Analysis Overview
SHA256
c9cc5c0b7d439c7881227618879dc53ea07ddb4b649cef39fc0a1b1da6c4d476
Threat Level: Known bad
The file 751f2d5097fc2ba1bebf9170bda56a14 was found to be: Known bad.
Malicious Activity Summary
Kinsing
Executes dropped EXE
Reads user/profile data of web browsers
Checks whether UAC is enabled
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Modifies Internet Explorer settings
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-01-25 17:42
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-01-25 17:42
Reported
2024-01-25 17:45
Platform
win7-20231215-en
Max time kernel
118s
Max time network
123s
Command Line
Signatures
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\LocalLow\cookieman.exe | N/A |
Reads user/profile data of web browsers
Checks whether UAC is enabled
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA | C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe | N/A |
| Key value queried | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA | C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe | N/A |
Modifies Internet Explorer settings
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main | C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeIncreaseQuotaPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe
"C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe"
C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe
"C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe" /wrapper /dir="C:\Users\Admin\AppData\Local\Temp\pkg_112a1f890"
C:\Users\Admin\AppData\LocalLow\cookieman.exe
"C:\Users\Admin\AppData\LocalLow\cookieman.exe" /mode=read installiq.com
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | installer.freeze.com | udp |
| US | 8.8.8.8:53 | dl.installiq.com | udp |
| US | 69.162.95.5:80 | dl.installiq.com | tcp |
| US | 8.8.8.8:53 | ww1.installiq.com | udp |
| US | 208.91.196.145:80 | ww1.installiq.com | tcp |
Files
C:\Users\Admin\AppData\Local\Temp\pkg_112a1f890\autorun.txt
| MD5 | dedd637ddbf046e30073a331661f9c07 |
| SHA1 | ab5f8164ea28c3b43ef05d20a45fe05d56b55362 |
| SHA256 | ea421d768126b1dcd0892be805e7cd22c1ccc662cd744bc4bac801264be8e722 |
| SHA512 | c8d63d624c71ed717dfedf3940c5a3983f9b5626c16a2ff4357ad3c02f20040742d8ad33247cc0b60c1ce82ca4b57fd402ddb7e27fe04138f37f152725a1fd65 |
C:\Users\Admin\AppData\Local\Temp\pkg_112a1f890\wrapper.xml
| MD5 | 1d45a29e3511b982a1f91b33c70e964f |
| SHA1 | 176a47b489be3f27dc354a2b9dd0b580bb2f3904 |
| SHA256 | 0a69c29fe16727b18425df8ded1cfe9d07a380b9f23f1beb32f60fefc000b3dc |
| SHA512 | c574719f56a9cc0a3c393001f0774a5826afa5972906d9d9d214a183724a9f7226483a7181a0030e0f801b481a19957761efc170a10850aec786623eb939eb69 |
C:\Users\Admin\AppData\LocalLow\cookieman.exe
| MD5 | 3e382f6385bf86f976aecc9c2c3c6552 |
| SHA1 | d8c658bc164cb8bce72e5cca0597406841105685 |
| SHA256 | f2327ccb290c23f00af6555afc7f1c2855ef599ae387022a7f785d6cb47fceae |
| SHA512 | 656ee17c403d6aef18faad8eff0e4c305cb0f18ac22fe55b5b6b3400a560f45445f5fe0f21140ee36fb0de6cbe9abb3185a3c2caf0cbafd4d0bcdbf9ae20396b |
C:\Users\Admin\AppData\LocalLow\cookie.ini
| MD5 | 3f4519b56cb1e006dfe4341e72112913 |
| SHA1 | 0ff5675d359c898b6a6bdc1dff10f71097bc9927 |
| SHA256 | 125adf4924899f2026436c0919853bb78b718c7cb6f2187148b01938b79388a2 |
| SHA512 | 78c0961f0828f32032c643f0e6ab59d1ca8b96bb891a74b0b255e1a1a63a0c581f486e9e16b070399e6365d1fb53464eb2b723932480b41a2df5e9f1eb89ab40 |
Analysis: behavioral2
Detonation Overview
Submitted
2024-01-25 17:42
Reported
2024-01-25 17:45
Platform
win10v2004-20231215-en
Max time kernel
142s
Max time network
147s
Command Line
Signatures
Kinsing
Reads user/profile data of web browsers
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 756 wrote to memory of 384 | N/A | C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe | C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe |
| PID 756 wrote to memory of 384 | N/A | C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe | C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe |
| PID 756 wrote to memory of 384 | N/A | C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe | C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe
"C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe"
C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe
"C:\Users\Admin\AppData\Local\Temp\751f2d5097fc2ba1bebf9170bda56a14.exe" /wrapper /dir="C:\Users\Admin\AppData\Local\Temp\pkg_112a26680"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | installer.freeze.com | udp |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | dl.installiq.com | udp |
| US | 69.162.95.5:80 | dl.installiq.com | tcp |
| US | 8.8.8.8:53 | 5.95.162.69.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 58.55.71.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 157.123.68.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 178.223.142.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 168.117.168.52.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\pkg_112a26680\autorun.txt
| MD5 | dedd637ddbf046e30073a331661f9c07 |
| SHA1 | ab5f8164ea28c3b43ef05d20a45fe05d56b55362 |
| SHA256 | ea421d768126b1dcd0892be805e7cd22c1ccc662cd744bc4bac801264be8e722 |
| SHA512 | c8d63d624c71ed717dfedf3940c5a3983f9b5626c16a2ff4357ad3c02f20040742d8ad33247cc0b60c1ce82ca4b57fd402ddb7e27fe04138f37f152725a1fd65 |
C:\Users\Admin\AppData\Local\Temp\pkg_112a26680\wrapper.xml
| MD5 | 1d45a29e3511b982a1f91b33c70e964f |
| SHA1 | 176a47b489be3f27dc354a2b9dd0b580bb2f3904 |
| SHA256 | 0a69c29fe16727b18425df8ded1cfe9d07a380b9f23f1beb32f60fefc000b3dc |
| SHA512 | c574719f56a9cc0a3c393001f0774a5826afa5972906d9d9d214a183724a9f7226483a7181a0030e0f801b481a19957761efc170a10850aec786623eb939eb69 |