Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
03-03-2024 01:08
General
-
Target
Email-Worm/Klez.e.exe
-
Size
86KB
-
MD5
f2db87b351770e5995e9fcaad47d9591
-
SHA1
4c75bd93f458096fbc27fa852e16ce25a602f267
-
SHA256
3113fa9a3cf00ed423a2c686a2ffb19586f6a047747de65a93436a7dca8fcfa7
-
SHA512
608e74274b555a239534a9d43514e07cb8aad9b13baf4cc383e8c21ea4e9ebd36162dc0b4bf30a0975c334facf23d6e63742e2bbe4ba400e80d9f191893a84fc
-
SSDEEP
768:zXS6Lnze1gshn5ew/QuBdL/4Ckir4SWeq3HwFdkt+Afs2DBnoLK6KcgMvtD:TSSnze1gsJ55n/4CkOwwF+bho0st
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Email-Worm\Klez.e.exe"C:\Users\Admin\AppData\Local\Temp\Email-Worm\Klez.e.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Winkrvo.exeC:\Windows\SysWOW64\Winkrvo.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\Winkrvo.exeFilesize
84KB
MD554cf6d969cdb5ac8f86f5ad00393c17e
SHA1a2a0b86601f7d9fa60f83c89ae06750ab21754d9
SHA25643d6fc27c1060fb91e6daaeaee6baf435090534972ca1750e15babbf6b99ac44
SHA5123df52f19be536ec7e42259096c66096daf68e953f7371c5fd6b09875d729dc8828aff805147e3adafcd5effac710f7bca2bb63370597ac88122aa3e6ec345a29