General
-
Target
mkp_nowin.bin.zip
-
Size
27KB
-
Sample
220803-kyfgbaadgk
-
MD5
c2e2e3a00ddfe6fa5663db6758263040
-
SHA1
01bd0f3992f228668fe2fdac17326d12c741b4a3
-
SHA256
267bb5959f1755e22de05faf02aec3bdab5f2f11b5d7699713c63c4fdea10229
-
SHA512
a8d5f7ec94f26456ca2dc80429c756ee9cafa7f9bcceb2d7a647968a2cfeb8bad3be69de5514314067b9dcf3c60cb73d09c472a521aea77af5151a8265a40be2
Behavioral task
behavioral1
Sample
mkp_nowin.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
mkp_nowin.exe
Resource
win10v2004-20220722-en
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\2887110549\+README-WARNING+.txt
Targets
-
-
Target
mkp_nowin.bin
-
Size
42KB
-
MD5
d0fc0f9ec95cecf3550cdc3fb46e2f9e
-
SHA1
849470ba2fed3d2d153364e951bf2c7ce29a0210
-
SHA256
bc23e3f90365b07b0477de81b377006c5cc3ecdded9bf80f5e363489924435dd
-
SHA512
dbc1465a65abd0504271ea246c8509c8ae8fab203d0d272d8a95b086515566a7421235b71f6215e391e6df9a59f40f16f804bbe89315bd216b47424bf067bbcb
Score10/10-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Drops file in System32 directory
-