Resubmissions
04-11-2024 03:20
241104-dv3zwasdnf 804-11-2024 03:16
241104-dsxp3svmeq 803-11-2024 23:56
241103-3zhxya1jer 3Analysis
-
max time kernel
179s -
max time network
181s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
04-11-2024 03:16
Static task
static1
Behavioral task
behavioral1
Sample
Kawaii.exe
Resource
win11-20241007-en
Behavioral task
behavioral2
Sample
Kawaii.exe
Resource
win7-20240708-en
Errors
General
-
Target
Kawaii.exe
-
Size
5.3MB
-
MD5
d9dabab21dc0ae729cd41a81850e8593
-
SHA1
afca150f0964df9bf4c9336465ed0ff3c7ed4900
-
SHA256
14c2553770ce1d8784cdd691d03f2d215c7112e29cc01701c9c5e8cd27b122f6
-
SHA512
0caf4e854dd4458f8a2d730fe56d6a4c19cf1af5eb7e4b3534b34fd6758be15fbe320c4f823bd53d22d983a0f2fc14e4a8662d7d6c223e823ffa6423f617c5a3
-
SSDEEP
98304:X3u3YBR2ycevqJZUfYLceHQIJ/xvSBIcevqJZUfYLcN3HQIJ/xvf2:nvcLrvLcqQIJjcLrvLc5QIJ
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Drops file in Drivers directory 1 IoCs
Processes:
Kawaii.exedescription ioc process File created C:\Windows\System32\drivers\Kawaii.exe Kawaii.exe -
Possible privilege escalation attempt 6 IoCs
Processes:
takeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exepid process 340 takeown.exe 2424 icacls.exe 1640 takeown.exe 1972 icacls.exe 2128 takeown.exe 1740 icacls.exe -
Modifies file permissions 1 TTPs 6 IoCs
Processes:
takeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exepid process 2128 takeown.exe 1740 icacls.exe 340 takeown.exe 2424 icacls.exe 1640 takeown.exe 1972 icacls.exe -
Drops file in System32 directory 10 IoCs
Processes:
Kawaii.exedescription ioc process File opened for modification C:\Windows\System32\Win32\Windows\Kawaii\Temp\fondo2.jpg Kawaii.exe File opened for modification C:\Windows\System32\Win32\Windows\Kawaii\Temp\control.reg Kawaii.exe File created C:\Windows\System32\Win32\Windows\Kawaii\Temp\Kawaii.exe Kawaii.exe File opened for modification C:\Windows\System32\Win32\Windows\Kawaii\Temp\Kawaii.exe Kawaii.exe File opened for modification C:\Windows\System32\Win32\Windows\Kawaii\Temp\flower_blue.ani Kawaii.exe File opened for modification C:\Windows\System32\Win32\Windows\Kawaii\Temp\gemido.wav Kawaii.exe File opened for modification C:\Windows\System32\Win32\Windows\Kawaii\Temp\fondo1.jpg Kawaii.exe File opened for modification C:\Windows\System32\Win32\Windows\Kawaii\Temp\icon.ico Kawaii.exe File opened for modification C:\Windows\System32\Win32\Windows\Kawaii\Temp\fondo.jpg Kawaii.exe File created C:\Windows\System32\Kawaii.exe Kawaii.exe -
Drops file in Program Files directory 1 IoCs
Processes:
Kawaii.exedescription ioc process File created C:\Program Files\Win32\Temp\Kawaii.exe Kawaii.exe -
Drops file in Windows directory 1 IoCs
Processes:
Kawaii.exedescription ioc process File created C:\Windows\Kawaii.exe Kawaii.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe -
Modifies registry class 64 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 19002f433a5c000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f463a5c000000000000000000000000000000000000000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616209" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7} explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "3" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags explorer.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Vid = "{0057D0E0-3573-11CF-AE69-08002B2E1262}" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Rev = "0" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616193" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f44471a0359723fa74489c55595fe6b30ee0000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3} explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe -
Runs .reg file with regedit 1 IoCs
Processes:
regedit.exepid process 2076 regedit.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Kawaii.exepid process 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 1676 explorer.exe -
Suspicious use of AdjustPrivilegeToken 28 IoCs
Processes:
Kawaii.exetakeown.exetakeown.exetakeown.exeAUDIODG.EXEexplorer.exeshutdown.exedescription pid process Token: SeDebugPrivilege 2000 Kawaii.exe Token: SeTakeOwnershipPrivilege 2128 takeown.exe Token: SeTakeOwnershipPrivilege 340 takeown.exe Token: SeTakeOwnershipPrivilege 1640 takeown.exe Token: 33 604 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 604 AUDIODG.EXE Token: 33 604 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 604 AUDIODG.EXE Token: SeShutdownPrivilege 1676 explorer.exe Token: SeShutdownPrivilege 1676 explorer.exe Token: SeShutdownPrivilege 1676 explorer.exe Token: SeShutdownPrivilege 1676 explorer.exe Token: SeShutdownPrivilege 1676 explorer.exe Token: SeShutdownPrivilege 1676 explorer.exe Token: SeShutdownPrivilege 1676 explorer.exe Token: SeShutdownPrivilege 1676 explorer.exe Token: SeShutdownPrivilege 1676 explorer.exe Token: SeShutdownPrivilege 1676 explorer.exe Token: SeShutdownPrivilege 1676 explorer.exe Token: SeShutdownPrivilege 1676 explorer.exe Token: SeShutdownPrivilege 1676 explorer.exe Token: SeShutdownPrivilege 1676 explorer.exe Token: SeShutdownPrivilege 1676 explorer.exe Token: SeShutdownPrivilege 1676 explorer.exe Token: SeShutdownPrivilege 1676 explorer.exe Token: SeShutdownPrivilege 2208 shutdown.exe Token: SeRemoteShutdownPrivilege 2208 shutdown.exe Token: SeShutdownPrivilege 1676 explorer.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
Processes:
Kawaii.exeexplorer.exepid process 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe -
Suspicious use of SendNotifyMessage 42 IoCs
Processes:
Kawaii.exeexplorer.exepid process 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 2000 Kawaii.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe 1676 explorer.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
Kawaii.execmd.execmd.execmd.exedescription pid process target process PID 2000 wrote to memory of 2776 2000 Kawaii.exe cmd.exe PID 2000 wrote to memory of 2776 2000 Kawaii.exe cmd.exe PID 2000 wrote to memory of 2776 2000 Kawaii.exe cmd.exe PID 2776 wrote to memory of 2128 2776 cmd.exe takeown.exe PID 2776 wrote to memory of 2128 2776 cmd.exe takeown.exe PID 2776 wrote to memory of 2128 2776 cmd.exe takeown.exe PID 2776 wrote to memory of 1740 2776 cmd.exe icacls.exe PID 2776 wrote to memory of 1740 2776 cmd.exe icacls.exe PID 2776 wrote to memory of 1740 2776 cmd.exe icacls.exe PID 2776 wrote to memory of 340 2776 cmd.exe takeown.exe PID 2776 wrote to memory of 340 2776 cmd.exe takeown.exe PID 2776 wrote to memory of 340 2776 cmd.exe takeown.exe PID 2776 wrote to memory of 2424 2776 cmd.exe icacls.exe PID 2776 wrote to memory of 2424 2776 cmd.exe icacls.exe PID 2776 wrote to memory of 2424 2776 cmd.exe icacls.exe PID 2776 wrote to memory of 1640 2776 cmd.exe takeown.exe PID 2776 wrote to memory of 1640 2776 cmd.exe takeown.exe PID 2776 wrote to memory of 1640 2776 cmd.exe takeown.exe PID 2776 wrote to memory of 1972 2776 cmd.exe icacls.exe PID 2776 wrote to memory of 1972 2776 cmd.exe icacls.exe PID 2776 wrote to memory of 1972 2776 cmd.exe icacls.exe PID 2000 wrote to memory of 2364 2000 Kawaii.exe cmd.exe PID 2000 wrote to memory of 2364 2000 Kawaii.exe cmd.exe PID 2000 wrote to memory of 2364 2000 Kawaii.exe cmd.exe PID 2000 wrote to memory of 2484 2000 Kawaii.exe cmd.exe PID 2000 wrote to memory of 2484 2000 Kawaii.exe cmd.exe PID 2000 wrote to memory of 2484 2000 Kawaii.exe cmd.exe PID 2364 wrote to memory of 2076 2364 cmd.exe regedit.exe PID 2364 wrote to memory of 2076 2364 cmd.exe regedit.exe PID 2364 wrote to memory of 2076 2364 cmd.exe regedit.exe PID 2484 wrote to memory of 1904 2484 cmd.exe notepad.exe PID 2484 wrote to memory of 1904 2484 cmd.exe notepad.exe PID 2484 wrote to memory of 1904 2484 cmd.exe notepad.exe PID 2000 wrote to memory of 2208 2000 Kawaii.exe shutdown.exe PID 2000 wrote to memory of 2208 2000 Kawaii.exe shutdown.exe PID 2000 wrote to memory of 2208 2000 Kawaii.exe shutdown.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Kawaii.exe"C:\Users\Admin\AppData\Local\Temp\Kawaii.exe"1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\gpedit.msc && icacls C:\Windows\System32\gpedit.msc /grant %username%:F && takeown /f C:\Windows\System32\mmc.exe && icacls C:\Windows\System32\mmc.exe /grant %username%:F && takeown /f C:\Windows\System32\taskkill.exe && icacls C:\Windows\System32\taskkill.exe /grant %username%:F && exit2⤵
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\gpedit.msc3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2128 -
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\gpedit.msc /grant Admin:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1740 -
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\mmc.exe3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:340 -
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\mmc.exe /grant Admin:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2424 -
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\taskkill.exe3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1640 -
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\taskkill.exe /grant Admin:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1972 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k regedit /s "C:/Windows/System32/Win32/Windows/Kawaii/Temp/control.reg && exit" && exit2⤵
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\regedit.exeregedit /s "C:/Windows/System32/Win32/Windows/Kawaii/Temp/control.reg && exit"3⤵
- Runs .reg file with regedit
PID:2076 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k notepad C:/Users/nota.txt && exit2⤵
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\system32\notepad.exenotepad C:/Users/nota.txt3⤵PID:1904
-
C:\Windows\System32\shutdown.exe"C:\Windows\System32\shutdown.exe" -f -r -t 32⤵
- Suspicious use of AdjustPrivilegeToken
PID:2208
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5041⤵
- Suspicious use of AdjustPrivilegeToken
PID:604
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1676
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵PID:2608
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.3MB
MD5d9dabab21dc0ae729cd41a81850e8593
SHA1afca150f0964df9bf4c9336465ed0ff3c7ed4900
SHA25614c2553770ce1d8784cdd691d03f2d215c7112e29cc01701c9c5e8cd27b122f6
SHA5120caf4e854dd4458f8a2d730fe56d6a4c19cf1af5eb7e4b3534b34fd6758be15fbe320c4f823bd53d22d983a0f2fc14e4a8662d7d6c223e823ffa6423f617c5a3
-
Filesize
471B
MD50aea1502a4192f4fcd8d25d4172ec0e5
SHA1adcc286452580eee1a6d651c63f54cdaaadc23e0
SHA256acab5764875cdbb4a37299d32da3680ff66221072eb8a044375a872d3b1a9eee
SHA51233ed0647cd4a81e1aa71fa9faa3d548b6fd2596822315dc41eefde1e57dae4440476e128d79288c47636e3ceac0a435b532b6d2c7eefc52c5910385b57771edb