8e5caecea47361361a7d9db02ec614e16884a7dd4c6ebfa029df390ab31eafd2

Analysis

max time kernel
98s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2023, 22:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WSKENXR.exe
Size

653.0MB
MD5

eb5622bc93279202365ebee2006ec544
SHA1

3a360762c7d6c7a3b48bcf6e292799153ff5484d
SHA256

11c1b7886228120ff08c66066e38b663c3e0ee3b296854eb590f8fc426d90198
SHA512

a6dfc7692ef8f1fa3ea5578f06ff19dd1d4fc9e83067edede34406be6d35b769eb6952ec9456c4bd66d4fbd4d47d01893afb9a2e12f06f4d7e47b51b22c1fdaa
SSDEEP

12288:uClq7ejV7NyoQ+xJydH65YYMmE0khmz1FZm97IWs69uHF1ZBlxV:uCIu7jNZQmXZi7zslTBlx

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2548	908	WerFault.exe	81

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2676	powershell.exe
2676	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	908	WSKENXR.exe
Token: SeDebugPrivilege	2676	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 908 wrote to memory of 2676	908	WSKENXR.exe	87
PID 908 wrote to memory of 2676	908	WSKENXR.exe	87

C:\Users\Admin\AppData\Local\Temp\WSKENXR.exe
"C:\Users\Admin\AppData\Local\Temp\WSKENXR.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ProgramData'
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2676
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 908 -s 912
  2⤵
  - Program crash
  PID:2548

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 408 -p 908 -ip 908
1⤵
PID:2272

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eedkrhsv.lq3.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/908-166-0x00007FFE02470000-0x00007FFE02739000-memory.dmp

Filesize
2.8MB

Download
memory/908-136-0x0000000003350000-0x0000000003391000-memory.dmp

Filesize
260KB

Download
memory/908-140-0x00007FFDE61F0000-0x00007FFDE629A000-memory.dmp

Filesize
680KB

Download
memory/908-141-0x00007FFE02BF0000-0x00007FFE02C8E000-memory.dmp

Filesize
632KB

Download
memory/908-142-0x00007FFDFFF30000-0x00007FFDFFF42000-memory.dmp

Filesize
72KB

Download
memory/908-144-0x00007FFE035E0000-0x00007FFE03781000-memory.dmp

Filesize
1.6MB

Download
memory/908-143-0x00007FFDE50A0000-0x00007FFDE515D000-memory.dmp

Filesize
756KB

Download
memory/908-145-0x00007FFDE5160000-0x00007FFDE5C21000-memory.dmp

Filesize
10.8MB

Download
memory/908-146-0x00007FFE02C90000-0x00007FFE02CBB000-memory.dmp

Filesize
172KB

Download
memory/908-147-0x0000000001000000-0x0000000001134000-memory.dmp

Filesize
1.2MB

Download
memory/908-148-0x00007FFDE3950000-0x00007FFDE3A9E000-memory.dmp

Filesize
1.3MB

Download
memory/908-149-0x00007FFDE2770000-0x00007FFDE28DA000-memory.dmp

Filesize
1.4MB

Download
memory/908-150-0x00007FFE02170000-0x00007FFE02197000-memory.dmp

Filesize
156KB

Download
memory/908-194-0x0000000003350000-0x0000000003391000-memory.dmp

Filesize
260KB

Download
memory/908-134-0x0000000003350000-0x0000000003391000-memory.dmp

Filesize
260KB

Download
memory/908-164-0x00007FFE048F0000-0x00007FFE04AE5000-memory.dmp

Filesize
2.0MB

Download
memory/908-133-0x0000000001000000-0x0000000001134000-memory.dmp

Filesize
1.2MB

Download
memory/908-165-0x00007FFE02D90000-0x00007FFE02E4E000-memory.dmp

Filesize
760KB

Download
memory/908-178-0x00007FFDE5160000-0x00007FFDE5C21000-memory.dmp

Filesize
10.8MB

Download
memory/908-168-0x00007FFE035E0000-0x00007FFE03781000-memory.dmp

Filesize
1.6MB

Download
memory/908-170-0x00007FFE03EC0000-0x00007FFE03F6C000-memory.dmp

Filesize
688KB

Download
memory/908-171-0x00007FFE02BF0000-0x00007FFE02C8E000-memory.dmp

Filesize
632KB

Download
memory/908-172-0x00007FFE034B0000-0x00007FFE035DA000-memory.dmp

Filesize
1.2MB

Download
memory/908-174-0x00007FFDE61F0000-0x00007FFDE629A000-memory.dmp

Filesize
680KB

Download
memory/908-173-0x00007FFDE6500000-0x00007FFDE6565000-memory.dmp

Filesize
404KB

Download
memory/908-175-0x00007FFE02CC0000-0x00007FFE02D15000-memory.dmp

Filesize
340KB

Download
memory/908-177-0x00007FFDF4EC0000-0x00007FFDF4ECA000-memory.dmp

Filesize
40KB

Download
memory/908-180-0x00007FFDED3C0000-0x00007FFDED3D6000-memory.dmp

Filesize
88KB

Download
memory/908-167-0x00007FFE02740000-0x00007FFE02840000-memory.dmp

Filesize
1024KB

Download
memory/908-184-0x00007FFE04780000-0x00007FFE048AA000-memory.dmp

Filesize
1.2MB

Download
memory/908-186-0x00007FFE03070000-0x00007FFE033C5000-memory.dmp

Filesize
3.3MB

Download
memory/908-182-0x00007FFDE50A0000-0x00007FFDE515D000-memory.dmp

Filesize
756KB

Download
memory/908-190-0x00007FFDE2770000-0x00007FFDE28DA000-memory.dmp

Filesize
1.4MB

Download
memory/908-187-0x00007FFDE3950000-0x00007FFDE3A9E000-memory.dmp

Filesize
1.3MB

Download
memory/908-193-0x0000000001000000-0x0000000001134000-memory.dmp

Filesize
1.2MB

Download
memory/2676-157-0x0000026446B70000-0x0000026446B92000-memory.dmp

Filesize
136KB

Download