6f8b540361c734dd1b08c829483cc31674ad5dd38909e6e9692bc95f2dfaf24e

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/07/2024, 18:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$TEMP/KanKan_1020.exe
Size

2.2MB
MD5

56e5f4611a542ca833721569749cb291
SHA1

50e5813d6b78b32392e39c868ace99f46c829cdc
SHA256

f984adb81a9bb0945692c0377d770ece26c09e63e138c1843127d7993cc202a1
SHA512

3963405c67ef80e2c8bd33e4cd2156a15d35700011b5147506c9f96af813cfbf839c7668e031f9813eb1201a67ed65c7ed9101dd5c23da3b5e6e7bc88cca6e64
SSDEEP

49152:vcdZYkrOtorhQQUw4pyyp/d8XaaXWe4P+ynePQPX:vcfOtotQ++yyp/d8XaaXKneIP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2584	KanKan_1020.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2584	KanKan_1020.exe

C:\Users\Admin\AppData\Local\Temp\$TEMP\KanKan_1020.exe
"C:\Users\Admin\AppData\Local\Temp\$TEMP\KanKan_1020.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsy8FA3.tmp\meituWel.ini

Filesize
211B

MD5
79ddccb9ddb0de7d5dc1427388e5e033

SHA1
136bf43be38492ba583b70056e37b7fc68dbe404

SHA256
7ef275d0b94408eee92ae08b5e5f426ac84cf85979424d2443a92ba020c7f3c9

SHA512
ba824b591632816ea9caf8473b667c60a8fa2d2d81a21a3b6c463f5ea50e3b9a2004c5075933918fb37149e6afe102f991eccc10da9680ec405677753ff596a7

Download Submit
\Users\Admin\AppData\Local\Temp\nsy8FA3.tmp\InstallOptions.dll

Filesize
14KB

MD5
32aa6334fc543e70ef0f792bb9a0c45a

SHA1
54be1f5004f7e5afe7c9ba160495076ea2a4d60c

SHA256
610e54bcfc2831d4f9d7030ceb16d35ee33006403d842f01b6e75bebea0083e2

SHA512
ac92116821a032de8df64bf9aea9c6ba4040467eebaa4e028c2bf031f1c81bb69531288b9d89d951b952fe0b4ecccade874a5ae76d04db8b4dee2d13c486f9ae

Download Submit