Analysis

  • max time kernel
    210s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    29/02/2024, 04:11

General

  • Target

    KKjie.exe

  • Size

    184KB

  • MD5

    b9aeb26808660d0e9cffca9db42590f0

  • SHA1

    60cc89d6e97a1cdc809bd3f98f1f4323af039f2d

  • SHA256

    54160c7d3350b20a4abc569f4543a1bd5001e8612c636a7c49cbe3eaf97e12e4

  • SHA512

    1909e40d155b96a3ec5a79bb7fd3afa755bfd4923175d711fcb1bf54ee1f64d625240d7a0ca220012a2bc177e77184bed89fa63949201676ba64c0101e6a4dd8

  • SSDEEP

    3072:IoyjBGWMuG4SJJHCiRhafmH4QvaNCj3Vf7pfTLR/bNTubouYKux+PlXEcWxGAc+w:VyjZUdnRQeH4QiNCjl75d1ubAV8ZWFcT

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\KKjie.exe
    "C:\Users\Admin\AppData\Local\Temp\KKjie.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1996
    • C:\Users\Admin\AppData\Local\Temp\KKjie_safe.exe
      C:\Users\Admin\AppData\Local\Temp\KKjie_safe.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2436

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\nse3BD9.tmp\Banner.dll

          Filesize

          4KB

          MD5

          103580e980d6082efc8580953d3692c3

          SHA1

          62f3fe6148e99c1ecf65411686cac19ae6d2dafc

          SHA256

          a5d8839e9b015538c54af7b171a47e223f2f1d6b6f28af715341bba95252d318

          SHA512

          14e2f480bc64126b2e20848cc36e774cd5a326e83896de6c64ecd8cea61f665178e41e4999ac17ad3898dd770e1166eb82a460e919dd1eaacc5868a71ecf57a4

        • \Users\Admin\AppData\Local\Temp\KKjie_safe.exe

          Filesize

          377KB

          MD5

          ac68dffc261c8625c5f2a94364ca10c9

          SHA1

          d5873084dcf4a74631c9abe82f1afc3ba1216464

          SHA256

          16694059e7073810021960bb709f814f42490a5219f7970fa201b3d8ef259db7

          SHA512

          d7ab568b6906d6d0ff924da59983cb8def9cfbb76ed93371e815c26f2f59f3a33edef0e65419bdaee02bcf85efc7a5b856949de5c26afab689aeada50a705b59

        • \Users\Admin\AppData\Local\Temp\nse3BD9.tmp\FindProcDLL.dll

          Filesize

          3KB

          MD5

          8614c450637267afacad1645e23ba24a

          SHA1

          e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2

          SHA256

          0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758

          SHA512

          af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b

        • memory/1996-7-0x0000000010000000-0x0000000010003000-memory.dmp

          Filesize

          12KB

        • memory/2436-29-0x00000000002F0000-0x00000000002FD000-memory.dmp

          Filesize

          52KB