Analysis
-
max time kernel
37s -
max time network
42s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
20/10/2022, 00:23
General
-
Target
14f50d13f040fd98b88f74b73330bf217562d38734de1e83ef3f375e90b68a52.exe
-
Size
90KB
-
MD5
a11e4a7eefea7c497a3f24c0e27df7d0
-
SHA1
3378765fe4924bca23b30a72798788fef8d43ab6
-
SHA256
14f50d13f040fd98b88f74b73330bf217562d38734de1e83ef3f375e90b68a52
-
SHA512
7767bdb6c5d82ae9bb584fe475b0366ec73c2922238aef44ebb7b87e3753af56eacc9615d0b0fa40aae84a8f1765ea87f1ce65e0f88ecfc181e92befd29d5034
-
SSDEEP
1536:1WGxs9kGdYk8wO4Cnt8RUyho58aIxC8nj:UGfGdYSCnNyho4xBn
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\14f50d13f040fd98b88f74b73330bf217562d38734de1e83ef3f375e90b68a52.exe"C:\Users\Admin\AppData\Local\Temp\14f50d13f040fd98b88f74b73330bf217562d38734de1e83ef3f375e90b68a52.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Winkgjv.exeC:\Windows\SysWOW64\Winkgjv.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
87KB
MD5aa9281681deba0fb294dbdaf8c78b4a6
SHA170b7764a1ec1d2b34f3cc785f45356b970680bea
SHA256c924a48effc914b4b4da057ec3939b24300845fe2d6b793a0f64d8dcbcb5a4d7
SHA512b2ba63d32f65998408fc3de9ca25bf2acd7b6d94596327ab938a6279ff28bcaf552a50668b69d0108a20e19de7615403f36a7676f828a5beeee154f40c14304f
-
Filesize
87KB
MD5aa9281681deba0fb294dbdaf8c78b4a6
SHA170b7764a1ec1d2b34f3cc785f45356b970680bea
SHA256c924a48effc914b4b4da057ec3939b24300845fe2d6b793a0f64d8dcbcb5a4d7
SHA512b2ba63d32f65998408fc3de9ca25bf2acd7b6d94596327ab938a6279ff28bcaf552a50668b69d0108a20e19de7615403f36a7676f828a5beeee154f40c14304f