Analysis
-
max time kernel
46s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
-
submitted
14-10-2022 09:37
General
-
Target
a5097f49d508db6ed6b5cb3eb444695d07b981a8eaa0dc19dd8acc51ede77a52.exe
-
Size
372KB
-
MD5
6b1e748ea9ac6a98d7e93a66fc84d9d0
-
SHA1
f27cd2b2c17b570889414d10346ef9196d12c41f
-
SHA256
a5097f49d508db6ed6b5cb3eb444695d07b981a8eaa0dc19dd8acc51ede77a52
-
SHA512
5a0c35612fb44cbb6df521ad02231f3d6f0ecb9ab19d90db09d2d408a32600b5a9ab0f67d620ed27088e946c668ee8f829a4302a3d73f4164e819a5d269a42be
-
SSDEEP
1536:pWGxs9kGdYk8wO4Cnt8RUyho9vc5MICC4I4PP6PcvPnyp3aOTotXQK:gGfGdYSCnNyho9vc1N86PcvgKOEtgK
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5097f49d508db6ed6b5cb3eb444695d07b981a8eaa0dc19dd8acc51ede77a52.exe"C:\Users\Admin\AppData\Local\Temp\a5097f49d508db6ed6b5cb3eb444695d07b981a8eaa0dc19dd8acc51ede77a52.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Winkdx.exeC:\Windows\SysWOW64\Winkdx.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
87KB
MD5b76c83fea9e872baf5649bcd1267e94b
SHA1c3355e809fd57faaf25aaed760b5d3da4dc8bafd
SHA256da1882fc3ea45b947690d0afa5b2c2de94828777d18d8990b052c27c5f6b749e
SHA512c6cece68ae8e9ac7672ccd96649193fff21e17484f9c3f8517bbaed1026e20c47cba3eec941fe1ce72acd5e9326d4987ace56b3880d2c64cd2f6ca428f7dcf99
-
Filesize
87KB
MD5b76c83fea9e872baf5649bcd1267e94b
SHA1c3355e809fd57faaf25aaed760b5d3da4dc8bafd
SHA256da1882fc3ea45b947690d0afa5b2c2de94828777d18d8990b052c27c5f6b749e
SHA512c6cece68ae8e9ac7672ccd96649193fff21e17484f9c3f8517bbaed1026e20c47cba3eec941fe1ce72acd5e9326d4987ace56b3880d2c64cd2f6ca428f7dcf99