Overview
overview
7Static
static
3Nowy Archi...P).zip
windows7-x64
1Nowy Archi...P).zip
windows10-2004-x64
1Bootstrapper.exe
windows7-x64
1Bootstrapper.exe
windows10-2004-x64
7DISCORD
windows7-x64
1DISCORD
windows10-2004-x64
1workspace/IY_FE.iy
windows7-x64
3workspace/IY_FE.iy
windows10-2004-x64
3workspace/...g.json
windows7-x64
3workspace/...g.json
windows10-2004-x64
3workspace/...V4.lua
windows7-x64
3workspace/...V4.lua
windows10-2004-x64
3workspace/...zaphub
windows7-x64
3workspace/...zaphub
windows10-2004-x64
3workspace/flingv2.js
windows7-x64
3workspace/flingv2.js
windows10-2004-x64
3workspace/shaders.js
windows7-x64
3workspace/shaders.js
windows10-2004-x64
3workspace/...99.txt
windows7-x64
1workspace/...99.txt
windows10-2004-x64
1Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
17/08/2024, 20:40
Static task
static1
Behavioral task
behavioral1
Sample
Nowy Archiwum WinRARa (ZIP).zip
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
Nowy Archiwum WinRARa (ZIP).zip
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Bootstrapper.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
Bootstrapper.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
DISCORD
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
DISCORD
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
workspace/IY_FE.iy
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
workspace/IY_FE.iy
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
workspace/KavoConfig.json
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
workspace/KavoConfig.json
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
workspace/Speed Hub X V4.lua
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
workspace/Speed Hub X V4.lua
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
workspace/ZapHub/ZapHubFolder.zaphub
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
workspace/ZapHub/ZapHubFolder.zaphub
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
workspace/flingv2.js
Resource
win7-20240705-en
Behavioral task
behavioral16
Sample
workspace/flingv2.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
workspace/shaders.js
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
workspace/shaders.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
workspace/walkerps99.txt
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
workspace/walkerps99.txt
Resource
win10v2004-20240802-en
General
-
Target
workspace/KavoConfig.json
-
Size
2B
-
MD5
99914b932bd37a50b983c5e7c90ae93b
-
SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
-
SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
-
SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\json_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\.json rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\.json\ = "json_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\json_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\json_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\json_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\json_auto_file\shell\Read rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2656 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2656 AcroRd32.exe 2656 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2904 wrote to memory of 2732 2904 cmd.exe 31 PID 2904 wrote to memory of 2732 2904 cmd.exe 31 PID 2904 wrote to memory of 2732 2904 cmd.exe 31 PID 2732 wrote to memory of 2656 2732 rundll32.exe 32 PID 2732 wrote to memory of 2656 2732 rundll32.exe 32 PID 2732 wrote to memory of 2656 2732 rundll32.exe 32 PID 2732 wrote to memory of 2656 2732 rundll32.exe 32
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\workspace\KavoConfig.json1⤵
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\workspace\KavoConfig.json2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\workspace\KavoConfig.json"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2656
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD50e052e75bed63c3178ca5a771867e784
SHA12e1b24dbbeaf1154a49d993a55e2f5cee32084ab
SHA25645b710befb1b6d494c34b550b892ef8866d170c979502000a99d4057362210dd
SHA512cfe0a61a63da82dacb977c576b82dcc3ff48532a508be781b4931b4da3dff3568c608e2324a1739fda331903a55e23e0de20759157112cabd8a7eb697ba79f41