31536988fab11be58365fb9fd1eea5a6aacf6dd1f767d2c441bf2fe6267fdc58

General

Target

31536988fab11be58365fb9fd1eea5a6aacf6dd1f767d2c441bf2fe6267fdc58.exe
Size

181KB
MD5

6bdae60cfe8456949b7c6a5d05e14fed
SHA1

07e68e795fea7324ab2605ec2578b2527b4afec3
SHA256

31536988fab11be58365fb9fd1eea5a6aacf6dd1f767d2c441bf2fe6267fdc58
SHA512

93c7de75b2ac43f8b92895d75c33e0049f964d1d41fd4c1e019e286cbffb0621adf405654e081fdf4162b57c8d516cb437e77ac5d5c5f59a807bdf1291599a64

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
952	winkslk.exe

Loads dropped DLL 2 IoCs

pid	Process
868	31536988fab11be58365fb9fd1eea5a6aacf6dd1f767d2c441bf2fe6267fdc58.exe
868	31536988fab11be58365fb9fd1eea5a6aacf6dd1f767d2c441bf2fe6267fdc58.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update 39405 = "C:\\Windows\\1885814916343229\\winkslk.exe"	31536988fab11be58365fb9fd1eea5a6aacf6dd1f767d2c441bf2fe6267fdc58.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update 39405 = "C:\\Windows\\1885814916343229\\winkslk.exe"	31536988fab11be58365fb9fd1eea5a6aacf6dd1f767d2c441bf2fe6267fdc58.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\1885814916343229\winkslk.exe	31536988fab11be58365fb9fd1eea5a6aacf6dd1f767d2c441bf2fe6267fdc58.exe
File opened for modification	C:\Windows\1885814916343229\winkslk.exe	31536988fab11be58365fb9fd1eea5a6aacf6dd1f767d2c441bf2fe6267fdc58.exe
File opened for modification	C:\Windows\1885814916343229	31536988fab11be58365fb9fd1eea5a6aacf6dd1f767d2c441bf2fe6267fdc58.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 952	868	31536988fab11be58365fb9fd1eea5a6aacf6dd1f767d2c441bf2fe6267fdc58.exe	28
PID 868 wrote to memory of 952	868	31536988fab11be58365fb9fd1eea5a6aacf6dd1f767d2c441bf2fe6267fdc58.exe	28
PID 868 wrote to memory of 952	868	31536988fab11be58365fb9fd1eea5a6aacf6dd1f767d2c441bf2fe6267fdc58.exe	28
PID 868 wrote to memory of 952	868	31536988fab11be58365fb9fd1eea5a6aacf6dd1f767d2c441bf2fe6267fdc58.exe	28

C:\Users\Admin\AppData\Local\Temp\31536988fab11be58365fb9fd1eea5a6aacf6dd1f767d2c441bf2fe6267fdc58.exe
"C:\Users\Admin\AppData\Local\Temp\31536988fab11be58365fb9fd1eea5a6aacf6dd1f767d2c441bf2fe6267fdc58.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:868
- C:\Windows\1885814916343229\winkslk.exe
  C:\Windows\1885814916343229\winkslk.exe
  2⤵
  - Executes dropped EXE
  PID:952

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\1885814916343229\winkslk.exe

Filesize
181KB

MD5
6bdae60cfe8456949b7c6a5d05e14fed

SHA1
07e68e795fea7324ab2605ec2578b2527b4afec3

SHA256
31536988fab11be58365fb9fd1eea5a6aacf6dd1f767d2c441bf2fe6267fdc58

SHA512
93c7de75b2ac43f8b92895d75c33e0049f964d1d41fd4c1e019e286cbffb0621adf405654e081fdf4162b57c8d516cb437e77ac5d5c5f59a807bdf1291599a64

Download Submit
\Windows\1885814916343229\winkslk.exe

Filesize
181KB

MD5
6bdae60cfe8456949b7c6a5d05e14fed

SHA1
07e68e795fea7324ab2605ec2578b2527b4afec3

SHA256
31536988fab11be58365fb9fd1eea5a6aacf6dd1f767d2c441bf2fe6267fdc58

SHA512
93c7de75b2ac43f8b92895d75c33e0049f964d1d41fd4c1e019e286cbffb0621adf405654e081fdf4162b57c8d516cb437e77ac5d5c5f59a807bdf1291599a64

Download Submit
\Windows\1885814916343229\winkslk.exe

Filesize
181KB

MD5
6bdae60cfe8456949b7c6a5d05e14fed

SHA1
07e68e795fea7324ab2605ec2578b2527b4afec3

SHA256
31536988fab11be58365fb9fd1eea5a6aacf6dd1f767d2c441bf2fe6267fdc58

SHA512
93c7de75b2ac43f8b92895d75c33e0049f964d1d41fd4c1e019e286cbffb0621adf405654e081fdf4162b57c8d516cb437e77ac5d5c5f59a807bdf1291599a64

Download Submit
memory/868-54-0x00000000053DE000-0x00000000053E3000-memory.dmp

Filesize
20KB

Download
memory/868-55-0x0000000076431000-0x0000000076433000-memory.dmp

Filesize
8KB

Download
memory/868-56-0x00000000053DE000-0x00000000053E3000-memory.dmp

Filesize
20KB

Download
memory/868-57-0x0000000000400000-0x0000000005295000-memory.dmp

Filesize
78.6MB

Download
memory/952-62-0x00000000002EE000-0x00000000002F2000-memory.dmp

Filesize
16KB

Download
memory/952-64-0x00000000002EE000-0x00000000002F2000-memory.dmp

Filesize
16KB

Download
memory/952-65-0x0000000000400000-0x0000000005295000-memory.dmp

Filesize
78.6MB

Download

Analysis

Sharing