Analysis
-
max time kernel
18s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
23-11-2022 18:55
General
-
Target
018f3f7e2e731500654aa680c6dbfacd5a2cbe0ca9aead83b632453aaa531a88.exe
-
Size
112KB
-
MD5
457172bf57a9e415545c31756c6f16b6
-
SHA1
66008496c53954cbd931579fe9464e1eb02833cd
-
SHA256
018f3f7e2e731500654aa680c6dbfacd5a2cbe0ca9aead83b632453aaa531a88
-
SHA512
92852e17a3333848ce6b88b08d83e6c2b28b6b6c8fddd5cdb16faa8bfb3c2a0adda3529159014e35a83a679c60c1b2269bf72f22ecb7697e3dd6894b4f6a4da9
-
SSDEEP
1536:XSSnze1gsJ55n/4CkOwwF+bhoOHLnjXIRXMMGBkyJMjZROYJT3bQghxHCZ:iSn3sziCkd5bho+nsRcaC
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\018f3f7e2e731500654aa680c6dbfacd5a2cbe0ca9aead83b632453aaa531a88.exe"C:\Users\Admin\AppData\Local\Temp\018f3f7e2e731500654aa680c6dbfacd5a2cbe0ca9aead83b632453aaa531a88.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Winklyt.exeC:\Windows\SysWOW64\Winklyt.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\Winklyt.exeFilesize
82KB
MD5d50b0b394d96961e391228bf10ae84bc
SHA107e6176ecdd916604c34ad4a25853c21e82e3589
SHA256852eb7fdb3cba7e6ab8e307076c5184bdd18ca01939d3a63c8fa017fca086cc6
SHA512a8fd079c3d90bb7b28c170fc05b39cdcd491f2cdc634e44c9732b406058a1cce170154b81b5cdad2e60f1145cbfcd2897d62266da8045c80b2f053ee2cc44fe2
-
C:\Windows\SysWOW64\Winklyt.exeFilesize
82KB
MD5d50b0b394d96961e391228bf10ae84bc
SHA107e6176ecdd916604c34ad4a25853c21e82e3589
SHA256852eb7fdb3cba7e6ab8e307076c5184bdd18ca01939d3a63c8fa017fca086cc6
SHA512a8fd079c3d90bb7b28c170fc05b39cdcd491f2cdc634e44c9732b406058a1cce170154b81b5cdad2e60f1145cbfcd2897d62266da8045c80b2f053ee2cc44fe2