Analysis
-
max time kernel
40s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
01-12-2022 08:32
General
-
Target
c9e6648b0bc6490fbb850125c5c5c14852d88ea48c87ee6bacf3b2e4b753b191.exe
-
Size
88KB
-
MD5
d6677e94b6e1a0b3d7573575e42adb0e
-
SHA1
399fac57a4f1e8e91782ee94091f8b7534a9ddf5
-
SHA256
c9e6648b0bc6490fbb850125c5c5c14852d88ea48c87ee6bacf3b2e4b753b191
-
SHA512
a8b0e8be9523f77725cb8f83c864ff1ba8b3228c7fa79d3c08f6bf08c1ddaedce5800ded22e7d498f3d1612c21184e201803a82345c5a9f1d0e8902d24953591
-
SSDEEP
768:WeWGCQxs9kGd96NDkSV2bIXzl4CnTDHGsDf8RUFqoD4bDIsFDBnowp6D5or3J:1WGxs9kGdYk8wO4Cnt8RUyhowCm
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c9e6648b0bc6490fbb850125c5c5c14852d88ea48c87ee6bacf3b2e4b753b191.exe"C:\Users\Admin\AppData\Local\Temp\c9e6648b0bc6490fbb850125c5c5c14852d88ea48c87ee6bacf3b2e4b753b191.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Winkjqn.exeC:\Windows\SysWOW64\Winkjqn.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
93KB
MD58f08880916f48cfc73946152a4aabba0
SHA1f187962bd67bdc47f41a7ee0b4c0d194d74ade32
SHA256cfb796d1e3ab355e0445eebec7335788ff62f3c37bb7c447664fbafe79d6d83e
SHA5129da0091d22f8e028fbe03390fd5509a1488018220efcb2921ef739b86f74c4a31e11ecb8ff12060a527aa27bffb7a9384d92465e5993b44a8290cff4b0b03fb0
-
Filesize
93KB
MD58f08880916f48cfc73946152a4aabba0
SHA1f187962bd67bdc47f41a7ee0b4c0d194d74ade32
SHA256cfb796d1e3ab355e0445eebec7335788ff62f3c37bb7c447664fbafe79d6d83e
SHA5129da0091d22f8e028fbe03390fd5509a1488018220efcb2921ef739b86f74c4a31e11ecb8ff12060a527aa27bffb7a9384d92465e5993b44a8290cff4b0b03fb0