Analysis
-
max time kernel
315s -
max time network
320s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
10/07/2024, 14:50
General
-
Target
kaspersky4win202121.16.6.467ru_45357.exe
-
Size
4.3MB
-
MD5
63c9a22c500df9925f2e513ae1091653
-
SHA1
bc93f45c412173045c0e39cb1b6a622c52669de0
-
SHA256
47f5ce81ce33612610a6efc353a0735a4baf8486a898d7eceadb8a58d2415dfc
-
SHA512
1661a5a4bc12b96bd3b769ea7619a1c62ec009a3df74d6f605c9d3741234a37d89acfa05f58223195e6e0537d94294a93773b9d96c05d6536415b9e756b6ba83
-
SSDEEP
98304:EO/RG67kIN84klIci68xyDC2YmoieSoaSiHFnI6ts3/8:b724kDi6s2YBieS96/8
Malware Config
Signatures
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Downloads MZ/PE file
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 44 IoCs
-
Modifies system certificate store 2 TTPs 6 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\kaspersky4win202121.16.6.467ru_45357.exe"C:\Users\Admin\AppData\Local\Temp\kaspersky4win202121.16.6.467ru_45357.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\temp\06E9B44CBCE3FE113BF3EC69443FBBDB\kaspersky4win202121.16.6.467ru_45357.exe"C:\Windows\temp\06E9B44CBCE3FE113BF3EC69443FBBDB\kaspersky4win202121.16.6.467ru_45357.exe" -initialNonSecureSetupPath="C:\Users\Admin\AppData\Local\Temp\kaspersky4win202121.16.6.467ru_45357.exe"2⤵
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Checks for VirtualBox DLLs, possible anti-VM trick
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD579a78149e4ef2e6e09cc061338c7b151
SHA199505d2461a18f16d4d185603887c60e226347ee
SHA256e6c0da20fc5d9eda24e4128faa5641f8b2d39951e0a0236c013e1f1efcbf83fd
SHA512a3baf55b373b943f8f1c8840cdc2f02a94aed436c54fdcb8cf6eeac9b5840a5e1a11be0c70460da0c17f6fda1b01b87f4e2a688abb5ddeb7819301a1354d688e
-
Filesize
4.3MB
MD5a423a6a12fe4e5958e22d4382e3e8124
SHA1e9932b58b88a55c0f958729d909c7425a8d37541
SHA256e81dc2c3ff23d7ce547c7109a78ed876158f6f92cb684fb6256824f0800c0db9
SHA512f0e8f6620ae0e8b82d20e1c46c8fc98baf1bc47a3bb5075bfeaa59eeda1ab3a1deefe0c6b6c24201e4cd64dac070b5ad28bf951a7a69e4b3ceb60720d0676994
-
Filesize
867B
MD5c5dfb849ca051355ee2dba1ac33eb028
SHA1d69b561148f01c77c54578c10926df5b856976ad
SHA256cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b
SHA51288289cdd2c2dd1f5f4c13ab2cf9bc601fc634b5945309bedf9fc5b96bf21697b4cd6da2f383497825e02272816befbac4f44955282ffbbd4dd0ddc52281082da
-
Filesize
342B
MD5e04ceb9ac407526eaec2ae18f15cff26
SHA1d3fd557ca22b44a79c711c6e60ad2186e003cb1e
SHA256b439dcd1fe13830e37b2365a92afa4db3d85def7486ef2a02b42461b5e5efcd8
SHA512cf2fdeae1083b9da50d34a82ae1fb59e1cb208529fb5a174d80cee251655361a35bc664ec142c0b77f8690df349361ba24969e2a93713d132db0b728d3dc782c
-
Filesize
242B
MD5617c449c5083b06a784d8041e26762ec
SHA1549f523e74ee9a37ffb847577cf0083f1a72e01d
SHA2569d89f98352c844e55542cc92c0379edc0b11ee97982a370387c355273112add2
SHA512271e612862f58fd79e58d1ae274c9295206539a21a49536cbc1875f00d65fb72a82a89978b33c56bdd41f37c3340706cf7e45be8a7343210284e0c2f994f5e2a
-
Filesize
417KB
MD55bcc51f3bb85949e37ffc08cf1501f70
SHA1f2d6067c3084e5c0af33b6e4bb9837b3f05a8f83
SHA256fdcbe09d8c6ee7681e88bbf7bbcc6c87f089d034e00df6a422c3482f4a99a2bd
SHA512950d8bf52222c1ba6c5173b3a9385737b4b414a259d72adee921b524b790113f473e00b5961972b19ad5dd2349fc1ba5c7b3541086c5b93a11238992a0e3c8a5
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
39KB
MD53ab57a33a6e3a1476695d5a6e856c06a
SHA1dabb4ecffd0c422a8eebff5d4ec8116a6e90d7e7
SHA2564aace8c8a330ae8429cd8cc1b6804076d3a9ffd633470f91fd36bdd25bb57876
SHA51258dbfcf9199d72d370e2d98b8ef2713d74207a597c9494b0ecf5e4c7bf7cf60c5e85f4a92b2a1896dff63d9d5107f0d81d7dddbc7203e9e559ab7219eca0df92
-
Filesize
89KB
MD578fb3f1e9f69beca863af1ff7713249c
SHA165e00f042db34b385d9bfd0100a3b13efd79df5e
SHA256323aa8d8707a030bf245d6031b7fb439c929a3a24c5621a03276114691e45aac
SHA51279bcfa36dfb3b1a6e04d06a5d85fce6574831d5684ae55c9e08784ee6a585bde5c649438103d40edd85da3bb8fd1d27b00be16fd421d32502da3587468ee8ced
-
Filesize
279KB
MD5bb9df6ed16bad5bbcde9b106e11dff6f
SHA15a18c06282442a241e42ea45eb636cc77bf7d95c
SHA256dc5f2821548e5a660fc920224846994da0169972f18a15e04fc9943a6a08f734
SHA51212d3c0ec2cc0224614cd8dcc81bb0f5610a0b836420628722d3409775f1c186b9d7cadb9a61bf5ce5f5ae1c99fa408ad14900f7f8b83c0b5073180786f9123a6
-
Filesize
56KB
MD5a54a9d1185edd71b120010d131f0dbea
SHA1e24ebb90da9840cb2b813bac4409c9525258d864
SHA256a7d59379fdfa59c21b114b087b16028480f976efa12e3a197fff3729f28f3bb3
SHA512c16e90afa3c9d49c6fb8af03e027e927c6ae582f28ffd6cbcb79178a47346327bef6ee8791cc0c04643ca7204c964c19c270f6c8609f1225bdcaf7d5f3c94c49
-
Filesize
235KB
MD5aeb7ba2ce5574025a985313bdde99cfb
SHA17e7d4d90a11c317c5d3b5065d47ef4209296cdaa
SHA25692d7b5ad2e92e72804223e71cde8350ba7f0561e5e1b8c0002ce88e3e88f6ef0
SHA512bd0aa5b5ac94076d6d6607cf704bcd89cabf43d3f99042fee8b653a0674c315ac9e464f0aef091998152f6b107a47034b541021efaf759bf250f6f99a91ba572
-
Filesize
281KB
MD5ccf2531b77412b4eb5410888bd3eeb42
SHA1ccc53ff2ac5b21d2a026b9f3431a016aee08dcb6
SHA256170a04a3141b1c4f2606c3ba78d687972db6319d85d7a45f59958cc9f1fd05bd
SHA5126eefd54ed14076cbd391e95817ce53c4bf69bae7d3c6f75f682d8e26f236cb2e4b9153c54fe358e1f833e9661cdc010686a2a5136fa70d77ca7f81cd59e32909
-
Filesize
543KB
MD5fb389c9c3c063163f5609608405f66bc
SHA10d2d249335b82941aaa7aeb58947c12cadf04ff8
SHA2567e97138fe069a260a05bad7beddc31fc54d0909f36728ab0efa761e7580393df
SHA512c169b1e6fecd432517f58bac541820c4fde5fefd847b9dd4544d290f95334b8fc392b26cd02eebeb30aaddb87885bd35b1f0c46644b1e5b9e9c84115afebf0f7
-
Filesize
2.5MB
MD57076c5eb43353580a88554a458c393dc
SHA174d9ec58d4ef5d0a7a69fe6500b47c6873ed87ba
SHA256294055db0edebad0b62f5690d65c401ff3c859bb2ce913c7840142ea344f0f24
SHA51281c88f67e55c415a5fe48c07d020069cd494c7eaafb8c79475093121121d7360c9a72e79f9f64c6700f4a90a923ae876064d0a942c2cda3a6914c1b07a218515
-
Filesize
5.6MB
MD5986033838280c8d36c4fcc14b03caa35
SHA1ac082f683dbbf4537dccee380b802055b2cf60df
SHA25642abfb0fd3d1fba8832f5eb2aa0e0d42a10b60f4a033c1b3838668287a4e88d6
SHA5124245f331953fd6661d75349e229e012fdce8fdf85de5f3666468f9b6198d678292ecd1970a6eb0101c02c3609d2116d7a609b9341509478de1b4e03c9614d65e
-
Filesize
137KB
MD5ca5e6167b66c384f62e56fe0e1757af3
SHA14d8912deab579d0ad3bfa7477f7377d03260ec1f
SHA256a9edc78bc8dd9e6ab098c96d2f26949bf8cc7c1f1071c5d96154022dac685979
SHA51253d2828ea80ba1c9726240859c42deddf3b384bfdc173763804d5c0e59bc531de519720c8f396cba3851768be14ebed5f8f6ed501d2a99055f2abab9c920ce5a
-
Filesize
201KB
MD5f6004bd10ff1bced912d389a48138323
SHA1349d4f7bb69dec14ce5051c1ce4d7aaf33ce9ab8
SHA256fa2c2216181125daaf69ce4c7e2addc9df98e09845a27292b9775ff8d568ac39
SHA512550af5c8d54f4987a7c05347c9fa21a6cac5817ed410c5f9358bed6d13648c0c55be2426ea3b221f82b635e91f2a2c505f07703ae93392754c870853073536d5
-
Filesize
109KB
MD525e40483458b8083eb12d38b6cead136
SHA19158642854dcdc9b2610272e181d98526b3547cc
SHA2561a87d710b34b187f75e9213c95ab5eb129da63906f122035e7badf7044c929c9
SHA512381ba47f815cfc4fe665913a49f8e53121dcad53c8e63ffc3d61663a2b5db0fc3fb2e3e8784fe5a0fd058ccb0687317c11e01debf4c596795f7cae5fd45dcadb
-
Filesize
55KB
MD5b97a47906b78413d18249eaa15c0933b
SHA1ccf1951838e20c52cdc440cea34f88101310dbb3
SHA2565fd8cfbe80ec610463ab092b74e2c22b2651f30dd0660849d09210e70eca7254
SHA512b490641ca358c270e77e587c5ecff4ad60848384348603d576212e4da133d30087aa32ed11037d19de8f3f6777711255f5a6a9a66ddfa0abb87d893d72619af5
-
Filesize
997KB
MD5ff09404438a1aaf5bafa792a504e7631
SHA17e78ad564aba274bf70c5320e39ae5061b30572a
SHA256ccf8359d7862330ebb1dd0a5f50b9e12e43b1763ef64cde5417960774d1dcf11
SHA5128b90210aa69b69b9e4e06a721a444ca9e50bcb87648fffdd2f47f2056ad52c55a2228547c45757a804b3b76ced8bf8899918f5c4a23f2139061bdff1dcf23db5
-
Filesize
203KB
MD5619044935bd3151b6d1fef1e06ce5323
SHA1f5d5e2b4171465ef022ed85ea7ff1e70c7b2a581
SHA2565b6dc4ff32972e022a3a457d319ffc756c915b8f9be4fa62a550f2e361aca5f2
SHA512d5f4cc32d6ccecd4accdb78913badc5190adea1df1e173d5b47ef2c522cadf4d2f198deb25440aa1360c03ba90fe734f3f8a3b63b38e7b7c54b8d3ecaad06cd4
-
Filesize
69KB
MD5cef0c0a808a94ef99fc4dc3472691a21
SHA1637ea1d4def4e840d73af915d0118db2c8c9f2bc
SHA256186fb849e9284fda5ed5ea84b1bb7a73b4321afa063df2fa4812b7f0dd857761
SHA5120f764d85f76fe2fdcf094120f379e0841b74f710b6857722687334bd7a01329d79ab653e825c323110c9e67999429c70efe2c213b7a6a77d1d939f1829f5ad67
-
Filesize
4.3MB
MD563c9a22c500df9925f2e513ae1091653
SHA1bc93f45c412173045c0e39cb1b6a622c52669de0
SHA25647f5ce81ce33612610a6efc353a0735a4baf8486a898d7eceadb8a58d2415dfc
SHA5121661a5a4bc12b96bd3b769ea7619a1c62ec009a3df74d6f605c9d3741234a37d89acfa05f58223195e6e0537d94294a93773b9d96c05d6536415b9e756b6ba83
-
Filesize
64KB
-
Filesize
56KB
-
Filesize
544KB
-
Filesize
544KB
-
Filesize
416KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
208KB
-
Filesize
2.5MB
-
Filesize
280KB
-
Filesize
136KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
200KB
-
Filesize
88KB
-
Filesize
1000KB
-
Filesize
240KB
-
Filesize
280KB
-
Filesize
6.9MB
-
Filesize
416KB
-
Filesize
112KB
-
Filesize
72KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
56KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
40KB
-
Filesize
6.9MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB