e6f414475c95a5dc5b98c66b14b600c2be9cc796623b58897d3e3e9ac61749aa

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, wscript.exe \"C:/Windows/Temp/Windows.vbs\""	Kawaii.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	Kawaii.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

Hidden Files and Directories

T1564.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Kawaii.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

Hidden Files and Directories

T1564.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	Kawaii.exe

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Kawaii.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Kawaii.exe

Blocks application from running via registry modification 10 IoCs

Adds application to list of disallowed applications.

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000\SOFTWARE\Microsoft\windows\CurrentVersion\Policies\Explorer\DisallowRun	Kawaii.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "procexp64.exe"	Kawaii.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3 = "Autoruns.exe"	Kawaii.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\6 = "Autorunsc64.exe"	Kawaii.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	Kawaii.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "ProcessHacker.exe"	Kawaii.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4 = "Autoruns64.exe"	Kawaii.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\5 = "Autorunsc.exe"	Kawaii.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\7 = "notepad.exe"	Kawaii.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\8 = "chrome.exe"	Kawaii.exe

Disables RegEdit via registry modification 1 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Kawaii.exe

Disables Task Manager via registry modification
evasion
Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\Kawaii.exe	Kawaii.exe

Possible privilege escalation attempt 4 IoCs

exploit

pid	Process
5556	takeown.exe
5564	takeown.exe
5596	icacls.exe
5588	icacls.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000\Control Panel\International\Geo\Nation	Kawaii.exe
Key value queried	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000\Control Panel\International\Geo\Nation	Kawaii.exe

Deletes itself 1 IoCs

pid	Process
1220	Kawaii.exe

Executes dropped EXE 1 IoCs

pid	Process
1220	Kawaii.exe

Modifies file permissions 1 TTPs 4 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5596	icacls.exe
5588	icacls.exe
5556	takeown.exe
5564	takeown.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Kawaii.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Kawaii.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0"	Kawaii.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DisableCAD = "1"	Kawaii.exe

Modifies boot configuration data using bcdedit 1 IoCs

pid	Process
1308	bcdedit.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\System32\Kawaii.exe	Kawaii.exe
File opened for modification	C:\Windows\System32\Win32\Windows\Kawaii\Temp\flower_blue.ani	Kawaii.exe
File opened for modification	C:\Windows\System32\Win32\Windows\Kawaii\Temp\gemido.wav	Kawaii.exe
File opened for modification	C:\Windows\System32\Win32\Windows\Kawaii\Temp\fondo.jpg	Kawaii.exe
File opened for modification	C:\Windows\System32\Win32\Windows\Kawaii\Temp\fondo2.jpg	Kawaii.exe
File created	C:\Windows\System32\Win32\Windows\Kawaii\Temp\WindowsActual.txt	Kawaii.exe
File opened for modification	C:\Windows\System32\Win32\Windows\Kawaii\Temp\icon.ico	Kawaii.exe
File opened for modification	C:\Windows\System32\Win32\Windows\Kawaii\Temp\fondo1.jpg	Kawaii.exe
File opened for modification	C:\Windows\System32\Win32\Windows\Kawaii\Temp\control.reg	Kawaii.exe
File created	C:\Windows\System32\Win32\Windows\Kawaii\Temp\Kawaii.exe	Kawaii.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\89919f31-06a8-40a5-b576-3d30e38d0f8a.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241123231326.pma	setup.exe
File created	C:\Program Files\Win32\Temp\Kawaii.exe	Kawaii.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Kawaii.exe	Kawaii.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Control Panel 1 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000\Control Panel\Desktop\AutoColorization = "1"	Kawaii.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000\Software\Microsoft\Internet Explorer\TypedURLs	taskmgr.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "https://github.com/ItzMoon931/Kawaii"	Kawaii.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	taskmgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	taskmgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings	Kawaii.exe
Key created	\REGISTRY\USER\S-1-5-21-870806430-2618236806-3023919190-1000_Classes\Local Settings	taskmgr.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2368	NOTEPAD.EXE

Runs .reg file with regedit 1 IoCs

pid	Process
6112	regedit.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
1080	msedge.exe
1080	msedge.exe
3140	taskmgr.exe
3140	taskmgr.exe
3276	msedge.exe
3276	msedge.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
2488	identity_helper.exe
2488	identity_helper.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	2684	Kawaii.exe
Token: SeDebugPrivilege	3140	taskmgr.exe
Token: SeSystemProfilePrivilege	3140	taskmgr.exe
Token: SeCreateGlobalPrivilege	3140	taskmgr.exe
Token: SeDebugPrivilege	240	Kawaii.exe
Token: SeDebugPrivilege	1220	Kawaii.exe
Token: SeTakeOwnershipPrivilege	5556	takeown.exe
Token: SeTakeOwnershipPrivilege	5564	takeown.exe
Token: 33	5824	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5824	AUDIODG.EXE
Token: SeDebugPrivilege	5964	taskkillam3nlWfcxJRwYBLKMTgk.exe
Token: SeShutdownPrivilege	5176	shutdown.exe
Token: SeRemoteShutdownPrivilege	5176	shutdown.exe
Token: SeShutdownPrivilege	1220	Kawaii.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
1220	Kawaii.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
1220	Kawaii.exe
1220	Kawaii.exe
1220	Kawaii.exe
1220	Kawaii.exe
1220	Kawaii.exe
1220	Kawaii.exe
1220	Kawaii.exe
1220	Kawaii.exe
1220	Kawaii.exe
1220	Kawaii.exe
1220	Kawaii.exe
1220	Kawaii.exe
1220	Kawaii.exe
1220	Kawaii.exe
1220	Kawaii.exe
1220	Kawaii.exe
1220	Kawaii.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
1220	Kawaii.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe
3140	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 240 wrote to memory of 1220	240	Kawaii.exe	96
PID 240 wrote to memory of 1220	240	Kawaii.exe	96
PID 1220 wrote to memory of 2368	1220	Kawaii.exe	98
PID 1220 wrote to memory of 2368	1220	Kawaii.exe	98
PID 1220 wrote to memory of 3276	1220	Kawaii.exe	99
PID 1220 wrote to memory of 3276	1220	Kawaii.exe	99
PID 3276 wrote to memory of 2584	3276	msedge.exe	100
PID 3276 wrote to memory of 2584	3276	msedge.exe	100
PID 3276 wrote to memory of 5104	3276	msedge.exe	101
PID 3276 wrote to memory of 5104	3276	msedge.exe	101
PID 3276 wrote to memory of 5104	3276	msedge.exe	101
PID 3276 wrote to memory of 5104	3276	msedge.exe	101
PID 3276 wrote to memory of 5104	3276	msedge.exe	101
PID 3276 wrote to memory of 5104	3276	msedge.exe	101
PID 3276 wrote to memory of 5104	3276	msedge.exe	101
PID 3276 wrote to memory of 5104	3276	msedge.exe	101
PID 3276 wrote to memory of 5104	3276	msedge.exe	101
PID 3276 wrote to memory of 5104	3276	msedge.exe	101
PID 3276 wrote to memory of 5104	3276	msedge.exe	101
PID 3276 wrote to memory of 5104	3276	msedge.exe	101
PID 3276 wrote to memory of 5104	3276	msedge.exe	101
PID 3276 wrote to memory of 5104	3276	msedge.exe	101
PID 3276 wrote to memory of 5104	3276	msedge.exe	101
PID 3276 wrote to memory of 5104	3276	msedge.exe	101
PID 3276 wrote to memory of 5104	3276	msedge.exe	101
PID 3276 wrote to memory of 5104	3276	msedge.exe	101
PID 3276 wrote to memory of 5104	3276	msedge.exe	101
PID 3276 wrote to memory of 5104	3276	msedge.exe	101
PID 3276 wrote to memory of 5104	3276	msedge.exe	101
PID 3276 wrote to memory of 5104	3276	msedge.exe	101
PID 3276 wrote to memory of 5104	3276	msedge.exe	101
PID 3276 wrote to memory of 5104	3276	msedge.exe	101
PID 3276 wrote to memory of 5104	3276	msedge.exe	101
PID 3276 wrote to memory of 5104	3276	msedge.exe	101
PID 3276 wrote to memory of 5104	3276	msedge.exe	101
PID 3276 wrote to memory of 5104	3276	msedge.exe	101
PID 3276 wrote to memory of 5104	3276	msedge.exe	101
PID 3276 wrote to memory of 5104	3276	msedge.exe	101
PID 3276 wrote to memory of 5104	3276	msedge.exe	101
PID 3276 wrote to memory of 5104	3276	msedge.exe	101
PID 3276 wrote to memory of 5104	3276	msedge.exe	101
PID 3276 wrote to memory of 5104	3276	msedge.exe	101
PID 3276 wrote to memory of 5104	3276	msedge.exe	101
PID 3276 wrote to memory of 5104	3276	msedge.exe	101
PID 3276 wrote to memory of 5104	3276	msedge.exe	101
PID 3276 wrote to memory of 5104	3276	msedge.exe	101
PID 3276 wrote to memory of 5104	3276	msedge.exe	101
PID 3276 wrote to memory of 5104	3276	msedge.exe	101
PID 3276 wrote to memory of 1080	3276	msedge.exe	102
PID 3276 wrote to memory of 1080	3276	msedge.exe	102
PID 3276 wrote to memory of 1712	3276	msedge.exe	103
PID 3276 wrote to memory of 1712	3276	msedge.exe	103
PID 3276 wrote to memory of 1712	3276	msedge.exe	103
PID 3276 wrote to memory of 1712	3276	msedge.exe	103
PID 3276 wrote to memory of 1712	3276	msedge.exe	103
PID 3276 wrote to memory of 1712	3276	msedge.exe	103
PID 3276 wrote to memory of 1712	3276	msedge.exe	103
PID 3276 wrote to memory of 1712	3276	msedge.exe	103
PID 3276 wrote to memory of 1712	3276	msedge.exe	103
PID 3276 wrote to memory of 1712	3276	msedge.exe	103
PID 3276 wrote to memory of 1712	3276	msedge.exe	103
PID 3276 wrote to memory of 1712	3276	msedge.exe	103
PID 3276 wrote to memory of 1712	3276	msedge.exe	103
PID 3276 wrote to memory of 1712	3276	msedge.exe	103

System policy modification 1 TTPs 11 IoCs

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesMyComputer = "1"	Kawaii.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Kawaii.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy = "1"	Kawaii.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "1"	Kawaii.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0"	Kawaii.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	Kawaii.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Kawaii.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\UseDefaultTile = "1"	Kawaii.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1"	Kawaii.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	Kawaii.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRecycleFiles = "1"	Kawaii.exe

C:\Users\Admin\AppData\Local\Temp\Kawaii.exe
"C:\Users\Admin\AppData\Local\Temp\Kawaii.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2684

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3140

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2764

C:\Users\Admin\Desktop\Kawaii.exe
"C:\Users\Admin\Desktop\Kawaii.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:240
- C:\Users\Admin\AppData\Local\Temp\Kawaii.exe
  "C:\Users\Admin\AppData\Local\Temp\Kawaii.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies Windows Defender Real-time Protection settings
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - UAC bypass
  - Blocks application from running via registry modification
  - Disables RegEdit via registry modification
  - Drops file in Drivers directory
  - Checks computer location settings
  - Deletes itself
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies Internet Explorer start page
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1220
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\README.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:2368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/ItzMoon931/Kawaii
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:3276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x140,0x144,0x148,0x11c,0x14c,0x7ffdbd6446f8,0x7ffdbd644708,0x7ffdbd644718
      4⤵
      PID:2584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,5430341258999930532,15211608017859532301,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
      4⤵
      PID:5104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,5430341258999930532,15211608017859532301,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,5430341258999930532,15211608017859532301,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
      4⤵
      PID:1712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,5430341258999930532,15211608017859532301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3844 /prefetch:1
      4⤵
      PID:4780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,5430341258999930532,15211608017859532301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3860 /prefetch:1
      4⤵
      PID:940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,5430341258999930532,15211608017859532301,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5692 /prefetch:8
      4⤵
      PID:4344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      PID:4804
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x154,0x130,0x124,0x294,0x2a0,0x7ff762455460,0x7ff762455470,0x7ff762455480
        5⤵
        
        PID:3196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,5430341258999930532,15211608017859532301,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5692 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,5430341258999930532,15211608017859532301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
      4⤵
      PID:3480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,5430341258999930532,15211608017859532301,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
      4⤵
      PID:4964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,5430341258999930532,15211608017859532301,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3872 /prefetch:1
      4⤵
      PID:5236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,5430341258999930532,15211608017859532301,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3888 /prefetch:1
      4⤵
      PID:5244
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\taskkill.exe && icacls C:\Windows\System32\taskkill.exe /grant %username%:F && exit
    3⤵
    PID:5456
  - - C:\Windows\system32\takeown.exe
      takeown /f C:\Windows\System32\taskkill.exe
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      Suspicious use of AdjustPrivilegeToken
      PID:5556
  - - C:\Windows\system32\icacls.exe
      icacls C:\Windows\System32\taskkill.exe /grant Admin:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5588
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\gpedit.msc && icacls C:\Windows\System32\gpedit.msc /grant %username%:F && exit
    3⤵
    PID:5472
  - - C:\Windows\system32\takeown.exe
      takeown /f C:\Windows\System32\gpedit.msc
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      Suspicious use of AdjustPrivilegeToken
      PID:5564
  - - C:\Windows\system32\icacls.exe
      icacls C:\Windows\System32\gpedit.msc /grant Admin:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5596
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /k regedit /s "C:/Windows/System32/Win32/Windows/Kawaii/Temp/control.reg && exit" && exit
    3⤵
    PID:5940
  - - C:\Windows\regedit.exe
      regedit /s "C:/Windows/System32/Win32/Windows/Kawaii/Temp/control.reg && exit"
      4⤵
      Runs .reg file with regedit
      PID:6112
- - C:\Windows\System32\taskkillam3nlWfcxJRwYBLKMTgk.exe
    "C:\Windows\System32\taskkillam3nlWfcxJRwYBLKMTgk.exe" -f -im explorer.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5964
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /k notepad C:/Users/nota.txt && exit
    3⤵
    PID:5992
  - - C:\Windows\system32\notepad.exe
      notepad C:/Users/nota.txt
      4⤵
      PID:6128
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /k bcdedit /deletevalue {current} safeboot && exit
    3⤵
    PID:6032
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /deletevalue {current} safeboot
      4⤵
      Modifies boot configuration data using bcdedit
      PID:1308
- - C:\Windows\System32\shutdown.exe
    "C:\Windows\System32\shutdown.exe" -f -r -t 3
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5176

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4896

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x24c 0x4c0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery