Analysis Overview
SHA256
fac6ae4446cfae1d79e6fc98d2679fe01ce737eaa275868f4184e951864fb370
Threat Level: Known bad
The file 751e67a4989473abf91876bc5f5fe704 was found to be: Known bad.
Malicious Activity Summary
Kinsing
UPX packed file
Unsigned PE
Program crash
Enumerates physical storage devices
Suspicious behavior: EnumeratesProcesses
Modifies registry class
Modifies Internet Explorer settings
Suspicious use of SetWindowsHookEx
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-01-25 17:40
Signatures
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-01-25 17:40
Reported
2024-01-25 17:43
Platform
win7-20231215-en
Max time kernel
142s
Max time network
123s
Command Line
Signatures
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Enumerates physical storage devices
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main | C:\Users\Admin\AppData\Local\Temp\751e67a4989473abf91876bc5f5fe704.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Users\Admin\AppData\Local\Temp\751e67a4989473abf91876bc5f5fe704.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Users\Admin\AppData\Local\Temp\751e67a4989473abf91876bc5f5fe704.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\751e67a4989473abf91876bc5f5fe704.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\751e67a4989473abf91876bc5f5fe704.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\751e67a4989473abf91876bc5f5fe704.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\751e67a4989473abf91876bc5f5fe704.exe
"C:\Users\Admin\AppData\Local\Temp\751e67a4989473abf91876bc5f5fe704.exe"
Network
Files
memory/760-0-0x0000000000400000-0x00000000005B9000-memory.dmp
memory/760-1-0x0000000003DC0000-0x0000000003DC1000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\index.html
| MD5 | c75583d86c4ce7ba75e3651e0b5bcce9 |
| SHA1 | b1a536a62ee86ac0ed4a4f9ca3152cd11a525a65 |
| SHA256 | 4ce1156be542cd55b59f8c778f92550277688d9ab6929618cc9609054ba57f61 |
| SHA512 | c071b1704898723d9548fcbaecf47a8962fe7a9de81466bb13a2e2484a951e501fbbc4d5ebbe98baad71f7559c2fa0761c114c70c2a5a4b46885dbb3ef6cce6b |
C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\js\jquery.min.1.6.4.js
| MD5 | 219073097031d9c1a95a1291d66f3a10 |
| SHA1 | 2b7996b01d90b7f424f2a2e6063947461db4b2b2 |
| SHA256 | 232066e3f6f1351afdaee1acb70c409766641fd5669e0b55ce7c77fac0a857ef |
| SHA512 | 9ad2745f96cf79a4d59393cc3fbb3958b244013f6798c12abe41e37fca80df3c7cedab4b47cbd197645c86b31077388ec8f01ea8d67c5feacbef95b1ae7582b5 |
C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\js\jquery-ui.min.1.8.0.js
| MD5 | a4fdd77e182bd2fabe300a47b5617a35 |
| SHA1 | e002b335c75b5edefcd251962f61f53a2ab8e0f2 |
| SHA256 | 8b59592d67eadc703af6cdd5ba8d077f9f9485d01fb6405555614335f89be99b |
| SHA512 | ddcccde1c129f8f71fb39685abc615c4202b8b3dfc12cedd7d9cca2f97b308fc14b64497826421fa9df3d1cf54bdae9c085051af0a8d393cd3d556a6578d4085 |
memory/760-60-0x0000000005C70000-0x0000000005C90000-memory.dmp
memory/760-76-0x0000000000400000-0x00000000005B9000-memory.dmp
memory/760-78-0x0000000003DC0000-0x0000000003DC1000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-01-25 17:40
Reported
2024-01-25 17:43
Platform
win10v2004-20231222-en
Max time kernel
144s
Max time network
150s
Command Line
Signatures
Kinsing
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Enumerates physical storage devices
Program crash
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WerFault.exe | C:\Users\Admin\AppData\Local\Temp\751e67a4989473abf91876bc5f5fe704.exe |
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch | C:\Users\Admin\AppData\Local\Temp\751e67a4989473abf91876bc5f5fe704.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" | C:\Users\Admin\AppData\Local\Temp\751e67a4989473abf91876bc5f5fe704.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Software\Microsoft\Internet Explorer\IESettingSync | C:\Users\Admin\AppData\Local\Temp\751e67a4989473abf91876bc5f5fe704.exe | N/A |
| Set value (int) | \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" | C:\Users\Admin\AppData\Local\Temp\751e67a4989473abf91876bc5f5fe704.exe | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ | C:\Users\Admin\AppData\Local\Temp\751e67a4989473abf91876bc5f5fe704.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ | C:\Users\Admin\AppData\Local\Temp\751e67a4989473abf91876bc5f5fe704.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\751e67a4989473abf91876bc5f5fe704.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\751e67a4989473abf91876bc5f5fe704.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\751e67a4989473abf91876bc5f5fe704.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\751e67a4989473abf91876bc5f5fe704.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\751e67a4989473abf91876bc5f5fe704.exe
"C:\Users\Admin\AppData\Local\Temp\751e67a4989473abf91876bc5f5fe704.exe"
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3188 -ip 3188
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3188 -s 2584
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 104.219.191.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 68.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 50.23.12.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 198.187.3.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.205.248.87.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 10.73.50.20.in-addr.arpa | udp |
Files
memory/3188-0-0x0000000000400000-0x00000000005B9000-memory.dmp
memory/3188-1-0x0000000003260000-0x0000000003261000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\js\jquery.min.1.6.4.js
| MD5 | 219073097031d9c1a95a1291d66f3a10 |
| SHA1 | 2b7996b01d90b7f424f2a2e6063947461db4b2b2 |
| SHA256 | 232066e3f6f1351afdaee1acb70c409766641fd5669e0b55ce7c77fac0a857ef |
| SHA512 | 9ad2745f96cf79a4d59393cc3fbb3958b244013f6798c12abe41e37fca80df3c7cedab4b47cbd197645c86b31077388ec8f01ea8d67c5feacbef95b1ae7582b5 |
C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\index.html
| MD5 | c75583d86c4ce7ba75e3651e0b5bcce9 |
| SHA1 | b1a536a62ee86ac0ed4a4f9ca3152cd11a525a65 |
| SHA256 | 4ce1156be542cd55b59f8c778f92550277688d9ab6929618cc9609054ba57f61 |
| SHA512 | c071b1704898723d9548fcbaecf47a8962fe7a9de81466bb13a2e2484a951e501fbbc4d5ebbe98baad71f7559c2fa0761c114c70c2a5a4b46885dbb3ef6cce6b |
C:\Users\Admin\AppData\Local\Temp\mediaget-installer-tmp\js\jquery-ui.min.1.8.0.js
| MD5 | a4fdd77e182bd2fabe300a47b5617a35 |
| SHA1 | e002b335c75b5edefcd251962f61f53a2ab8e0f2 |
| SHA256 | 8b59592d67eadc703af6cdd5ba8d077f9f9485d01fb6405555614335f89be99b |
| SHA512 | ddcccde1c129f8f71fb39685abc615c4202b8b3dfc12cedd7d9cca2f97b308fc14b64497826421fa9df3d1cf54bdae9c085051af0a8d393cd3d556a6578d4085 |
memory/3188-61-0x0000000000400000-0x00000000005B9000-memory.dmp