Overview

overview

7

Static

static

1

krnlss.exe

windows10-1703-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    krnlss.exe

  • Size

    2.2MB

  • Sample

    230304-vvn96aee44

  • MD5

    57aa168d72ce8e38ed86ae8225305886

  • SHA1

    0bbcd41f49fbe0a058e356eb482f614045f2bb9d

  • SHA256

    f0f69756ab35e1f936f8486148c453b4820bfc177522fff2a7375ca1830a9167

  • SHA512

    f09eddca198258e7ab2312f8555d5cecb809f18b1904ddc8fce796cafa5a7ac375495ec9b7f9d2d5ff19cd949eed1e30b7aa9420a1fffab837dd7cb8b119b7a1

  • SSDEEP

    24576:ynsJ39LyjbJkQFMhmC+6GD9BnWuOWPC4ysGGGGGGhGGGGx1VpsD:ynsHyjtk2MYC5GDrGmHpi

Score
7/10
persistence

Malware Config

Targets

    • Target

      krnlss.exe

    • Size

      2.2MB

    • MD5

      57aa168d72ce8e38ed86ae8225305886

    • SHA1

      0bbcd41f49fbe0a058e356eb482f614045f2bb9d

    • SHA256

      f0f69756ab35e1f936f8486148c453b4820bfc177522fff2a7375ca1830a9167

    • SHA512

      f09eddca198258e7ab2312f8555d5cecb809f18b1904ddc8fce796cafa5a7ac375495ec9b7f9d2d5ff19cd949eed1e30b7aa9420a1fffab837dd7cb8b119b7a1

    • SSDEEP

      24576:ynsJ39LyjbJkQFMhmC+6GD9BnWuOWPC4ysGGGGGGhGGGGx1VpsD:ynsHyjtk2MYC5GDrGmHpi

    Score
    7/10
    persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks