kinsing | dd02e2a6f580af520625c84f08991d708c2614ee85184a5abdd86359a79cac1d

Analysis

max time kernel
88s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 17:11

Target
750f0c298d126fe41f6ea52ef84389bc.exe
Size 8KB
Sample240125-vqqmesbdb4
SHA256 dd02e2a6f580af520625c84f08991d708c2614ee85184a5abdd86359a79cac1d
MD5 750f0c298d126fe41f6ea52ef84389bc
SHA1 9dff0d71cf3f2de7c78f17b9f3b01f75a64e3687
SHA512 526f669871bbfa75a8c1380f8588eadf5dedb381dbf97a4bf13ed68bfecd26fb00748cd00cbb918ce0f62b96fc984d5b4018adbea8c351bbb5f88d9791d71781
SSDEEP 192:aVl/yowJL/aMjGwP7PMZvz+ebMeFMn0TP:u/YJLW/vlbgs
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kinsing loader

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3508	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3508	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3508	msiexec.exe
3508	msiexec.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 3508	2976	750f0c298d126fe41f6ea52ef84389bc.exe	87
PID 2976 wrote to memory of 3508	2976	750f0c298d126fe41f6ea52ef84389bc.exe	87
PID 2976 wrote to memory of 3508	2976	750f0c298d126fe41f6ea52ef84389bc.exe	87

C:\Users\Admin\AppData\Local\Temp\750f0c298d126fe41f6ea52ef84389bc.exe
"C:\Users\Admin\AppData\Local\Temp\750f0c298d126fe41f6ea52ef84389bc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\SysWOW64\msiexec.exe
  msiexec /i 64.msi
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:3508