Analysis
-
max time kernel
120s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18/04/2024, 21:37
Static task
static1
Behavioral task
behavioral1
Sample
kav21.3.10.391en_26074.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
kav21.3.10.391en_26074.exe
Resource
win10v2004-20240412-en
General
-
Target
kav21.3.10.391en_26074.exe
-
Size
2.6MB
-
MD5
d0e47e632ba9144605d7bec32e126737
-
SHA1
9c02c04bed4cc77baab6ad8f22a9e780fedb61e3
-
SHA256
915ceba5edafdf1ffc45792ede4269ada50809960c2d0e74fe554010f25b9afc
-
SHA512
62b87616b11ec3299288f6015ad693e869f3dc795dfce7e3186d31e7e24e4490537ef68d739ed6aec1cd306c33057eff8827e8f1022503d0be3b42544b8e04a0
-
SSDEEP
49152:847Nlau3ZiJvDrOV9Gcwb/alTe/iXMNLdcE/EBSDre/2jX8oL:8eNlau3UJOV9GvZbRDe/2zl
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1292 startup.exe -
Loads dropped DLL 3 IoCs
pid Process 2236 kav21.3.10.391en_26074.exe 2236 kav21.3.10.391en_26074.exe 1292 startup.exe -
Checks for any installed AV software in registry 1 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab kav21.3.10.391en_26074.exe Key queried \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride kav21.3.10.391en_26074.exe Key opened \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride\International\Scripts kav21.3.10.391en_26074.exe Key opened \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride\Larger Hit Test kav21.3.10.391en_26074.exe Key value queried \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride\Main\Show image placeholders startup.exe Key value queried \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride\Main\Q300829 startup.exe Key value queried \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride\Main\JScriptProfileCacheEventDelay startup.exe Key value queried \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride\Main\CSS_Compat kav21.3.10.391en_26074.exe Key value queried \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride\Main\Play_Animations kav21.3.10.391en_26074.exe Key opened \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride\Viewport kav21.3.10.391en_26074.exe Key value queried \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride\Main\Disable Script Debugger startup.exe Key value queried \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride\Main\Move System Caret kav21.3.10.391en_26074.exe Key opened \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride\Settings kav21.3.10.391en_26074.exe Key opened \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride\International\Scripts\3 kav21.3.10.391en_26074.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride\Main startup.exe Key value queried \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride\Main\SmoothScroll startup.exe Key opened \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride\International\Scripts\4 startup.exe Key opened \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride\AdvancedOptions\DISAMBIGUATION kav21.3.10.391en_26074.exe Key opened \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride\International\Scripts\4 kav21.3.10.391en_26074.exe Key queried \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride\Main startup.exe Key value queried \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride\RtfConverterFlags startup.exe Key value queried \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride\Main\XDomainRequest startup.exe Key opened \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride\International startup.exe Key value queried \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride\Main\Display Inline Videos kav21.3.10.391en_26074.exe Key value queried \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride\Main\Show image placeholders kav21.3.10.391en_26074.exe Key value queried \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride\Main\Cleanup HTCs kav21.3.10.391en_26074.exe Key opened \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride\Text Scaling kav21.3.10.391en_26074.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride\Main\Enable Browser Extensions = "no" startup.exe Key value queried \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride\Main\CSS_Compat startup.exe Key value queried \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride\Main\DisableScriptDebuggerIE startup.exe Key queried \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab kav21.3.10.391en_26074.exe Key value queried \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride\Main\Print_Background kav21.3.10.391en_26074.exe Key value queried \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride\Main\Q300829 kav21.3.10.391en_26074.exe Key opened \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride\AdvancedOptions\DISAMBIGUATION startup.exe Key deleted \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride\Main kav21.3.10.391en_26074.exe Key deleted \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride kav21.3.10.391en_26074.exe Key value queried \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride\Main\Expand Alt Text kav21.3.10.391en_26074.exe Key value queried \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride\Main\UseHR kav21.3.10.391en_26074.exe Key opened \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride startup.exe Key value queried \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride\Main\Display Inline Videos startup.exe Key opened \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride\International\Scripts\3 startup.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride\Main kav21.3.10.391en_26074.exe Key value queried \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride\Main\Play_Background_Sounds kav21.3.10.391en_26074.exe Key value queried \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride\Main\SmoothScroll kav21.3.10.391en_26074.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride\Main\UseSWRender = "1" startup.exe Key opened \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab kav21.3.10.391en_26074.exe Key opened \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride\Text Scaling startup.exe Key queried \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride\Main kav21.3.10.391en_26074.exe Key opened \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride\Main kav21.3.10.391en_26074.exe Key value queried \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride\Main\Use_DlgBox_Colors kav21.3.10.391en_26074.exe Key value queried \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride\Main\XMLHTTP kav21.3.10.391en_26074.exe Key value queried \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride\Main\DisableScriptDebuggerIE kav21.3.10.391en_26074.exe Key value queried \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride\Main\XDomainRequest kav21.3.10.391en_26074.exe Key opened \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride\Styles kav21.3.10.391en_26074.exe Key opened \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride\MenuExt startup.exe Key opened \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride kav21.3.10.391en_26074.exe Key opened \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride\International kav21.3.10.391en_26074.exe Key opened \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride\Viewport startup.exe Key value queried \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride\Main\Disable Diagnostics Mode kav21.3.10.391en_26074.exe Key opened \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride\Main startup.exe Key value queried \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride\Main\Anchor Underline startup.exe Key opened \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride\International\Scripts startup.exe Key opened \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride\Settings startup.exe Key opened \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\KasperskyLab\IEOverride\Larger Hit Test startup.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA kav21.3.10.391en_26074.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA startup.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 kav21.3.10.391en_26074.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN kav21.3.10.391en_26074.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch startup.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" startup.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main kav21.3.10.391en_26074.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch kav21.3.10.391en_26074.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" kav21.3.10.391en_26074.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main startup.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 kav21.3.10.391en_26074.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 kav21.3.10.391en_26074.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d4304000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 kav21.3.10.391en_26074.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 kav21.3.10.391en_26074.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde kav21.3.10.391en_26074.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 kav21.3.10.391en_26074.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 2236 kav21.3.10.391en_26074.exe 2236 kav21.3.10.391en_26074.exe 2236 kav21.3.10.391en_26074.exe 1292 startup.exe 1292 startup.exe 1292 startup.exe 1292 startup.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2236 kav21.3.10.391en_26074.exe 1292 startup.exe -
Suspicious use of SetWindowsHookEx 19 IoCs
pid Process 2236 kav21.3.10.391en_26074.exe 2236 kav21.3.10.391en_26074.exe 2236 kav21.3.10.391en_26074.exe 2236 kav21.3.10.391en_26074.exe 2236 kav21.3.10.391en_26074.exe 2236 kav21.3.10.391en_26074.exe 2236 kav21.3.10.391en_26074.exe 2236 kav21.3.10.391en_26074.exe 2236 kav21.3.10.391en_26074.exe 2236 kav21.3.10.391en_26074.exe 1292 startup.exe 1292 startup.exe 1292 startup.exe 1292 startup.exe 1292 startup.exe 1292 startup.exe 1292 startup.exe 1292 startup.exe 1292 startup.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2236 wrote to memory of 1292 2236 kav21.3.10.391en_26074.exe 29 PID 2236 wrote to memory of 1292 2236 kav21.3.10.391en_26074.exe 29 PID 2236 wrote to memory of 1292 2236 kav21.3.10.391en_26074.exe 29 PID 2236 wrote to memory of 1292 2236 kav21.3.10.391en_26074.exe 29 PID 2236 wrote to memory of 1292 2236 kav21.3.10.391en_26074.exe 29 PID 2236 wrote to memory of 1292 2236 kav21.3.10.391en_26074.exe 29 PID 2236 wrote to memory of 1292 2236 kav21.3.10.391en_26074.exe 29 PID 2236 wrote to memory of 2596 2236 kav21.3.10.391en_26074.exe 30 PID 2236 wrote to memory of 2596 2236 kav21.3.10.391en_26074.exe 30 PID 2236 wrote to memory of 2596 2236 kav21.3.10.391en_26074.exe 30 PID 2236 wrote to memory of 2596 2236 kav21.3.10.391en_26074.exe 30 PID 2236 wrote to memory of 2596 2236 kav21.3.10.391en_26074.exe 30 PID 2236 wrote to memory of 2596 2236 kav21.3.10.391en_26074.exe 30 PID 2236 wrote to memory of 2596 2236 kav21.3.10.391en_26074.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\kav21.3.10.391en_26074.exe"C:\Users\Admin\AppData\Local\Temp\kav21.3.10.391en_26074.exe"1⤵
- Loads dropped DLL
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Checks for VirtualBox DLLs, possible anti-VM trick
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2091.0\au_setup_EBE73292-FDCB-11EE-A6D5-5A791E92BC44\startup.exe"C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2091.0\au_setup_EBE73292-FDCB-11EE-A6D5-5A791E92BC44\startup.exe" -auto_update_mode="C:\Users\Admin\AppData\Local\Temp\kav21.3.10.391en_26074.exe" /-self_remove -l=en -xpos=346 -ypos=71 -prevsetupver=21.3.10.391.0.21.02⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1292
-
-
C:\Users\Admin\AppData\Local\Temp\kav21.3.10.391en_26074.exe"C:\Users\Admin\AppData\Local\Temp\kav21.3.10.391en_26074.exe" -cleanup="C:\Users\Admin\AppData\Local\Temp\09237EBEBCDFEE116A5DA597E129CB44;2236"2⤵PID:2596
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2091.0\au_setup_EBE73292-FDCB-11EE-A6D5-5A791E92BC44\dynamic.ini
Filesize98B
MD58052359711301152986c22daf2d05d47
SHA17a969cc68fbb85c687a9d3ace86c182bf0b8d05b
SHA256509f94751eda031fff8c5b8f91e615b1ce3b156f3844adb89862d84287099566
SHA512aff238980c0158e5163bee86feb7c0ff8bc511f6515aa5df9bde0281e33cd5ff7edd3559ab1eb93ab16c28d8021b6c9618d16f5f058285557555e418ec47b585
-
C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2091.0\au_setup_EBE73292-FDCB-11EE-A6D5-5A791E92BC44\startup.exe
Filesize2.6MB
MD552c9f5d97af0e8d7345f51091dc905e6
SHA1ebbf72c39d30654130c9bcde627abb33a22210ac
SHA2561c44c2e745d5b0b9c16e26b04f062401426218fac5797c789ca9c02576e30617
SHA5123a74a5fda0cf1758311f62c55d90474be91c057974bfd18637fd79754a0fe6551ceac80270845ff7377c41dc32cdf5ba37c7184c65ff6322101326359f6d8267
-
C:\ProgramData\Kaspersky Lab Setup Files\KAV21.3.10.391.0.2091.0\au_setup_EBE73292-FDCB-11EE-A6D5-5A791E92BC44\static.ini
Filesize5KB
MD511069b61a2b705e749d8f48d291d7a3e
SHA1f1c0d52e26d8d653471643487c561fe3811c6145
SHA25614f8f4f4f67cfa6c322c4e46c245294b2e3632b1209bc6588e755cc7b7d2a825
SHA5125feec50c42cb7046206f54f53b25e3df422bb4fc61a965c6fdb7605f25fcb10bd67deece0e1b14ffee0f6d11dea2638715c9654f2ceab0b5f85d4f8f12c4643b
-
Filesize
4KB
MD5bdea6885cfeffb2de552578f50925fd6
SHA1c0ccb051167947ea03fac4182f3a9b96dc6f29cd
SHA256f9f10d25becf3013ea958d1a4c87c7e819c2f083eaf2e0e28c80af5c71c37beb
SHA5124e1084132d938b38dfe4f99fad69675efb7d9998242bd1093315db93e2822225b8d71e5b5e5278c4c70d290a98af6014b430dc356ea84cba265b0e60651cdab1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
Filesize471B
MD5b922e9fdf6b5c52c23408584f77e1d74
SHA1fb5384f9b9dee982b7a073adfb342f877c054a32
SHA2561849402b6d507e23c861adfd6096e01205d76520a7af99792b02e619de140f24
SHA512cbca0a8059a4af94ae56b541e3429af86298ffa9e4f3a790ca474a48946fa28a70001b7e945e114cd7087e5bf2c81a6923d931024807fbd6d1a769372248c314
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD565d7dc01714db22611ae1e9ba6f17053
SHA1b9597d4b0e3b398693d0ebd92ada4fb1041ca9e7
SHA25672b63e333a7d19216fbb60206dabd5aa197514b1eb40cc3d92064a22c9b89e8f
SHA512eba5d39fb116276d6ad9d8f6048c01b4bd27cb5c3203b4d5d03835daec711995c31e53fc1e7d2d2868e8a730d769e17971967d31038c393b2248001c1a69a097
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
Filesize400B
MD536a5ae12ac0bdbeb2d79bd924fec4bbc
SHA14b543ae4edb4fa6553fb15d6f38fec97bd97350e
SHA2563e67e3d7deae0cec868de821eb7735f52442ea0b985be539495b3b4ce9bd7b4e
SHA512c717509e84c1245186e16d7df12a87b5447c932e8abcccb7b25a16feeadce2b7a596169ed2a50f5bdecf046cd4ae5ae7570b3d96dfecf42585d6c995a9f4e413
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
1KB
MD5b79ab8145423e4714f4d3623a7913eef
SHA10f17053bd76724cb244866c537de47ea6124331a
SHA25659a439debcea1f039382e258a337031f9878450afbce19a2a52a37783009fafe
SHA512239663617d89722d8c4187804901436c456444b92655ade83c1fbf04231467693869efdc689123724dcc58d63665efb5dbb2a835fe49144facbea361c8ae9151
-
Filesize
10KB
MD569d4b9b309bfa6a87f7620647bafd2d0
SHA1c9f6bb4d6494bbd7a47d52874da43501afb97c6d
SHA256f056164cf99799234c90e2318e90ab5d83d0fd855118224286ff0680ee455734
SHA5122aa95fa187d24b4310af4e72a49c8fe665b84aa15ed33ca5b78a88da861554948d5fdb2f0b59ba8560b8c9dc1d4ff8cf5b37bdc1cbdb4fdf7a6e6fbe7e4f4b1a
-
Filesize
4KB
MD518f81892daa926fec1d30324b4cd9367
SHA10f0753271f09aecd6731c9dd998d15df5f967b7e
SHA256681a96b96b5e0425fc74be929d29164528bf0bc0a84ac97952c011e407e23d9b
SHA5125e07a3f44f6135291909680abb62e21d0c6bca899905aafa66cc3b436e77430a3ea96a95b54f2705e1f9dd49b60a855d986c4d76ea65dc9a9a5edf3d2748550d
-
Filesize
94KB
MD5618538b4ab9639d444e962729a927f15
SHA1dacc1f76630a9708add066819b1aabf8dce01056
SHA25627d92130c0321dad5a03760fd5ac98a3d04ed4c94d88418fe6d50da1f7fc5cbe
SHA512bcb6754ea246939a19a917cc0b810e1753c1b0f1a8b1b7e652128ef15dee4fc79111e4d88fe12f9188449a307e82240d0261af402d783428edfe5785c860372d
-
Filesize
5KB
MD5d2c620c462b75696eea1fb22fb23602a
SHA1900f78eb8e1103be1535af5e76d1bed686cdcce3
SHA256dd678d32073078552e0e2c35eed78f16cc8d6e8662d4734518561a1b183f775c
SHA51240e1180b63b328c22cfacc40529cbda2409a54fbbbd5813fcc5f8dcdf95ad7fcd74ea96382e3a2d0bcfed9e68c208f7733b7c630edee7e2013c9a5459091c02c
-
Filesize
306B
MD51304724dd5001b2600fc5bd80c098f1e
SHA187ec458c25a35e3a45c2a6ede9ec16ec4d4c7093
SHA2562481b34b48fd96b194405da621e8e5f19142dcb55744f9c9a93591705cb697fd
SHA5124371fbd6ba7e84ae827ec73bec4c903275e4373c16063b6fe63ca157a4db346df5617a9db5c9e1fdcb661f220f6dcbc1f7e4003805dba9fa7a279fc882aebeeb
-
Filesize
1KB
MD55134186180074c51639d7a514919ed23
SHA123bddb16b3b6c3a687dfcfed5c1a6c23c0ed1f0a
SHA25633e84b33ff911257e3a6a303c08a2cc178827dadb7dfd7c951e096866e02ad5e
SHA5128ad216cee9192533801b0f10f3bc149506f75dfd2cd554e801e1732b474629435ada4549473176b5440c57c112986dd198dcf508fb0e55ed3a050a75b0fa3d82
-
Filesize
306B
MD5026425ccbf4417eefa444285707132ef
SHA1a953b9f6781d4b6daa2eedc0c45d358f2a472370
SHA25697e5f342227ea23c27c1b660f111847fcdd9d7b23c1d248c733a36f983fd7f04
SHA512a266e2f9f10620347f0d05d081362086e81c67fb7c5f4a74c26cca54686f6afb2f2933b1f7afb6d9c96382ff4e4e3cf2f0f38cdd162175cdefccb5909b1aa6c3
-
Filesize
29KB
MD52b4bd0afd0e9dd5c90fb8c3bb4a5d619
SHA1a4a1a61d43e8f897d36fef9e1927848de2d312cc
SHA256f9963b403e053f6bfa7c87cad3c10dd55cf1f94fefe00c6380921440e28b48d2
SHA512c0b284552502304f05dd10606e01b0d35210a27f982bba8a605f2939a2ac43890636175431eab99edc45cfc2825fe1b1cffabd8067d9eaa7ad59af466a052974
-
Filesize
2KB
MD5725363d5b886e02f1c5476f79590b577
SHA1be2e4e60b62c8705443972015a86a23c7ec4bd50
SHA25629f0688682087bc5262f8abb97d0804a1fc8a7ff16685c24b6197e61cc1a6401
SHA512eeabe64d4828c5633fb687c72d75b3524f62b9a4a912b3fb36d280e0c32e7d79fe12f92e8bb962ccbe10a1770016ac108d853b5046089316d25d7e2d6bf39413
-
Filesize
104B
MD51708e3ef892548bf3c29a8d5231a3a91
SHA1ae7dd19c14d7ab85b7c771d2508873bca7d2e2cf
SHA2561c8fde3b205e9042dfa7a1ce710323ce8cb916fb896896a76df458886e3d72da
SHA51215cf16a367a01a3a9bbe3f06c58ff1cf79734c3afbdd811fe876349532a3dc6b311687523ea5cddde0145b6d49961a39c112aaa4f9cbfb4f08e8c5600350b7b0
-
Filesize
5.1MB
MD57c0418acfb24086ede591a7e1d3df7ac
SHA19bee27188d04bf44fa2e95a8fcb575497396f2b0
SHA256d7b6905661d364be51bdb7e8e2ef9832ed0c33f056c4f40368f9ae6c1b4e608a
SHA512e2c45aad07d5db230c9758fde258ab5589160d81a8723a5d246fe3287fca1a192b162c33f35144a44d16dd655e4a86694acd55c9279a15b795777ede2b14f71c
-
Filesize
5.1MB
MD547bba658d9b8c74a8c94d7024ba608b6
SHA1902be0a993f37db76eb5ad237aae5568c20bad95
SHA2563279d6e132eb640cef3d74c5edf851a93e9553d7c889a6e665360058405af5f5
SHA5128a8635083db6cc825cac63ca834cc1b1ec5412746db293f1bf44af5731265044c45108a54adf428e83111237c1f3e60f7dd048ec7066b655780145c80569a1e0