817a45502360c84218d7f1d314d3274a8ec394cb68ccf1e019e3886fd5bca09b | Triage

Analysis

max time kernel
125s
max time network
138s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 14:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0210a6153c91f25371e747eaee94e116.exe
Size

64KB
MD5

0210a6153c91f25371e747eaee94e116
SHA1

50e3e632215354cde4337617ce29f864526fdd5a
SHA256

817a45502360c84218d7f1d314d3274a8ec394cb68ccf1e019e3886fd5bca09b
SHA512

0270b2ce3a60ceb7723a4f146a5934232297ac52b88ba85947b05e18b192966d2fbbe097ea055d81a66f36dbdf826bb6a0e60d30c4c7c4b1efafae2da91333fa
SSDEEP

1536:CMnevuzyh6n3m9dMZyTh1I2h7OhGHLLFGToIf0dNO:de1T7lsGHLL4TBf0dNO

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1888	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1708	kkaaya.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\kkaaya.exe	0210a6153c91f25371e747eaee94e116.exe
File opened for modification	C:\Windows\SysWOW64\kkaaya.exe	0210a6153c91f25371e747eaee94e116.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2232	0210a6153c91f25371e747eaee94e116.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 1888	2232	0210a6153c91f25371e747eaee94e116.exe	29
PID 2232 wrote to memory of 1888	2232	0210a6153c91f25371e747eaee94e116.exe	29
PID 2232 wrote to memory of 1888	2232	0210a6153c91f25371e747eaee94e116.exe	29
PID 2232 wrote to memory of 1888	2232	0210a6153c91f25371e747eaee94e116.exe	29

C:\Users\Admin\AppData\Local\Temp\0210a6153c91f25371e747eaee94e116.exe
"C:\Users\Admin\AppData\Local\Temp\0210a6153c91f25371e747eaee94e116.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\0210A6~1.EXE > nul
  2⤵
  - Deletes itself
  PID:1888

C:\Windows\SysWOW64\kkaaya.exe
C:\Windows\SysWOW64\kkaaya.exe
1⤵
- Executes dropped EXE
PID:1708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\kkaaya.exe

Filesize
64KB

MD5
0210a6153c91f25371e747eaee94e116

SHA1
50e3e632215354cde4337617ce29f864526fdd5a

SHA256
817a45502360c84218d7f1d314d3274a8ec394cb68ccf1e019e3886fd5bca09b

SHA512
0270b2ce3a60ceb7723a4f146a5934232297ac52b88ba85947b05e18b192966d2fbbe097ea055d81a66f36dbdf826bb6a0e60d30c4c7c4b1efafae2da91333fa

Download Submit