Analysis
-
max time kernel
117s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
02-10-2024 20:00
General
-
Target
KKMAgent.exe
-
Size
111KB
-
MD5
d96d9d8a9b421ea214c48b577617a182
-
SHA1
2aed04e1a8ec1d478e7d97702c3e88532983a7f8
-
SHA256
2a79b92b28f741d75e810f4b5c93db87282fbda5e7afe4c3745d2704ca431ffe
-
SHA512
c21eb7438bb13575f8ec8055fbc0f07dae98726f912cbca28bad873085a192bad8cad9f8a093e5a440a5d319e9013fc76397705d400465a6dc3b1a72e0402c3c
-
SSDEEP
1536:Z209btw+XFaGpnlVMhrE8Os2VbkbNPMyivE+8GeHTFg9Q4PR2aAiwjGB07dQ4Ia:c07Xk6S+bZyivE+8GezFsQ4Z3KicQ4Ia
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 8 IoCs
-
Suspicious use of SendNotifyMessage 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\KKMAgent.exe"C:\Users\Admin\AppData\Local\Temp\KKMAgent.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
576B
MD5f46bcea2dcb08b6ecc2475786129d19d
SHA1c7438f35429a518345d033878abd1287ab3e21d7
SHA256d8582f6a0e2c1f534525354a2b7c46044278e4486167aa0bbe7f1d1eac62121f
SHA5124fcc11065bde5ed71cfef5b017b31ff30d19845d7924fc0b9c1b32410a8a495125c0559a44aeda930db227836879dfc51208c2bb026b3221e64be825c6d2b714
-
Filesize
725B
MD59b240c42ad2d05e7dd1d839e1a8c3eb2
SHA150e2d4ed7c6b31aef23512b8f06ec9d426ebe436
SHA256cbdb4ffd026bd5b369bb525e5126d52556d38f2bd8100baf0795f899a01d6a60
SHA51200bb59ab8d610976e7c83452998c5bc895259b94ce34d617cb964bd3a11ae251a67be4c727484ddac2bbc91cae77327d3b54aeb07d6c72cd02b7871f8e92c362
-
Filesize
324B
MD5b1dbcf1157c264239ec26b6ebb616c67
SHA19434b62ab9c73ec0a837b85b503c062538a3ff79
SHA25699b76533b7d71cdf2029a9fee066a05870c294f555699bb3732e4d4e614a5d2c
SHA512659e766fc6deb100c07be97c657136cd491d0651a815410951af9473eec929f04260d5b4fc62caa95d38b2720d1c8731426866f776f74a63a9dfbd39def36082
-
Filesize
447B
MD5af96bcee6adb977372e2d229d77fe21c
SHA1861828e79720bf2a3dd055c888805f45ccc026ec
SHA256f69a7c5d2537c06dfd90cc59f308573813a64d1d81d2cf8673ad7b166e3c4c2b
SHA51204d596d3d8bb102d4bdb70b619ebb8bd1df5f754b3524565fe2dd0ed0102f722ce7f90a91c952eccf64531a4e5318731c6312d3f1e8225b72bc081af98eab539
-
Filesize
852B
MD5cef034a929dfd34f481133b0d1568bd2
SHA12cee4a17f1ca42cc5d9bc1b524a7641802d1d07c
SHA2567a1d9e787a1568a609fe25b407121f131151e3440c6809fb483b6b16f340d7d3
SHA512af48c4a37277ef68cbd4fe692971afe5c2e3a7bdf70ab9a5c999ecc96b376525b3d9afb648f682f5ac71c6a4923f6486190bd8ddf84f4aae87fa7036ef64c69a
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
176KB
-
Filesize
6.9MB
-
Filesize
32KB
-
Filesize
712KB
-
Filesize
104KB
-
Filesize
296KB
-
Filesize
280KB
-
Filesize
80KB
-
Filesize
848KB
-
Filesize
136KB
-
Filesize
440KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
6.9MB