Analysis

  • max time kernel
    140s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-10-2023 10:36

General

  • Target

    Commkkhwb.exe

  • Size

    68KB

  • MD5

    9978b4e89a86b7e659e6d50737a5a2e3

  • SHA1

    ae5553562926cdefd411108d898fed36ed69bede

  • SHA256

    e74eac907deb295455e5856a2f4030c175a134dd3f2d681cec2d59ebb387c275

  • SHA512

    55b64faf8aec29f2e5600a8f83cf366f080d63cfec26d767760d9f48774b177e54767b84f6916bee585e4c8020c4a49dc53dc2fb59af898175b2b2cf81e473f2

  • SSDEEP

    768:m4GpAgE5/XuIHDI0w7yrSAllWoqEqRyflqFwH9SKzaDq/qTplPWrFDF+84PB0/tv:aAgkuOuyrzlhl8c/ti6GCKoqi

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Commkkhwb.exe
    "C:\Users\Admin\AppData\Local\Temp\Commkkhwb.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4060-0-0x00000263823D0000-0x00000263823E6000-memory.dmp

    Filesize

    88KB

  • memory/4060-1-0x00007FFCBA480000-0x00007FFCBAF41000-memory.dmp

    Filesize

    10.8MB

  • memory/4060-2-0x000002639CB40000-0x000002639CB50000-memory.dmp

    Filesize

    64KB

  • memory/4060-3-0x00007FFCBA480000-0x00007FFCBAF41000-memory.dmp

    Filesize

    10.8MB