Analysis
-
max time kernel
113s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
20-10-2022 09:39
General
-
Target
39c2db5e91a59bca2f0f680243baf05a4b83d0a798ca3f0df8333c5d7e3e981f.exe
-
Size
92KB
-
MD5
5fbd5fae046efcd682840731e4324b30
-
SHA1
7e02d7560b3f0448c95ef9e44e7bbe7f1a872cd5
-
SHA256
39c2db5e91a59bca2f0f680243baf05a4b83d0a798ca3f0df8333c5d7e3e981f
-
SHA512
5870fb4e3bd341bc28475247d1a514910a007254e4aaecbf6d6d804750180e209dfaf051cf059e94b3c2e3259357a07b26cfea4a9cdd1cbb1f504c8fff0cd322
-
SSDEEP
1536:1WGxs9kGdYk8wO4Cnt8RUyhoY/m3NsCl:UGfGdYSCnNyhoYOGA
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\39c2db5e91a59bca2f0f680243baf05a4b83d0a798ca3f0df8333c5d7e3e981f.exe"C:\Users\Admin\AppData\Local\Temp\39c2db5e91a59bca2f0f680243baf05a4b83d0a798ca3f0df8333c5d7e3e981f.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Winkrno.exeC:\Windows\SysWOW64\Winkrno.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
90KB
MD55ae7a2d7da6bacedafcf7328749042e9
SHA17927df0c5dfc8b73743801fc3de8688767de1e88
SHA256cdfc219697221ea40ccf5dd2576f74d12e270a05eaea7b51213e37c6c0f965f1
SHA512fefca397d0ef0df01945223a4587a22aec0eb70db5f131f8b8410396443245f3bd10cc6905b606199a169e9a3d673d66558d7dda4769c4c917abf051d47b972a
-
Filesize
90KB
MD55ae7a2d7da6bacedafcf7328749042e9
SHA17927df0c5dfc8b73743801fc3de8688767de1e88
SHA256cdfc219697221ea40ccf5dd2576f74d12e270a05eaea7b51213e37c6c0f965f1
SHA512fefca397d0ef0df01945223a4587a22aec0eb70db5f131f8b8410396443245f3bd10cc6905b606199a169e9a3d673d66558d7dda4769c4c917abf051d47b972a