Analysis
-
max time kernel
28s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
20/10/2022, 09:39
General
-
Target
39c2db5e91a59bca2f0f680243baf05a4b83d0a798ca3f0df8333c5d7e3e981f.exe
-
Size
92KB
-
MD5
5fbd5fae046efcd682840731e4324b30
-
SHA1
7e02d7560b3f0448c95ef9e44e7bbe7f1a872cd5
-
SHA256
39c2db5e91a59bca2f0f680243baf05a4b83d0a798ca3f0df8333c5d7e3e981f
-
SHA512
5870fb4e3bd341bc28475247d1a514910a007254e4aaecbf6d6d804750180e209dfaf051cf059e94b3c2e3259357a07b26cfea4a9cdd1cbb1f504c8fff0cd322
-
SSDEEP
1536:1WGxs9kGdYk8wO4Cnt8RUyhoY/m3NsCl:UGfGdYSCnNyhoYOGA
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\39c2db5e91a59bca2f0f680243baf05a4b83d0a798ca3f0df8333c5d7e3e981f.exe"C:\Users\Admin\AppData\Local\Temp\39c2db5e91a59bca2f0f680243baf05a4b83d0a798ca3f0df8333c5d7e3e981f.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Winkam.exeC:\Windows\SysWOW64\Winkam.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
90KB
MD51b9152fda772223c9325af187a4d7a33
SHA1db3b364da43b8fd61de72d3cc44df06a8f048326
SHA256c770c9d76790f8c5a7b36ce9c79533942c036a94098682b6be96937a4fcee0d2
SHA5125c2dbc2f255a0d02f1983b38742e76e8005c8623edc55cba9ce73fc99cf99476f71962d2755908dfe307241a4579e64c5e4fd14ab6240456de9e3aec767cffce
-
Filesize
90KB
MD51b9152fda772223c9325af187a4d7a33
SHA1db3b364da43b8fd61de72d3cc44df06a8f048326
SHA256c770c9d76790f8c5a7b36ce9c79533942c036a94098682b6be96937a4fcee0d2
SHA5125c2dbc2f255a0d02f1983b38742e76e8005c8623edc55cba9ce73fc99cf99476f71962d2755908dfe307241a4579e64c5e4fd14ab6240456de9e3aec767cffce