a4e10fe06bb5202f8b07f3264adf23bd3d3825e214fef6b096adbe5d6a530e91

Analysis

max time kernel
146s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
21/07/2024, 21:59

Target

KKjie.exe
Size

181KB
MD5

67e89640d9ed9f8c7bc8a219e42a033f
SHA1

d2e5402fca8646e7b09a26e2866c0ab013c113f7
SHA256

d41dbe9ba5366a7701d9b45ab18a993476eedf34775e47a34fcc52f7ce690a3e
SHA512

c4833e39457540e18c25320c12148c2532f685d706eace42f04838f815c210fa7428ce90cf64397d5e7fb9939e91e1af400db6bc46138b979e06cb139627fe92
SSDEEP

3072:iZMJnTeM4cJJliRR7mH4QvaNCj3Vf7pfTLR/bNTubouYKux+PlXEcWxGAc+KTWYu:6eTeM/cRcH4QiNCjl75d1ubAV8ZWFcLM

Score

7^/10

Executes dropped EXE 1 IoCs

pid	Process
2148	KKjie_safe.exe

Loads dropped DLL 7 IoCs

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2148	KKjie_safe.exe
Token: SeIncBasePriorityPrivilege	2148	KKjie_safe.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2148	KKjie_safe.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 580 wrote to memory of 2148	580	KKjie.exe	30
PID 580 wrote to memory of 2148	580	KKjie.exe	30
PID 580 wrote to memory of 2148	580	KKjie.exe	30
PID 580 wrote to memory of 2148	580	KKjie.exe	30
PID 580 wrote to memory of 2148	580	KKjie.exe	30
PID 580 wrote to memory of 2148	580	KKjie.exe	30
PID 580 wrote to memory of 2148	580	KKjie.exe	30

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\nsoADDD.tmp\Banner.dll

Filesize
4KB

MD5
258dd27107feabb1969908a9387a79d7

SHA1
80f85b610e57d6ab07988cdae60c83300bef6a8f

SHA256
f4fc1344c32ad1c075067c6abfd168a1815dbc6f97103e83e7e8e708230889d2

SHA512
e2df96efab3ea794e75b6a3c9038601c7abd956b41fbbcc4fb60013e0d319d9978f539dc0f944778d05d2e384192d918e06dce8bf76f355d0cbfd142313b9a2b

Download Submit
\Users\Admin\AppData\Local\Temp\KKjie_safe.exe

Filesize
377KB

MD5
ac68dffc261c8625c5f2a94364ca10c9

SHA1
d5873084dcf4a74631c9abe82f1afc3ba1216464

SHA256
16694059e7073810021960bb709f814f42490a5219f7970fa201b3d8ef259db7

SHA512
d7ab568b6906d6d0ff924da59983cb8def9cfbb76ed93371e815c26f2f59f3a33edef0e65419bdaee02bcf85efc7a5b856949de5c26afab689aeada50a705b59

Download Submit
\Users\Admin\AppData\Local\Temp\nsoADDD.tmp\FindProcDLL.dll

Filesize
3KB

MD5
8614c450637267afacad1645e23ba24a

SHA1
e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2

SHA256
0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758

SHA512
af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b

Download Submit
memory/580-8-0x0000000010000000-0x0000000010003000-memory.dmp

Filesize
12KB

Download
memory/2148-28-0x0000000000350000-0x000000000035D000-memory.dmp

Filesize
52KB

Download