Analysis
-
max time kernel
147s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
03-03-2024 01:08
General
-
Target
Email-Worm/Klez.e.exe
-
Size
86KB
-
MD5
f2db87b351770e5995e9fcaad47d9591
-
SHA1
4c75bd93f458096fbc27fa852e16ce25a602f267
-
SHA256
3113fa9a3cf00ed423a2c686a2ffb19586f6a047747de65a93436a7dca8fcfa7
-
SHA512
608e74274b555a239534a9d43514e07cb8aad9b13baf4cc383e8c21ea4e9ebd36162dc0b4bf30a0975c334facf23d6e63742e2bbe4ba400e80d9f191893a84fc
-
SSDEEP
768:zXS6Lnze1gshn5ew/QuBdL/4Ckir4SWeq3HwFdkt+Afs2DBnoLK6KcgMvtD:TSSnze1gsJ55n/4CkOwwF+bho0st
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Drops file in System32 directory 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Email-Worm\Klez.e.exe"C:\Users\Admin\AppData\Local\Temp\Email-Worm\Klez.e.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Winkivz.exeC:\Windows\SysWOW64\Winkivz.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\Winkivz.exeFilesize
81KB
MD5eac73cc99e22dbd507165a9ff43c1918
SHA172f5d6604bd2301760cf949b7051611abda9c6c5
SHA256097084626356497649d55914e6594ebb85923e4aaa9aa0d72892fba59f54d1a8
SHA512bc0625a67cf7fb8fccf154402813cc38c86c07e3fbb20adb1831e4311c85be1860449d3f460f2fac62ce4fc682bd0e30a24047536c86df464a7c6bb9ef2dc57b