Overview

overview

10

Static

static

3

Kawaii.exe

windows11-21h2-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Kawaii.exe

  • Size

    5.8MB

  • Sample

    241120-r2ms5ayeql

  • MD5

    006fe3fc14a6c1e45bf484878e69d8f8

  • SHA1

    680ca4367f114a726ff9233fe942b8f615823968

  • SHA256

    a7c98b50f8a332367c7bb72e1a4eacf6911a3ac3deaf8328b6645a62ededc08c

  • SHA512

    0f3ffe6596a354e78993248372d67c8da89e585cf8854628a6541e8c1d70b752cf704900f511c49484ec0a6eaeccf65dc32268e9033fc8e4089572fe6a25a00d

  • SSDEEP

    98304:ku3aEGA+Bf2ycevqJZUfYLceHQIJ/xvXEGAzBIcevqJZUfYLcN3HQIJ/xvf2:kD3cLrvLcqQIJ5TcLrvLc5QIJ

Score
10/10
discoveryevasionexploitpersistencetrojan

Malware Config

Targets

    • Target

      Kawaii.exe

    • Size

      5.8MB

    • MD5

      006fe3fc14a6c1e45bf484878e69d8f8

    • SHA1

      680ca4367f114a726ff9233fe942b8f615823968

    • SHA256

      a7c98b50f8a332367c7bb72e1a4eacf6911a3ac3deaf8328b6645a62ededc08c

    • SHA512

      0f3ffe6596a354e78993248372d67c8da89e585cf8854628a6541e8c1d70b752cf704900f511c49484ec0a6eaeccf65dc32268e9033fc8e4089572fe6a25a00d

    • SSDEEP

      98304:ku3aEGA+Bf2ycevqJZUfYLceHQIJ/xvXEGAzBIcevqJZUfYLcN3HQIJ/xvf2:kD3cLrvLcqQIJ5TcLrvLc5QIJ

    Score
    10/10
    discoveryevasionexploitpersistencetrojan

    • Modifies WinLogon for persistence

      persistence

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Modifies visibility of file extensions in Explorer

      evasion

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • UAC bypass

      evasiontrojan

    • Blocks application from running via registry modification

      Adds application to list of disallowed applications.

      evasion

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Disables use of System Restore points

      evasion

    • Drops file in Drivers directory

    • Possible privilege escalation attempt

      exploit

    • Deletes itself

    • Executes dropped EXE

    • Modifies file permissions

      discovery

    • Checks whether UAC is enabled

      evasiontrojan

    • Modifies WinLogon

      persistence

    • Modifies boot configuration data using bcdedit

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Winlogon Helper DLL

2
T1547.004

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

2
T1547

Winlogon Helper DLL

2
T1547.004

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

File and Directory Permissions Modification

1
T1222

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Impair Defenses

2
T1562

Disable or Modify Tools

2
T1562.001

Modify Registry

8
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

1
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Tasks