Analysis
-
max time kernel
90s -
max time network
109s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
01-12-2022 08:32
General
-
Target
c9e6648b0bc6490fbb850125c5c5c14852d88ea48c87ee6bacf3b2e4b753b191.exe
-
Size
88KB
-
MD5
d6677e94b6e1a0b3d7573575e42adb0e
-
SHA1
399fac57a4f1e8e91782ee94091f8b7534a9ddf5
-
SHA256
c9e6648b0bc6490fbb850125c5c5c14852d88ea48c87ee6bacf3b2e4b753b191
-
SHA512
a8b0e8be9523f77725cb8f83c864ff1ba8b3228c7fa79d3c08f6bf08c1ddaedce5800ded22e7d498f3d1612c21184e201803a82345c5a9f1d0e8902d24953591
-
SSDEEP
768:WeWGCQxs9kGd96NDkSV2bIXzl4CnTDHGsDf8RUFqoD4bDIsFDBnowp6D5or3J:1WGxs9kGdYk8wO4Cnt8RUyhowCm
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c9e6648b0bc6490fbb850125c5c5c14852d88ea48c87ee6bacf3b2e4b753b191.exe"C:\Users\Admin\AppData\Local\Temp\c9e6648b0bc6490fbb850125c5c5c14852d88ea48c87ee6bacf3b2e4b753b191.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Winkek.exeC:\Windows\SysWOW64\Winkek.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
87KB
MD5e522e421405b36d84e800ca244bb35a3
SHA15ac76b259fa12bd885fa92b21b72db33e1c008c5
SHA256ae2bb7b7cf766b8533443884754761330c47124cbe5043960261c93893f5dde3
SHA512353eac40b83f8b63a4f41523506be56a4746a422f505ae7d4088ae05495a8e03d5e50b45af433893281dbcdc2cf0313314ae110dd4459349e81be584713824d1
-
Filesize
87KB
MD5e522e421405b36d84e800ca244bb35a3
SHA15ac76b259fa12bd885fa92b21b72db33e1c008c5
SHA256ae2bb7b7cf766b8533443884754761330c47124cbe5043960261c93893f5dde3
SHA512353eac40b83f8b63a4f41523506be56a4746a422f505ae7d4088ae05495a8e03d5e50b45af433893281dbcdc2cf0313314ae110dd4459349e81be584713824d1