Analysis
-
max time kernel
143s -
max time network
171s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
07-11-2022 15:24
General
-
Target
f42415e8c0e1deb2b412168bb66f31e915547a199ced374562f5690e832d373c.exe
-
Size
90KB
-
MD5
0a199f56620cd5cc50770af98ec3e0c1
-
SHA1
c0101a37edf3892b3c3db059a60b8b2245254f0a
-
SHA256
f42415e8c0e1deb2b412168bb66f31e915547a199ced374562f5690e832d373c
-
SHA512
969353497e6e02983159e146117355b0b195977cab14960ca18c774feeffb09ab86335b2c687dc17e24db34860b3e51afced68a40e50c544cfbd30d4a46cb459
-
SSDEEP
1536:OROM9kCiFHcx3a4Cnu8RbVSholRbIcCsnj:ORWCi+Cn1VSholWcRn
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f42415e8c0e1deb2b412168bb66f31e915547a199ced374562f5690e832d373c.exe"C:\Users\Admin\AppData\Local\Temp\f42415e8c0e1deb2b412168bb66f31e915547a199ced374562f5690e832d373c.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Winktbq.exeC:\Windows\SysWOW64\Winktbq.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
91KB
MD51c50093080cc85595a33967396955816
SHA1a70092b1e4e948edb144803a1ddf8609867bda46
SHA25661a9824f595f116c2fe91301435cd72155bb20d60e7aeed91dff70d7ca130e29
SHA5122839a7430dc338a0821db0365220f55f9a13d1657c0b51d73c66f042a7673498d431c8eb3eb8180ebb370d6d280559f4519e32d3aec754a08f5744dfa933acfb
-
Filesize
91KB
MD51c50093080cc85595a33967396955816
SHA1a70092b1e4e948edb144803a1ddf8609867bda46
SHA25661a9824f595f116c2fe91301435cd72155bb20d60e7aeed91dff70d7ca130e29
SHA5122839a7430dc338a0821db0365220f55f9a13d1657c0b51d73c66f042a7673498d431c8eb3eb8180ebb370d6d280559f4519e32d3aec754a08f5744dfa933acfb