Analysis
-
max time kernel
32s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
06-11-2022 10:37
General
-
Target
fe1bcd6b87c319bdc26d33ac9a091fa2b3770445beeb27e982e19f5900c1fb0c.exe
-
Size
93KB
-
MD5
099da4683426a7c5f2d4c1c2ae7e0306
-
SHA1
bf67c604b0e52b817a7d4c9d03a07bc1387665a2
-
SHA256
fe1bcd6b87c319bdc26d33ac9a091fa2b3770445beeb27e982e19f5900c1fb0c
-
SHA512
1959ce731185d664a44ff7d4c633481cb7b47674cee37bb8681018d09369d8bb452d264b4f4a67de65f607c7ea500f97a1787819c37393eec6d000df40880acc
-
SSDEEP
1536:1WGxs9kGdYk8wO4Cnt8RUyho0U6h7nJHC:UGfGdYSCnNyho0ZH
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe1bcd6b87c319bdc26d33ac9a091fa2b3770445beeb27e982e19f5900c1fb0c.exe"C:\Users\Admin\AppData\Local\Temp\fe1bcd6b87c319bdc26d33ac9a091fa2b3770445beeb27e982e19f5900c1fb0c.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Winkzxx.exeC:\Windows\SysWOW64\Winkzxx.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
86KB
MD564292951399fe06445d3f6fe5ab0c6d3
SHA14d10cd6e971e4b104465bb96dd13f310bc955733
SHA256a9a274fa3c8874915ee5967079a4cf4f96fdae67a28628c0f0e154ae6db6fe00
SHA512662a3d46b1524c25e6862163edcac70aa86829acebf16e03214438b371ace12a8dce354f501db75873601c088d5cee110bca0cbef7928c45e9cba5be358db124
-
Filesize
86KB
MD564292951399fe06445d3f6fe5ab0c6d3
SHA14d10cd6e971e4b104465bb96dd13f310bc955733
SHA256a9a274fa3c8874915ee5967079a4cf4f96fdae67a28628c0f0e154ae6db6fe00
SHA512662a3d46b1524c25e6862163edcac70aa86829acebf16e03214438b371ace12a8dce354f501db75873601c088d5cee110bca0cbef7928c45e9cba5be358db124