Analysis

  • max time kernel
    91s
  • max time network
    98s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-05-2024 12:51

General

  • Target

    kav21.3.10.391en_26074.exe

  • Size

    2.6MB

  • MD5

    b5af88375274f483302082b0732c3fe3

  • SHA1

    f88dd4162e4cd03602156b4ca80bf72cd40189ca

  • SHA256

    2718dbeb8322435219fedc9e55ef236052c9e8f1e85429a3c98d963ad733b9b6

  • SHA512

    6f1a5b0fdd67126047563520ce603e761208b0d745198e6bccd1ec95af8388ccd22c3e1af60472e94ff610defcdab16f52459506b27f455b2386993ab63b6cf3

  • SSDEEP

    49152:247Nlau3Z6JvDrOV9Gcwb/alTe/iXMNLdcE/EBSDre/2jX8oN:2eNlau3MJOV9GvZbRDe/2zb

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Checks for any installed AV software in registry 1 TTPs 45 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\kav21.3.10.391en_26074.exe
    "C:\Users\Admin\AppData\Local\Temp\kav21.3.10.391en_26074.exe"
    1⤵
    • Loads dropped DLL
    • Checks for any installed AV software in registry
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4664

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\35E1851638E1FE112A1D642887CF0FE8\setup.dll

    Filesize

    5.1MB

    MD5

    7c0418acfb24086ede591a7e1d3df7ac

    SHA1

    9bee27188d04bf44fa2e95a8fcb575497396f2b0

    SHA256

    d7b6905661d364be51bdb7e8e2ef9832ed0c33f056c4f40368f9ae6c1b4e608a

    SHA512

    e2c45aad07d5db230c9758fde258ab5589160d81a8723a5d246fe3287fca1a192b162c33f35144a44d16dd655e4a86694acd55c9279a15b795777ede2b14f71c

  • C:\Users\Admin\AppData\Local\Temp\61581E54-1E83-11EF-A2D1-468278FCF08E\check_new_version.html

    Filesize

    1KB

    MD5

    b79ab8145423e4714f4d3623a7913eef

    SHA1

    0f17053bd76724cb244866c537de47ea6124331a

    SHA256

    59a439debcea1f039382e258a337031f9878450afbce19a2a52a37783009fafe

    SHA512

    239663617d89722d8c4187804901436c456444b92655ade83c1fbf04231467693869efdc689123724dcc58d63665efb5dbb2a835fe49144facbea361c8ae9151

  • memory/4664-2-0x0000000077EA0000-0x0000000077EB0000-memory.dmp

    Filesize

    64KB

  • memory/4664-3-0x0000000077D32000-0x0000000077D33000-memory.dmp

    Filesize

    4KB

  • memory/4664-1-0x0000000077EA0000-0x0000000077EB0000-memory.dmp

    Filesize

    64KB

  • memory/4664-0-0x0000000077EA0000-0x0000000077EB0000-memory.dmp

    Filesize

    64KB