Analysis
-
max time kernel
42s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
-
submitted
11-10-2022 08:56
General
-
Target
0f00ccd8e20025aea0e0f9fe49a93d4ac51228852aeb5bf4d50557b90fe7c134.exe
-
Size
91KB
-
MD5
7c63da12a17748f542ec88a2ea2f90c0
-
SHA1
4f8c2056323884b44c261a48b70f2015fbb9f856
-
SHA256
0f00ccd8e20025aea0e0f9fe49a93d4ac51228852aeb5bf4d50557b90fe7c134
-
SHA512
5af592fc88b541d5df94eea820072b112d7ffed9003f0021e1f0aaabd35fb14e942fea1957a99e11817fdd647189c83ff914ee3997ee67b4c183cf16fe48fd00
-
SSDEEP
768:WeWGCQxs9kGd96NDkSV2bIXzl4CnTDHGsDf8RUFqoD4bDIsFDBnoZ76p6D5Ga34:1WGxs9kGdYk8wO4Cnt8RUyhoZ+Cl
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f00ccd8e20025aea0e0f9fe49a93d4ac51228852aeb5bf4d50557b90fe7c134.exe"C:\Users\Admin\AppData\Local\Temp\0f00ccd8e20025aea0e0f9fe49a93d4ac51228852aeb5bf4d50557b90fe7c134.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Winkum.exeC:\Windows\SysWOW64\Winkum.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
90KB
MD55737b548137d739f711f1ece67ff572b
SHA1c41faadc1f522d22299ac6cca5758c6530f4bb80
SHA2562af9b4f97dfd7e0849063cbaa294aedeb3f99417e41de7d06bba10a57aa928e6
SHA51237e0e052fb4e2077b0bb749c2d406633b9dd14f2f876b0a4864ddfea72d65f0d7568de3413c19e66f2163f12bf9ab13bbbd684d06bc50d834cc1a4e537d9253c
-
Filesize
90KB
MD55737b548137d739f711f1ece67ff572b
SHA1c41faadc1f522d22299ac6cca5758c6530f4bb80
SHA2562af9b4f97dfd7e0849063cbaa294aedeb3f99417e41de7d06bba10a57aa928e6
SHA51237e0e052fb4e2077b0bb749c2d406633b9dd14f2f876b0a4864ddfea72d65f0d7568de3413c19e66f2163f12bf9ab13bbbd684d06bc50d834cc1a4e537d9253c