Resubmissions
22/04/2024, 19:07
240422-xsrzdaeh9x 822/04/2024, 18:35
240422-w8jghaef8z 622/04/2024, 18:12
240422-wtdbyaed8x 822/04/2024, 18:01
240422-wl3xmaeb79 6Analysis
-
max time kernel
362s -
max time network
410s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
22/04/2024, 18:01
General
-
Target
kaspersky4win202121.16.6.467ru_45356.exe
-
Size
4.3MB
-
MD5
d9b84cc79b34ed577ce4882ef496d93e
-
SHA1
fc1ea414cd738328cf66cdef303da308b9798880
-
SHA256
846adcf4d156803c03df9c9e4f9a04114228d82b2c7bcfb41440af6a9acb7b65
-
SHA512
733298c54eba2d32f323bd16aba6f8411432bffa1cefdb36a0aeed46f2c3645be2aa22d5b56c2ad936a737fa077b9e7e18e8ef484ceb39b527f586f989ff5a34
-
SSDEEP
98304:DO/RG6GkIN84klIci68xyDC2YmoieSoaSiHFnI6ts3/l:OG24kDi6s2YBieS96/l
Malware Config
Signatures
-
Checks for any installed AV software in registry 1 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 42 IoCs
-
Modifies system certificate store 2 TTPs 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\kaspersky4win202121.16.6.467ru_45356.exe"C:\Users\Admin\AppData\Local\Temp\kaspersky4win202121.16.6.467ru_45356.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\temp\A3AA8E4E2D00FE114BA4EDB2B84F3411\kaspersky4win202121.16.6.467ru_45356.exe"C:\Windows\temp\A3AA8E4E2D00FE114BA4EDB2B84F3411\kaspersky4win202121.16.6.467ru_45356.exe" -initialNonSecureSetupPath="C:\Users\Admin\AppData\Local\Temp\kaspersky4win202121.16.6.467ru_45356.exe"2⤵
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
- Drops file in Windows directory
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD579a78149e4ef2e6e09cc061338c7b151
SHA199505d2461a18f16d4d185603887c60e226347ee
SHA256e6c0da20fc5d9eda24e4128faa5641f8b2d39951e0a0236c013e1f1efcbf83fd
SHA512a3baf55b373b943f8f1c8840cdc2f02a94aed436c54fdcb8cf6eeac9b5840a5e1a11be0c70460da0c17f6fda1b01b87f4e2a688abb5ddeb7819301a1354d688e
-
Filesize
2.5MB
MD5e9789f13e61fc272f739fb66aa3f067c
SHA192b4f1000cb72fb38e9ca7c0de54952b1eacf302
SHA2567da8d9ab3f379040e3f893e9d9534a22b2c1faa57eb630347551dcc2044beea1
SHA512c0875e746ffbfc1ad63ef496265909e0a4341d066f3dbcfac9495606720c9b0b1452f5c10f2eb101d6c9f40e9255c9f1a680bd9090baa599d521eead5a5d333c
-
Filesize
15.4MB
MD55cca2d4c7693dee68fd9f971a04f75df
SHA1bb9f0ce06dd156af8ef409ae34b9feb704f9c3ea
SHA256c585e6b8082e5aefbd7fb01837912936223b4a82e5ae69f947a6ad127876d8a7
SHA512745eade65dcc111266dee0734b96975540cdbadefbd14ceea2b79c9d6b9456fd12e84e24b9f45c3f27c6e95974add50c87416cf95caddcc11cbd8cf0db440246
-
Filesize
39KB
MD53ab57a33a6e3a1476695d5a6e856c06a
SHA1dabb4ecffd0c422a8eebff5d4ec8116a6e90d7e7
SHA2564aace8c8a330ae8429cd8cc1b6804076d3a9ffd633470f91fd36bdd25bb57876
SHA51258dbfcf9199d72d370e2d98b8ef2713d74207a597c9494b0ecf5e4c7bf7cf60c5e85f4a92b2a1896dff63d9d5107f0d81d7dddbc7203e9e559ab7219eca0df92
-
Filesize
89KB
MD578fb3f1e9f69beca863af1ff7713249c
SHA165e00f042db34b385d9bfd0100a3b13efd79df5e
SHA256323aa8d8707a030bf245d6031b7fb439c929a3a24c5621a03276114691e45aac
SHA51279bcfa36dfb3b1a6e04d06a5d85fce6574831d5684ae55c9e08784ee6a585bde5c649438103d40edd85da3bb8fd1d27b00be16fd421d32502da3587468ee8ced
-
Filesize
279KB
MD5bb9df6ed16bad5bbcde9b106e11dff6f
SHA15a18c06282442a241e42ea45eb636cc77bf7d95c
SHA256dc5f2821548e5a660fc920224846994da0169972f18a15e04fc9943a6a08f734
SHA51212d3c0ec2cc0224614cd8dcc81bb0f5610a0b836420628722d3409775f1c186b9d7cadb9a61bf5ce5f5ae1c99fa408ad14900f7f8b83c0b5073180786f9123a6
-
Filesize
56KB
MD5a54a9d1185edd71b120010d131f0dbea
SHA1e24ebb90da9840cb2b813bac4409c9525258d864
SHA256a7d59379fdfa59c21b114b087b16028480f976efa12e3a197fff3729f28f3bb3
SHA512c16e90afa3c9d49c6fb8af03e027e927c6ae582f28ffd6cbcb79178a47346327bef6ee8791cc0c04643ca7204c964c19c270f6c8609f1225bdcaf7d5f3c94c49
-
Filesize
417KB
MD55bcc51f3bb85949e37ffc08cf1501f70
SHA1f2d6067c3084e5c0af33b6e4bb9837b3f05a8f83
SHA256fdcbe09d8c6ee7681e88bbf7bbcc6c87f089d034e00df6a422c3482f4a99a2bd
SHA512950d8bf52222c1ba6c5173b3a9385737b4b414a259d72adee921b524b790113f473e00b5961972b19ad5dd2349fc1ba5c7b3541086c5b93a11238992a0e3c8a5
-
Filesize
235KB
MD5aeb7ba2ce5574025a985313bdde99cfb
SHA17e7d4d90a11c317c5d3b5065d47ef4209296cdaa
SHA25692d7b5ad2e92e72804223e71cde8350ba7f0561e5e1b8c0002ce88e3e88f6ef0
SHA512bd0aa5b5ac94076d6d6607cf704bcd89cabf43d3f99042fee8b653a0674c315ac9e464f0aef091998152f6b107a47034b541021efaf759bf250f6f99a91ba572
-
Filesize
281KB
MD5ccf2531b77412b4eb5410888bd3eeb42
SHA1ccc53ff2ac5b21d2a026b9f3431a016aee08dcb6
SHA256170a04a3141b1c4f2606c3ba78d687972db6319d85d7a45f59958cc9f1fd05bd
SHA5126eefd54ed14076cbd391e95817ce53c4bf69bae7d3c6f75f682d8e26f236cb2e4b9153c54fe358e1f833e9661cdc010686a2a5136fa70d77ca7f81cd59e32909
-
Filesize
543KB
MD5fb389c9c3c063163f5609608405f66bc
SHA10d2d249335b82941aaa7aeb58947c12cadf04ff8
SHA2567e97138fe069a260a05bad7beddc31fc54d0909f36728ab0efa761e7580393df
SHA512c169b1e6fecd432517f58bac541820c4fde5fefd847b9dd4544d290f95334b8fc392b26cd02eebeb30aaddb87885bd35b1f0c46644b1e5b9e9c84115afebf0f7
-
Filesize
2.5MB
MD57076c5eb43353580a88554a458c393dc
SHA174d9ec58d4ef5d0a7a69fe6500b47c6873ed87ba
SHA256294055db0edebad0b62f5690d65c401ff3c859bb2ce913c7840142ea344f0f24
SHA51281c88f67e55c415a5fe48c07d020069cd494c7eaafb8c79475093121121d7360c9a72e79f9f64c6700f4a90a923ae876064d0a942c2cda3a6914c1b07a218515
-
Filesize
5.6MB
MD5986033838280c8d36c4fcc14b03caa35
SHA1ac082f683dbbf4537dccee380b802055b2cf60df
SHA25642abfb0fd3d1fba8832f5eb2aa0e0d42a10b60f4a033c1b3838668287a4e88d6
SHA5124245f331953fd6661d75349e229e012fdce8fdf85de5f3666468f9b6198d678292ecd1970a6eb0101c02c3609d2116d7a609b9341509478de1b4e03c9614d65e
-
Filesize
137KB
MD5ca5e6167b66c384f62e56fe0e1757af3
SHA14d8912deab579d0ad3bfa7477f7377d03260ec1f
SHA256a9edc78bc8dd9e6ab098c96d2f26949bf8cc7c1f1071c5d96154022dac685979
SHA51253d2828ea80ba1c9726240859c42deddf3b384bfdc173763804d5c0e59bc531de519720c8f396cba3851768be14ebed5f8f6ed501d2a99055f2abab9c920ce5a
-
Filesize
201KB
MD5f6004bd10ff1bced912d389a48138323
SHA1349d4f7bb69dec14ce5051c1ce4d7aaf33ce9ab8
SHA256fa2c2216181125daaf69ce4c7e2addc9df98e09845a27292b9775ff8d568ac39
SHA512550af5c8d54f4987a7c05347c9fa21a6cac5817ed410c5f9358bed6d13648c0c55be2426ea3b221f82b635e91f2a2c505f07703ae93392754c870853073536d5
-
Filesize
109KB
MD525e40483458b8083eb12d38b6cead136
SHA19158642854dcdc9b2610272e181d98526b3547cc
SHA2561a87d710b34b187f75e9213c95ab5eb129da63906f122035e7badf7044c929c9
SHA512381ba47f815cfc4fe665913a49f8e53121dcad53c8e63ffc3d61663a2b5db0fc3fb2e3e8784fe5a0fd058ccb0687317c11e01debf4c596795f7cae5fd45dcadb
-
Filesize
55KB
MD5b97a47906b78413d18249eaa15c0933b
SHA1ccf1951838e20c52cdc440cea34f88101310dbb3
SHA2565fd8cfbe80ec610463ab092b74e2c22b2651f30dd0660849d09210e70eca7254
SHA512b490641ca358c270e77e587c5ecff4ad60848384348603d576212e4da133d30087aa32ed11037d19de8f3f6777711255f5a6a9a66ddfa0abb87d893d72619af5
-
Filesize
997KB
MD5ff09404438a1aaf5bafa792a504e7631
SHA17e78ad564aba274bf70c5320e39ae5061b30572a
SHA256ccf8359d7862330ebb1dd0a5f50b9e12e43b1763ef64cde5417960774d1dcf11
SHA5128b90210aa69b69b9e4e06a721a444ca9e50bcb87648fffdd2f47f2056ad52c55a2228547c45757a804b3b76ced8bf8899918f5c4a23f2139061bdff1dcf23db5
-
Filesize
203KB
MD5619044935bd3151b6d1fef1e06ce5323
SHA1f5d5e2b4171465ef022ed85ea7ff1e70c7b2a581
SHA2565b6dc4ff32972e022a3a457d319ffc756c915b8f9be4fa62a550f2e361aca5f2
SHA512d5f4cc32d6ccecd4accdb78913badc5190adea1df1e173d5b47ef2c522cadf4d2f198deb25440aa1360c03ba90fe734f3f8a3b63b38e7b7c54b8d3ecaad06cd4
-
Filesize
69KB
MD5cef0c0a808a94ef99fc4dc3472691a21
SHA1637ea1d4def4e840d73af915d0118db2c8c9f2bc
SHA256186fb849e9284fda5ed5ea84b1bb7a73b4321afa063df2fa4812b7f0dd857761
SHA5120f764d85f76fe2fdcf094120f379e0841b74f710b6857722687334bd7a01329d79ab653e825c323110c9e67999429c70efe2c213b7a6a77d1d939f1829f5ad67
-
Filesize
3.0MB
MD5a77d6a3bd41a9ccd2f6cacc1e6cdda0b
SHA112a4a72d7f9a9ae81c87cdb30a023c51472d692c
SHA256f7c049b6caf3e1727619cb7e6f34bbff3c8aebf720bdd4a9986cb1267e07d4bb
SHA51281f5bce0e9fa48dc57ea7e915579e44c9b86c6127c505fee7a91b5c57961e00ff539314cc66f114436397dc411e3d263437937f8c3e2e4ab6f3684bd0df4e97d
-
Filesize
4.3MB
MD5d9b84cc79b34ed577ce4882ef496d93e
SHA1fc1ea414cd738328cf66cdef303da308b9798880
SHA256846adcf4d156803c03df9c9e4f9a04114228d82b2c7bcfb41440af6a9acb7b65
SHA512733298c54eba2d32f323bd16aba6f8411432bffa1cefdb36a0aeed46f2c3645be2aa22d5b56c2ad936a737fa077b9e7e18e8ef484ceb39b527f586f989ff5a34
-
Filesize
280KB
-
Filesize
112KB
-
Filesize
64KB
-
Filesize
416KB
-
Filesize
280KB
-
Filesize
544KB
-
Filesize
88KB
-
Filesize
64KB
-
Filesize
240KB
-
Filesize
64KB
-
Filesize
208KB
-
Filesize
136KB
-
Filesize
64KB
-
Filesize
56KB
-
Filesize
200KB
-
Filesize
64KB
-
Filesize
584KB
-
Filesize
7.7MB
-
Filesize
1000KB
-
Filesize
2.5MB
-
Filesize
4KB
-
Filesize
56KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
72KB
-
Filesize
56KB
-
Filesize
224KB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB