Analysis
-
max time kernel
1800s -
max time network
1171s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
21-05-2024 19:12
General
-
Target
KAKEInjector.exe
-
Size
13.5MB
-
MD5
f1053bd6f2f6b5dd74d81af9db452f1f
-
SHA1
aa5f30c818dd8196e569c39126e73fb277fdc787
-
SHA256
cfc350c17f9f21c3cee709494d8945190be0d4838698e9161094f53f52c1bd02
-
SHA512
fc7455866addddda8850994b7b14f3dc3ad565f0dc5b6005699ea2a85b849cc3c331039905b19705e42d5194d65cbb9a1d3040be84636db14ff79eea963c204c
-
SSDEEP
393216:LD1rmILrAI3XmgJyL/s2jeUaUXtnseecncyeaGNjRtP7J/2g:n1rTvBXmUwljCebcyfGzl9
Score
7/10
Malware Config
Signatures
-
Themida packer 2 IoCs
Detects Themida, an advanced Windows software protection system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\KAKEInjector.exe"C:\Users\Admin\AppData\Local\Temp\KAKEInjector.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\KAKEInjector.exe" MD5 | find /i /v "md5" | find /i /v "certutil"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\certutil.execertutil -hashfile "C:\Users\Admin\AppData\Local\Temp\KAKEInjector.exe" MD53⤵
-
-
C:\Windows\system32\find.exefind /i /v "md5"3⤵
-
-
C:\Windows\system32\find.exefind /i /v "certutil"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11.2MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
25.4MB
-
Filesize
11.2MB
-
Filesize
25.4MB