3562c2177283ce1e73bb31754276b83d23266053f645761638cfbd64c3f7394a

Analysis

max time kernel
141s
max time network
33s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
16-06-2023 14:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

E8A3E804A96C716A3E9B69195DB6FFB0D33E2433AF871E4D4E1EAB3097237173.exe
Size

372KB
MD5

e9dc058440d321aa17d0600b3ca0ab04
SHA1

539c228b6b332f5aa523e5ce358c16647d8bbe57
SHA256

e8a3e804a96c716a3e9b69195db6ffb0d33e2433af871e4d4e1eab3097237173
SHA512

7e9a18fd03f1ce53e2829683f7aa51bd3ce7794ead29266bcb248e3088342dc369c43f644d31f4671a9a97244bbbfc2add1961b7c760e41b8ddf277bcdb7ebde
SSDEEP

6144:wW3dQfk45aQOVusKHL7G0FJ6KbJLor/XqNjHtBfLptTksD0c2PMM40:FgkOZHvNJ6KbJE/qNBJT/h2PM

Score

8^/10

persistence upx

Malware Config

Signatures

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\kgtoipow\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\kgtoipow.sys"	E8A3E804A96C716A3E9B69195DB6FFB0D33E2433AF871E4D4E1EAB3097237173.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1060-56-0x0000000000400000-0x00000000004DE000-memory.dmp	upx
behavioral1/memory/1060-57-0x0000000000400000-0x00000000004DE000-memory.dmp	upx

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
1060	E8A3E804A96C716A3E9B69195DB6FFB0D33E2433AF871E4D4E1EAB3097237173.exe
1060	E8A3E804A96C716A3E9B69195DB6FFB0D33E2433AF871E4D4E1EAB3097237173.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1060	E8A3E804A96C716A3E9B69195DB6FFB0D33E2433AF871E4D4E1EAB3097237173.exe
Token: SeDebugPrivilege	1060	E8A3E804A96C716A3E9B69195DB6FFB0D33E2433AF871E4D4E1EAB3097237173.exe
Token: SeBackupPrivilege	1060	E8A3E804A96C716A3E9B69195DB6FFB0D33E2433AF871E4D4E1EAB3097237173.exe
Token: SeLoadDriverPrivilege	1060	E8A3E804A96C716A3E9B69195DB6FFB0D33E2433AF871E4D4E1EAB3097237173.exe

C:\Users\Admin\AppData\Local\Temp\E8A3E804A96C716A3E9B69195DB6FFB0D33E2433AF871E4D4E1EAB3097237173.exe
"C:\Users\Admin\AppData\Local\Temp\E8A3E804A96C716A3E9B69195DB6FFB0D33E2433AF871E4D4E1EAB3097237173.exe"
1⤵
- Sets service image path in registry
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:1060

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1060-56-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download
memory/1060-57-0x0000000000400000-0x00000000004DE000-memory.dmp

Filesize
888KB

Download