kinsing | 792b0ae9a690ab305d247ea1af03bd191a02260d4ea555d79f8cc5d15a7bc1e7

Analysis

max time kernel
93s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 16:19

Target
74f3f9303efc4e4676cb8e1911272f57.lnk
Size 1KB
Sample240125-tsneeaaeb6
SHA256 792b0ae9a690ab305d247ea1af03bd191a02260d4ea555d79f8cc5d15a7bc1e7
MD5 74f3f9303efc4e4676cb8e1911272f57
SHA1 2f08ea86c8f200e1f694efba65347b14bc3cd9b7
SHA512 6e04ae9c8cb37ab6caa4d98234afee0ac10cda9d44aa55786b47f8b1f5fcdf4210bc406cf5e098987d0b62e0f4cf66c7cfd564e2afbe1a51c45ea94246137ab6
MD5 SHA1 SHA512

Score

10^/10

kinsing loader

Kinsing
Kinsing is a loader written in Golang.
loader kinsing
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1988	cmd.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\74f3f9303efc4e4676cb8e1911272f57.lnk
1⤵
- Suspicious use of FindShellTrayWindow
PID:1988

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact