Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
01-10-2022 23:28
General
-
Target
33ba8270215b91c0279a747f74a447e944c593c00a54ff4642ee0b5b60e6fb32.exe
-
Size
90KB
-
MD5
637a36bc4a6fde6e2df0341b227ab930
-
SHA1
6b68bd01e30db4953887ddd9fc69dd74f819f73e
-
SHA256
33ba8270215b91c0279a747f74a447e944c593c00a54ff4642ee0b5b60e6fb32
-
SHA512
0f9bccd5bcae9e3340700272166da982f7d9b890105e31a90518d720a3a77f19ff4e5efefd871ee9dd033b6aabd30d7d5bc1f1ed6e5b8592823706241de1ee6f
-
SSDEEP
768:WeWGCQxs9kGd96NDkSV2bIXzl4CnTDHGsDf8RUFqoD4bDIsFDBnon+0ACim4p6DU:1WGxs9kGdYk8wO4Cnt8RUyhon5wm4CS
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\33ba8270215b91c0279a747f74a447e944c593c00a54ff4642ee0b5b60e6fb32.exe"C:\Users\Admin\AppData\Local\Temp\33ba8270215b91c0279a747f74a447e944c593c00a54ff4642ee0b5b60e6fb32.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Winkzl.exeC:\Windows\SysWOW64\Winkzl.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
85KB
MD529873e72a96e279bad4e269a84d004dc
SHA1f45c5b66eb5b92212de77f6ae154d8404bc779a2
SHA2561fcbe973c417b4c7f6c8a0c95a9e5faeaf53f455259d335ca3f4c0e1c66b05c4
SHA5125039ddeacb6945f9bca9cef4e199f5a7d09bb6f5b47aa9e6a30dd084719782acfe6f760ab3ce35acc5be88260175e800fad1eee7e6722cdf2141e5a363d2675d
-
Filesize
85KB
MD529873e72a96e279bad4e269a84d004dc
SHA1f45c5b66eb5b92212de77f6ae154d8404bc779a2
SHA2561fcbe973c417b4c7f6c8a0c95a9e5faeaf53f455259d335ca3f4c0e1c66b05c4
SHA5125039ddeacb6945f9bca9cef4e199f5a7d09bb6f5b47aa9e6a30dd084719782acfe6f760ab3ce35acc5be88260175e800fad1eee7e6722cdf2141e5a363d2675d