3113fa9a3cf00ed423a2c686a2ffb19586f6a047747de65a93436a7dca8fcfa7 | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
18/02/2024, 13:29

Sharing

Report Analysis Logs

General

Target

Klez.e.exe
Size

86KB
MD5

f2db87b351770e5995e9fcaad47d9591
SHA1

4c75bd93f458096fbc27fa852e16ce25a602f267
SHA256

3113fa9a3cf00ed423a2c686a2ffb19586f6a047747de65a93436a7dca8fcfa7
SHA512

608e74274b555a239534a9d43514e07cb8aad9b13baf4cc383e8c21ea4e9ebd36162dc0b4bf30a0975c334facf23d6e63742e2bbe4ba400e80d9f191893a84fc
SSDEEP

768:zXS6Lnze1gshn5ew/QuBdL/4Ckir4SWeq3HwFdkt+Afs2DBnoLK6KcgMvtD:TSSnze1gsJ55n/4CkOwwF+bho0st

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1936	Winkxd.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Winkxd.exe	Klez.e.exe
File created	C:\Windows\SysWOW64\Winkxd.exe	Klez.e.exe
File opened for modification	C:\Windows\SysWOW64\Winkxd.exe	Winkxd.exe
File created	C:\Windows\SysWOW64\Winkxd.exe	Winkxd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTcbPrivilege	2724	Klez.e.exe
Token: SeTcbPrivilege	1936	Winkxd.exe

C:\Users\Admin\AppData\Local\Temp\Klez.e.exe
"C:\Users\Admin\AppData\Local\Temp\Klez.e.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2724

C:\Windows\SysWOW64\Winkxd.exe
C:\Windows\SysWOW64\Winkxd.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Winkxd.exe

Filesize
79KB

MD5
79e58dae4b5617f768ed37b64599c3f7

SHA1
32f61d498a83b7815c18a0516fe0fcbd7a0fb082

SHA256
da97364af6fd0cd140f82c11e1db4f836aeebf0bc44535989ad8108d7e463753

SHA512
99c757ba3826ab7475958e0c372a79d0dd835d6ebd43602fcb0f78c940f6a097f6bc0767e8b83d47f658e443c1abcf9f9a222119b20084ef359493fcfb917813

Download Submit