Analysis
-
max time kernel
136s -
max time network
171s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
20-10-2022 00:23
General
-
Target
14f50d13f040fd98b88f74b73330bf217562d38734de1e83ef3f375e90b68a52.exe
-
Size
90KB
-
MD5
a11e4a7eefea7c497a3f24c0e27df7d0
-
SHA1
3378765fe4924bca23b30a72798788fef8d43ab6
-
SHA256
14f50d13f040fd98b88f74b73330bf217562d38734de1e83ef3f375e90b68a52
-
SHA512
7767bdb6c5d82ae9bb584fe475b0366ec73c2922238aef44ebb7b87e3753af56eacc9615d0b0fa40aae84a8f1765ea87f1ce65e0f88ecfc181e92befd29d5034
-
SSDEEP
1536:1WGxs9kGdYk8wO4Cnt8RUyho58aIxC8nj:UGfGdYSCnNyho4xBn
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\14f50d13f040fd98b88f74b73330bf217562d38734de1e83ef3f375e90b68a52.exe"C:\Users\Admin\AppData\Local\Temp\14f50d13f040fd98b88f74b73330bf217562d38734de1e83ef3f375e90b68a52.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Winkvxd.exeC:\Windows\SysWOW64\Winkvxd.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
90KB
MD53883e91d1996705f4e4f21f16541bc49
SHA17e72e08a2c1a878bbdf2f2f073bfcb2e860ba077
SHA256a80db84bb8f59a405b95d6f557212a82f01338624775f10081e59e08ab508f46
SHA51277cfdb6bb46a2947bdd45e0f2387da10ae00ee398578704f58f2e140ce968b63a6b81887827f9ee06b80362bacacfb1a0c3fb7199e92cf8eabc12b52852214a2
-
Filesize
90KB
MD53883e91d1996705f4e4f21f16541bc49
SHA17e72e08a2c1a878bbdf2f2f073bfcb2e860ba077
SHA256a80db84bb8f59a405b95d6f557212a82f01338624775f10081e59e08ab508f46
SHA51277cfdb6bb46a2947bdd45e0f2387da10ae00ee398578704f58f2e140ce968b63a6b81887827f9ee06b80362bacacfb1a0c3fb7199e92cf8eabc12b52852214a2