96a2c02c92ab985233d04134b496252530282c745f3a142a359878cacd2a9025

Analysis

max time kernel
150s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-10-2024 21:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

KRLN/KRNL Remake.exe
Size

506KB
MD5

e827bd09934709f4955b0e7ea4509ae7
SHA1

4c7364758d5891c10fd603cbf104b0e9413ff4b1
SHA256

2ffc609f2556ed208c7aea6e4217c9c1e337e4004c1c0981bf455953d0b8a34e
SHA512

e17d5a319d5e6725297bf95683aad15dd72604c0d70b6bf4a438cb07ac6fec8c5dd42209961f0ebaf14fbd64735569f25092f7df1a50b43bd8c6d121decfa55f
SSDEEP

3072:vfTc9bvGjdh559dJ12QcVXqLRY3pClghBCWyyCzn8sZL3l4gxHC2E+JQLujdX:v8GvL9d2VaLa3pClghtyV8sug5Iu

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	KRNL Remake.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	KRNL Remake.exe

Modifies registry class 40 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	KRNL Remake.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	KRNL Remake.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 74003100000000002359a5291100557365727300600008000400efbeee3a851a2359a5292a000000e601000000000100000000000000000036000000000055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	KRNL Remake.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	KRNL Remake.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 4a00310000000000555907ad102054656d700000360008000400efbe2359a529555907ad2a000000ff010000000002000000000000000000000000000000540065006d007000000014000000	KRNL Remake.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0	KRNL Remake.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0	KRNL Remake.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	KRNL Remake.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	KRNL Remake.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	KRNL Remake.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff	KRNL Remake.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0 = 4a00310000000000555907ad10204b524c4e0000360008000400efbe555907ad555907ad2a000000818701000000080000000000000000000000000000004b0052004c004e00000014000000	KRNL Remake.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0 = 5200310000000000555907ad102073637269707473003c0008000400efbe555907ad555907ad2a00000088a401000000050000000000000000000000000000007300630072006900700074007300000016000000	KRNL Remake.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_Classes\Local Settings	KRNL Remake.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	KRNL Remake.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 4c00310000000000555907ad10204c6f63616c00380008000400efbe2359a529555907ad2a000000fe0100000000020000000000000000000000000000004c006f00630061006c00000014000000	KRNL Remake.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	KRNL Remake.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	KRNL Remake.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	KRNL Remake.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0\MRUListEx = ffffffff	KRNL Remake.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	KRNL Remake.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	KRNL Remake.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	KRNL Remake.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	KRNL Remake.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	KRNL Remake.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	KRNL Remake.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	KRNL Remake.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0	KRNL Remake.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	KRNL Remake.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\0\0\NodeSlot = "1"	KRNL Remake.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	KRNL Remake.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	KRNL Remake.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	KRNL Remake.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	KRNL Remake.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	KRNL Remake.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	KRNL Remake.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4c003100000000002359772f100041646d696e00380008000400efbe2359a5292359772f2a00000030000000000004000000000000000000000000000000410064006d0069006e00000014000000	KRNL Remake.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 52003100000000002359a529122041707044617461003c0008000400efbe2359a5292359a5292a000000eb0100000000020000000000000000000000000000004100700070004400610074006100000016000000	KRNL Remake.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	KRNL Remake.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	KRNL Remake.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3044	KRNL Remake.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3044	KRNL Remake.exe

Suspicious use of SetWindowsHookEx 24 IoCs

pid	Process
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe
3044	KRNL Remake.exe

C:\Users\Admin\AppData\Local\Temp\KRLN\KRNL Remake.exe
"C:\Users\Admin\AppData\Local\Temp\KRLN\KRNL Remake.exe"
1⤵
- Enumerates connected drives
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3044-0-0x000007FEF5B63000-0x000007FEF5B64000-memory.dmp

Filesize
4KB

Download
memory/3044-1-0x000000013FBB0000-0x000000013FC34000-memory.dmp

Filesize
528KB

Download
memory/3044-2-0x00000000022B0000-0x00000000022F2000-memory.dmp

Filesize
264KB

Download
memory/3044-3-0x000007FEF5B60000-0x000007FEF654C000-memory.dmp

Filesize
9.9MB

Download
memory/3044-4-0x00000000009F0000-0x00000000009FA000-memory.dmp

Filesize
40KB

Download
memory/3044-5-0x000007FEF5B60000-0x000007FEF654C000-memory.dmp

Filesize
9.9MB

Download
memory/3044-6-0x000007FEF5B60000-0x000007FEF654C000-memory.dmp

Filesize
9.9MB

Download
memory/3044-21-0x00000000269F0000-0x0000000027196000-memory.dmp

Filesize
7.6MB

Download
memory/3044-22-0x000007FEF5B63000-0x000007FEF5B64000-memory.dmp

Filesize
4KB

Download
memory/3044-23-0x000007FEF5B60000-0x000007FEF654C000-memory.dmp

Filesize
9.9MB

Download
memory/3044-24-0x0000000022280000-0x0000000022288000-memory.dmp

Filesize
32KB

Download
memory/3044-25-0x0000000022290000-0x00000000222A0000-memory.dmp

Filesize
64KB

Download
memory/3044-26-0x000007FEF5B60000-0x000007FEF654C000-memory.dmp

Filesize
9.9MB

Download
memory/3044-27-0x000007FEF5B60000-0x000007FEF654C000-memory.dmp

Filesize
9.9MB

Download
memory/3044-28-0x000007FEF5B60000-0x000007FEF654C000-memory.dmp

Filesize
9.9MB

Download