugin\gbiehabn.dll
    3⤵
    PID:1868
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s /u c:\arquiv~1\GbPlugin\gbiehcef.dll
    3⤵
    PID:2572
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s /u c:\arquiv~1\GbPlugin\gbpdist.dll
    3⤵
    PID:1936
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s /u c:\arquiv~1\GbPlugin\gbpsv.exe
    3⤵
    PID:2820
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s /u c:\arquiv~1\Scpad\scpLIB.dll
    3⤵
    PID:1544
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s /u c:\arquiv~1\Scpad\scpMIB.dll
    3⤵
    PID:1664
- - C:\Windows\SysWOW64\cacls.exe
    cacls c:\arquiv~1\GbPlugin\gbiehuni.dll /D todos
    3⤵
    PID:1592
- - C:\Windows\SysWOW64\cacls.exe
    cacls c:\arquiv~1\GbPlugin\gbiehcef.dll /D todos
    3⤵
    PID:292
- - C:\Windows\SysWOW64\cacls.exe
    cacls c:\arquiv~1\GbPlugin\gbiehabn.dll /D todos
    3⤵
    PID:1312
- - C:\Windows\SysWOW64\cacls.exe
    cacls c:\arquiv~1\GbPlugin\uni.gpc /D todos
    3⤵
    PID:1304
- - C:\Windows\SysWOW64\cacls.exe
    cacls c:\windows\downlo~1\uni.gpc /D todos
    3⤵
    PID:2072
- - C:\Windows\SysWOW64\cacls.exe
    cacls c:\arquiv~1\Scpad\scpsssh2.dll /D todos
    3⤵
    PID:2308
- - C:\Windows\SysWOW64\cacls.exe
    cacls c:\windows\kak.bat /G todos:F
    3⤵
    PID:3064
- - C:\Windows\SysWOW64\cacls.exe
    cacls c:\arquiv~1\Scpad\sshib.dll /D todos
    3⤵
    PID:1128
- - C:\Windows\SysWOW64\cacls.exe
    cacls c:\arquiv~1\Scpad\scpMIB.dll /D todos
    3⤵
    PID:2276
- - C:\Windows\SysWOW64\cacls.exe
    cacls c:\arquiv~1\Scpad\scpLIB.dll /D todos
    3⤵
    PID:2680
- - C:\Windows\SysWOW64\cacls.exe
    cacls c:\windows\downlo~1\Cef.gpc /D todos
    3⤵
    PID:1988
- - C:\Windows\SysWOW64\cacls.exe
    cacls c:\windows\downlo~1\gbiehcef.dll /D todos
    3⤵
    PID:2884
- - C:\Windows\SysWOW64\cacls.exe
    cacls c:\windows\downlo~1\gbiehabn.dll /D todos
    3⤵
    PID:2908
- - C:\Windows\SysWOW64\cacls.exe
    cacls c:\windows\downlo~1\gbiehuni.dll /D todos
    3⤵
    PID:2916
- - C:\Windows\SysWOW64\cacls.exe
    cacls c:\arquiv~1\GbPlugin\gbpsv.exe /D todos
    3⤵
    PID:2936
- - C:\Windows\SysWOW64\cacls.exe
    cacls c:\arquiv~1\GbPlugin\gbpdist.dll /D todos
    3⤵
    PID:1772
- - C:\Windows\SysWOW64\cacls.exe
    cacls c:\arquiv~1\GbPlugin\Cef.gpc /D todos
    3⤵
    PID:848
- - C:\Windows\SysWOW64\cacls.exe
    cacls c:\arquiv~1\GbPlugin\GbpSv.exe /D todos
    3⤵
    PID:1340
- - C:\Windows\SysWOW64\cacls.exe
    cacls c:\arquiv~1\GbPlugin\bb.gpc /D todos
    3⤵
    PID:2652
- - C:\Windows\SysWOW64\cacls.exe
    cacls c:\arquiv~1\GbPlugin\gbieh.gmd /D todos
    3⤵
    PID:1432
- - C:\Windows\SysWOW64\cacls.exe
    cacls c:\arquiv~1\GbPlugin\gbieh.dll /D todos
    3⤵
    PID:2896
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s /u c:\arquiv~1\Scpad\sshib.dll
    3⤵
    PID:1668
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32 /s /u c:\arquiv~1\Scpad\scpsssh2.dll
    3⤵
    PID:2240
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\kak2.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2120

C:\Windows\SysWOW64\cacls.exe
cacls c:\windows\kak.bat /G todos:F
1⤵
PID:2608

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s /u c:\arquiv~1\GbPlugin\gbieh.dll
1⤵
PID:3048

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s /u c:\windows\system32\scpsssh2.dll
1⤵
PID:2856

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s /u c:\arquiv~1\GbPlugin\gbieh.gmd
1⤵
PID:1992

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s /u c:\arquiv~1\GbPlugin\cef.gpc
1⤵
PID:2488

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s /u c:\arquiv~1\GbPlugin\bb.gpc
1⤵
PID:2580

C:\Windows\mightkak.exe
mightkak.exe -on "hklm\SYSTEM\CurrentControlSet\Control\Session Manager" -ot reg -actn ace -ace "n:todos;p:full" -ace "n:system;p:create_subkey;m:deny;i:np"
1⤵
- Executes dropped EXE
PID:2492

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s /u c:\arquiv~1\GbPlugin\bb.gpc
1⤵
PID:3008

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s /u c:\arquiv~1\GbPlugin\gbieh.dll
1⤵
PID:572

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s /u c:\windows\downlo~1\gbiehcef.dll
1⤵
PID:1808

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s /u c:\arquiv~1\GbPlugin\gbiehcef.dll
1⤵
PID:2020

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s /u c:\arquiv~1\GbPlugin\gbpsv.exe
1⤵
PID:1752

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s /u c:\arquiv~1\Scpad\scpsssh2.dll
1⤵
PID:2000

C:\Windows\SysWOW64\cacls.exe
cacls c:\arquiv~1\GbPlugin\gbieh.gmd /D todos
1⤵
PID:1760

C:\Windows\SysWOW64\cacls.exe
cacls c:\arquiv~1\GbPlugin\GbpSv.exe /D todos
1⤵
PID:2080

C:\Windows\SysWOW64\cacls.exe
cacls c:\arquiv~1\GbPlugin\gbpsv.exe /D todos
1⤵
PID:2676

C:\Windows\SysWOW64\cacls.exe
cacls c:\windows\downlo~1\Cef.gpc /D todos
1⤵
PID:2260

C:\Windows\SysWOW64\cacls.exe
cacls c:\arquiv~1\Scpad\scpLIB.dll /D todos
1⤵
PID:2876

C:\Windows\SysWOW64\cacls.exe
cacls c:\windows\kak.bat /G todos:F
1⤵
PID:2332

C:\Windows\SysWOW64\cacls.exe
cacls c:\arquiv~1\Scpad\sshib.dll /D todos
1⤵
PID:1708

C:\Windows\SysWOW64\cacls.exe
cacls c:\arquiv~1\Scpad\scpsssh2.dll /D todos
1⤵
PID:2756

C:\Windows\SysWOW64\cacls.exe
cacls c:\arquiv~1\Scpad\scpMIB.dll /D todos
1⤵
PID:2744

C:\Windows\SysWOW64\cacls.exe
cacls c:\windows\downlo~1\uni.gpc /D todos
1⤵
PID:2872

C:\Windows\SysWOW64\cacls.exe
cacls c:\windows\downlo~1\gbiehcef.dll /D todos
1⤵
PID:2832

C:\Windows\SysWOW64\cacls.exe
cacls c:\windows\downlo~1\gbiehabn.dll /D todos
1⤵
PID:2724

C:\Windows\SysWOW64\cacls.exe
cacls c:\windows\downlo~1\gbiehuni.dll /D todos
1⤵
PID:2352

C:\Windows\SysWOW64\cacls.exe
cacls c:\arquiv~1\GbPlugin\gbpdist.dll /D todos
1⤵
PID:2880

C:\Windows\SysWOW64\cacls.exe
cacls c:\arquiv~1\GbPlugin\uni.gpc /D todos
1⤵
PID:2420

C:\Windows\SysWOW64\cacls.exe
cacls c:\arquiv~1\GbPlugin\Cef.gpc /D todos
1⤵
PID:2328

C:\Windows\SysWOW64\cacls.exe
cacls c:\arquiv~1\GbPlugin\gbiehcef.dll /D todos
1⤵
PID:2340

C:\Windows\SysWOW64\cacls.exe
cacls c:\arquiv~1\GbPlugin\gbiehabn.dll /D todos
1⤵
PID:2392

C:\Windows\SysWOW64\cacls.exe
cacls c:\arquiv~1\GbPlugin\gbiehuni.dll /D todos
1⤵
PID:2180

C:\Windows\SysWOW64\cacls.exe
cacls c:\arquiv~1\GbPlugin\bb.gpc /D todos
1⤵
PID:1252

C:\Windows\SysWOW64\cacls.exe
cacls c:\arquiv~1\GbPlugin\gbieh.dll /D todos
1⤵
PID:2192

C:\Windows\SysWOW64\PING.EXE
PING -n 3 -w 000
1⤵
- Runs ping.exe
PID:3044

C:\Windows\SysWOW64\PING.EXE
PING -n 3 -w 000
1⤵
- Runs ping.exe
PID:2400

C:\Windows\SysWOW64\PING.EXE
PING -n 1 -w 000
1⤵
- Runs ping.exe
PID:2848

C:\Windows\SysWOW64\PING.EXE
PING -n 1 -w 000
1⤵
- Runs ping.exe
PID:2228

C:\Windows\SysWOW64\PING.EXE
PING -n 1 -w 000
1⤵
- Runs ping.exe
PID:2600

C:\Windows\SysWOW64\PING.EXE
PING -n 1 -w 000
1⤵
- Runs ping.exe
PID:3040

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s /u c:\arquiv~1\Scpad\sshib.dll
1⤵
PID:2520

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s /u c:\arquiv~1\Scpad\scpMIB.dll
1⤵
PID:1704

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s /u c:\arquiv~1\Scpad\scpLIB.dll
1⤵
PID:1728

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s /u c:\arquiv~1\GbPlugin\gbpdist.dll
1⤵
PID:2264

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s /u c:\arquiv~1\GbPlugin\gbiehabn.dll
1⤵
PID:1784

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s /u c:\arquiv~1\GbPlugin\gbiehuni.dll
1⤵
PID:2216

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s /u c:\windows\downlo~1\gbiehabn.dll
1⤵
PID:2384

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s /u c:\windows\downlo~1\gbiehuni.dll
1⤵
PID:2092

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s /u c:\windows\system32\scpsssh2.dll
1⤵
PID:2504

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s /u c:\arquiv~1\GbPlugin\gbieh.gmd
1⤵
PID:608

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s /u c:\arquiv~1\GbPlugin\cef.gpc
1⤵
PID:2088

C:\Windows\SysWOW64\cacls.exe
cacls c:\windows\kak.bat /G todos:F
1⤵
PID:696

C:\Windows\SysWOW64\cmd.exe
cmd /c c:\windows\system32\tmp0101.bat
1⤵
PID:948

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn initia4 /tr c:\windows\kak2.bat /sc ONLOGON /ru system
1⤵
- Creates scheduled task(s)
PID:320

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn initia3 /tr c:\windows\kak2.bat /sc onstart /ru system
1⤵
- Creates scheduled task(s)
PID:1872

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn initia2 /tr c:\windows\kak.bat /sc ONLOGON /ru system
1⤵
- Creates scheduled task(s)
PID:1628

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn initia /tr c:\windows\kak.bat /sc onstart /ru system
1⤵
- Creates scheduled task(s)
PID:1300

C:\Windows\SysWOW64\cmd.exe
cmd /c c:\windows\kak.bat
1⤵
PID:1948

C:\Windows\SysWOW64\cmd.exe
cmd /c c:\windows\kak2.bat
1⤵
PID:1548

C:\Windows\SysWOW64\regedit.exe
regedit /S c:\Windows\mightkak.reg
1⤵
- Runs .reg file with regedit
PID:2544

C:\Windows\mightkak.exe
mightkak.exe -on "hklm\SYSTEM\CurrentControlSet\Control\Session Manager" -ot reg -actn ace -ace "n:todos;p:full" -ace "n:todos;p:create_subkey;m:deny;i:np"
1⤵
- Executes dropped EXE
PID:1980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\WINDOWS\ntldr.txt

Filesize
3B

MD5
dcf2024ce15b54188e9de12e855fc761

SHA1
faae2c0b81dda269ffad17fbbd86e370f7890528

SHA256
f7217e671e4f819bc69da9d1a2d3683c26a327473bc5623a81aaaf59362bcd6e

SHA512
1919d049fef030430aa17fedd80a28e95db16ca00374737021a4d2024253a0ec8657019b3e40b33ef165e192412a4fc5b0e5e4619f8077a13664d7744c739fdf

Download Submit
C:\Windows\SysWOW64\tmp0101.bat

Filesize
493B

MD5
c087e83ceba28662eea05be5469de35a

SHA1
e0976223a768eefe8f398db3e4cf997e3185d6ef

SHA256
0436751f6bd854039bbee6e629a44ff6fca19923249c873acdae6c0892fc43ea

SHA512
3781edeb7138394da10ea9d58db3bc0ec5b760127a75bd915b7bc85b874ee8a1289ccaa65bc801d396c3960cff15e2857003ce45a71cef0bea3736b7e2f5a018

Download Submit
C:\Windows\SysWOW64\wbem\systray.exe

Filesize
136KB

MD5
76f018fea52ffd9a64f0736e70454f53

SHA1
af4c71d80edcfb7a51c84b5aa2df4473405415e4

SHA256
d75b55f38cbc966c2a4fa161a44e90a9cf202d1a1f1fb3349ace857f0b00f2ff

SHA512
e9f15ea41930ac4160940891851c7d45f4e095112fe01a744bc860b4537bdf6fa8f65567d8ece6e66a2432e23039b4b7aaadb46c0923110fc16e180debfb020e

Download Submit
C:\Windows\mightkak.exe

Filesize
252KB

MD5
19bb0722fdbeb638df3b66b1ac1552f1

SHA1
7d9f036a3b49b9b9c6b0eb41b789837e188a8da0

SHA256
4c3e18a58be2b15784a3460c7d49f1b50755dd3ccef8003d15aa7b2ae847e748

SHA512
169a3da36cc749f12812a1ab625da622042567aad0ecebbf6fc10848ccd1cb136c5182941120d7c92881ef488a2b8b559392117cfd2050f3ecde54bad7cdb36f

Download Submit
\??\c:\Windows\mightkak.reg

Filesize
39KB

MD5
5dabfc06b6f95be78f9a8035dc5222a8

SHA1
db27ad18e333c3355f526b66821434ade1ec6cff

SHA256
e30928bfa743c4ef5ad95337af6e135208e3e3b75248e384208af7f130538a84

SHA512
fe818ca83e1bb8c6a5155a1d66c09f957c4a0699f358d427bd261b1da031f9671ba23d118f467d549eefb19aabb4a83fa3e7566ae67950dbd1fdf7c0a20477eb

Download Submit
\??\c:\windows\SysWOW64\tmp0101.bat

Filesize
463B

MD5
c3248e0f422299116834542e27cd3f45

SHA1
fcd5cfce031703b8d65ae6b5f27d821e5f453ed8

SHA256
6f12a34c4bf70d37b597fa0d06019ab53a596551c33ece15e1f0a446a8b59dcc

SHA512
3531071d8ff589b16719e824cc947de112208ebfbfff265ec384d967616dd07b0c061126726e46e1c5acce7e1a0825edebe073d1c297d77985042c452c90b027

Download Submit
\??\c:\windows\kak.bat

Filesize
2KB

MD5
0e0cc25778021a8066b33281fd7979de

SHA1
3fb2272e50ccb40f1d8c742fe9f8db4e2fbdbf53

SHA256
f2d959e38c6b759cf84d8342bcc810211d635706ecd5f4a2fede2bdd64591641

SHA512
9b80301100a24050497a02ccfbf2815c3b7262db494b99d0689a3ae9559231dd17df2630a35edaf693c4963ead71c6dc008448b144b17a23e8e83b9150d4cbb3

Download Submit
\??\c:\windows\kak2.bat

Filesize
60B

MD5
d4c455e4e7e187673e5d7059d52d559a

SHA1
d7230bb387bca90367de1f377b0089e6004733a1

SHA256
f2d3c4687c6e41f462be4ea4880ae43afdf96e34603abef5d051f303a8855b76

SHA512
3d7b0f0b22188bcb494edcda43de22389f3285e2e0499030860dfd9361fc4d15ab410c5aae947433bc5f58c86750d67d8226c014d39d8b807fc96be3cbf74457

Download Submit
\Windows\SysWOW64\wbem\systray.exe

Filesize
177KB

MD5
0993ea024af48638bb18f843d35c0fd5

SHA1
7c7f7ae7af8be2bec0965a226daeb745532c4129

SHA256
eae7b2b6b0bc36e0624be13ee1079270f61e9bc79a449c403cf4a345d11b9090

SHA512
8710878e7e99378ddcc95e447a97a9187a83ad972aea64876271afc4039bd4d9747e784a28c653bba749b76b9c600c71b06dc5eba3cfde921602c7fd52c317d2

Download Submit
memory/1496-86-0x0000000005A50000-0x0000000005A51000-memory.dmp

Filesize
4KB

Download
memory/1496-50-0x0000000000400000-0x00000000013AA000-memory.dmp

Filesize
15.7MB

Download
memory/1496-87-0x0000000000400000-0x00000000013AA000-memory.dmp

Filesize
15.7MB

Download
memory/1496-55-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1684-43-0x0000000005A90000-0x0000000005A91000-memory.dmp

Filesize
4KB

Download
memory/1684-0-0x0000000000400000-0x00000000013AA000-memory.dmp

Filesize
15.7MB

Download
memory/1684-1-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1684-44-0x0000000000400000-0x00000000013AA000-memory.dmp

Filesize
15.7MB

Download
memory/2264-85-0x0000000000020000-0x0000000000027000-memory.dmp

Filesize
28KB

Download
memory/2824-49-0x0000000002760000-0x000000000370A000-memory.dmp

Filesize
15.7MB

Download
memory/2824-51-0x0000000002760000-0x000000000370A000-memory.dmp

Filesize
15.7MB

Download