f80bc12ffee2539f5827757dc8052decbbd795e604a58d8c83ae357cf5055151 | Triage

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
19/11/2024, 14:17

Sharing

Report Analysis Logs

General

Target

kcinst.exe
Size

117KB
MD5

71f004189b77c2f668c30ec67b876e51
SHA1

425ccabbb9f238f9cb9b3f10546894d57d16a164
SHA256

2aac0a7e1295e3307b1b7c4d2dc9ea5c84245df02981cde43e88fe50529fb38b
SHA512

daff0c7a21a773851f0963aff29eb3aee5832a73764ccba87ab4eb6d79752485a35a41ad19621dda97058c679b7a7258b45e402299d4a3a0f060419aaea9ec2f
SSDEEP

3072:cG6nTqLzvA2tx/TfMSKF2QtL8MLjEq6x0js:c3M93zM7a8ER

Score

1^/10

Malware Config

Signatures

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\kcinst.exe
"C:\Users\Admin\AppData\Local\Temp\kcinst.exe"
1⤵
PID:2472

C:\Windows\system32\taskeng.exe
taskeng.exe {4B9202A5-ED3C-4AFD-BC67-4AA4D82487E0} S-1-5-21-3692679935-4019334568-335155002-1000:BCXRJFKE\Admin:Interactive:[1]
1⤵
PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads