Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
10-08-2024 23:11
Static task
static1
Behavioral task
behavioral1
Sample
BkavPro.exe
Resource
win7-20240708-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
BkavPro.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
BkavPro.exe
-
Size
760KB
-
MD5
abf09a2221c6b58aca0aadba05f3cd56
-
SHA1
fa6969642f333241c89971089b63e4ff03aac42f
-
SHA256
731322b300479fe1e35a50e7069f504c2c4b359a000b29ea7500c9bcfab7a65b
-
SHA512
64b1f64daed76832202576fcd314b39575e0dbca461a41c67afac8ccc6056868456217a06df8201653e7ac3282f88e658bf5389cd97a914250b1c5774f27776f
-
SSDEEP
12288:OzAKNddaW7znYhASli1aRpsZIhBzLm6sZyGywn4N5AbH/6lRGi+jCakR:OzhdPkhASjsZKJm6sZyGyPXAbfmRGiA2
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 4 IoCs
description ioc Process File opened for modification C:\Windows\system32\DRIVERS\SET9405.tmp BkavPro.exe File created C:\Windows\system32\DRIVERS\SET9405.tmp BkavPro.exe File opened for modification C:\Windows\system32\DRIVERS\BkavSetupSd.sys BkavPro.exe File opened for modification C:\Windows\system32\Drivers\BkavSetupSd.sys BkavPro.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o" BkavPro.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.app.log BkavPro.exe -
Loads dropped DLL 4 IoCs
pid Process 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fltMC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BkavPro.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMD.EXE -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 runonce.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz runonce.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C BkavPro.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb040000000100000010000000285ec909c4ab0d2d57f5086b225799aa0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf9190000000100000010000000ea6089055218053dd01e37e1d806eedf1800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa22000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95 BkavPro.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 BkavPro.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e BkavPro.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d0030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e BkavPro.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e BkavPro.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 2468 fltMC.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeRestorePrivilege 292 BkavPro.exe Token: SeRestorePrivilege 292 BkavPro.exe Token: SeRestorePrivilege 292 BkavPro.exe Token: SeRestorePrivilege 292 BkavPro.exe Token: SeRestorePrivilege 292 BkavPro.exe Token: SeRestorePrivilege 292 BkavPro.exe Token: SeRestorePrivilege 292 BkavPro.exe Token: SeLoadDriverPrivilege 2468 fltMC.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe 292 BkavPro.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 292 BkavPro.exe 292 BkavPro.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 292 wrote to memory of 1736 292 BkavPro.exe 30 PID 292 wrote to memory of 1736 292 BkavPro.exe 30 PID 292 wrote to memory of 1736 292 BkavPro.exe 30 PID 292 wrote to memory of 1736 292 BkavPro.exe 30 PID 292 wrote to memory of 2376 292 BkavPro.exe 31 PID 292 wrote to memory of 2376 292 BkavPro.exe 31 PID 292 wrote to memory of 2376 292 BkavPro.exe 31 PID 292 wrote to memory of 2376 292 BkavPro.exe 31 PID 2376 wrote to memory of 2468 2376 CMD.EXE 34 PID 2376 wrote to memory of 2468 2376 CMD.EXE 34 PID 2376 wrote to memory of 2468 2376 CMD.EXE 34 PID 2376 wrote to memory of 2468 2376 CMD.EXE 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\BkavPro.exe"C:\Users\Admin\AppData\Local\Temp\BkavPro.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:292 -
C:\Windows\system32\runonce.exe"C:\Windows\system32\runonce.exe" -r2⤵
- Checks processor information in registry
PID:1736
-
-
C:\Windows\SysWOW64\CMD.EXECMD.EXE /c fltmc load BkavSetupSd2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\SysWOW64\fltMC.exefltmc load BkavSetupSd3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:2468
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
47KB
MD5803215483971d91b42f10b00d89df0f5
SHA1fae95849e25374780576d2270cffbd82dde20ce7
SHA2565612490c30e55792b0ab380f058ebf7666c0c3b9207cd58ec7527cfb34e16fc2
SHA512139f3077776c7678cb20c71bbeae41d7b35587b6e87de75637d5d2bce7ae223fc2ee5435d002fff44d7a4307e9755e9cdc9a77c83f621f1ec7cbf76a578b0381
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
3KB
MD5bd8a5f061d02cf0d4041c1035b4cffaf
SHA148a3a4f5d6d5270725b690a749c57928f9513238
SHA25655ed1fb2ed91d6066e98262577941c3e925a04ff5a53965917b901916f215ede
SHA51213a98cb87eedd375749f846193427710cfa1efda1f3878444cfe96cea625e7fdf9fd7331bf87f38d11e603e147e11d16c3416644eb9e6bc86da9a7f4b033a115
-
Filesize
4KB
MD53aadfc93680dc0c79083a0d819063cf9
SHA1dbde1d5e598edbbc9a0d471f4137b8ce18f3f563
SHA256ae8fbfdfecb8265187c10c247f978add3c4a4d1b48d65c760b5617823c7e397b
SHA512edb665f4a19bd817371b132a6919557820a87a874527aeb9f90764825d4176b278d6b2b397030bd952a354a020cc91c95d798284b1cb052492224c3e0414baef
-
Filesize
2KB
MD57a3c6aca47b2adb6e6583c5b1c144908
SHA104434e967c8b3c9b0a8ca7010b1641abb64efb00
SHA2567adc22dd2c8a903d08fad6af0de81362be3f68d27019d102338b592021fa3275
SHA5121ad3f956a2a28c3d4d9298bbd01ae2ea797105b76e56ae1844e1712d1fd7dd587827158a0b8ad2736033baba8af58f8c6b2eadbeaac3d707346abe55b747f863
-
Filesize
1.4MB
MD53f9f2afa135f0663946a006dd5ffd897
SHA1ea6456859b04b68af8dcd453381dd168af53fc5e
SHA256276d1c9c78c529625c2ef3d77079324628686ea184767971901a1de93681c133
SHA5128a57ce747909004aa101644734c0fb7cbc8b4482874869e5259ec92b1ef613c4985f8a0a3f362e777519ee2e2948c2579c7498f3060818bf17bc38162180ccbf