Analysis
-
max time kernel
42s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
-
submitted
30/10/2022, 14:12
General
-
Target
6b17efa188a6940b2067f541aacefcb7303af1b1d597a7573ae525cb2e9f1711.exe
-
Size
87KB
-
MD5
a2e26e8f4bb8f9a57b576acd9ae1d5a0
-
SHA1
af7df8bc068bd3aaa77888bbc8ec6a7457fcb3c4
-
SHA256
6b17efa188a6940b2067f541aacefcb7303af1b1d597a7573ae525cb2e9f1711
-
SHA512
01d04d6bcf5a867920e2c64bc7217c16e3852ba446bca8d2d7abad17c826f4f4fd06d06bbba0500b22387b14addbda0fd3d19f6f54f7a9e93c09f0bf37e3507b
-
SSDEEP
768:WeWGCQxs9kGd96NDkSV2bIXzl4CnTDHGsDf8RUFqoD4bDIsFDBnotp6D5Ga34:1WGxs9kGdYk8wO4Cnt8RUyhotCl
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6b17efa188a6940b2067f541aacefcb7303af1b1d597a7573ae525cb2e9f1711.exe"C:\Users\Admin\AppData\Local\Temp\6b17efa188a6940b2067f541aacefcb7303af1b1d597a7573ae525cb2e9f1711.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Winkjb.exeC:\Windows\SysWOW64\Winkjb.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
85KB
MD524a60d4c8e54633c3aea1c0fab7b8628
SHA15db9bda4412a4d20d182c673bb2202c80ba0d5fd
SHA25628621b113bf77b8ada8c04496a5e9a0bece863b61e2978860c862b382cfbc1ac
SHA512cc801af4ec3ed03b653b63774063bbacef06c6d469b8807fb7c4ba7b54ad1c1fd9ec01656bb9635bfef0f213e11e9dd9e7cca4368a1986efade81de512b7f142
-
Filesize
85KB
MD524a60d4c8e54633c3aea1c0fab7b8628
SHA15db9bda4412a4d20d182c673bb2202c80ba0d5fd
SHA25628621b113bf77b8ada8c04496a5e9a0bece863b61e2978860c862b382cfbc1ac
SHA512cc801af4ec3ed03b653b63774063bbacef06c6d469b8807fb7c4ba7b54ad1c1fd9ec01656bb9635bfef0f213e11e9dd9e7cca4368a1986efade81de512b7f142