Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
12/05/2024, 20:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
29610a7a1629748d0a9bb7eb7a42cfd1831deb0507664c8bfa1e743c23da47af.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
29610a7a1629748d0a9bb7eb7a42cfd1831deb0507664c8bfa1e743c23da47af.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 29610a7a1629748d0a9bb7eb7a42cfd1831deb0507664c8bfa1e743c23da47af.exe
- Size 53KB
- Sample240512-y1rt1she34
- SHA256 29610a7a1629748d0a9bb7eb7a42cfd1831deb0507664c8bfa1e743c23da47af
- MD5 f971a10edd05ee144ca9b0dddefabe5b
- SHA1 36377df61a33b03d49a5edd9360643ff0f1a2062
- SHA512 1ad1bb6b7bc89a5ac4434c0fddbe8ee86c342f530401db3553b2c9a7cb9ccc571d6fe009df036a84f7fe98b623ee5f3497e7f8a09c003d451fdd62fbeb97fd70
- SSDEEP 1536:vNpg8r8QCIZA7C7Kp3StjEMjmLM3ztDJWZsXy4JzxPME:aIZA7CJJjmLM3zRJWZsXy4JN
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" kaecaat.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 29610a7a1629748d0a9bb7eb7a42cfd1831deb0507664c8bfa1e743c23da47af.exe - Executes dropped EXE 1 IoCs
pid Process 992 kaecaat.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kaecaat = "C:\\Users\\Admin\\kaecaat.exe" kaecaat.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe 992 kaecaat.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1196 29610a7a1629748d0a9bb7eb7a42cfd1831deb0507664c8bfa1e743c23da47af.exe 992 kaecaat.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1196 wrote to memory of 992 1196 29610a7a1629748d0a9bb7eb7a42cfd1831deb0507664c8bfa1e743c23da47af.exe 87 PID 1196 wrote to memory of 992 1196 29610a7a1629748d0a9bb7eb7a42cfd1831deb0507664c8bfa1e743c23da47af.exe 87 PID 1196 wrote to memory of 992 1196 29610a7a1629748d0a9bb7eb7a42cfd1831deb0507664c8bfa1e743c23da47af.exe 87 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80 PID 992 wrote to memory of 1196 992 kaecaat.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\29610a7a1629748d0a9bb7eb7a42cfd1831deb0507664c8bfa1e743c23da47af.exe"C:\Users\Admin\AppData\Local\Temp\29610a7a1629748d0a9bb7eb7a42cfd1831deb0507664c8bfa1e743c23da47af.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\kaecaat.exe"C:\Users\Admin\kaecaat.exe"2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:992
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\kaecaat.exe
- Size 53KB
- SHA256 e3df19ca2a1367049e8d0d4570e1a0be3734b8599a72ea032ced261f9482530f
- MD5 b9b750491a6ba7838a6d0c9ecd69a3cb
- SHA1 a6181d41415920c3694013dcbc1279d6096acc10
- SHA512 98ab332f47472b1ab35b6b6dadd9c827afeccf4c4b1949d83c0e7156534b5cb0b350357df42f7f943dccb7ccccdf7819f06bc3c918f984a50f090661b0d06967
- SSDEEP 1536:vNfg8r8QoSaH7Kp3StjEMjmLM3ztDJWZsXy4JzxPMk:+SaHJJjmLM3zRJWZsXy4Jt
- MD5 SHA1 SHA512 SSDEEP