Analysis
-
max time kernel
25s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
22-11-2024 08:17
General
-
Target
KkKL23yz.exe
-
Size
475KB
-
MD5
ce0c97958ef707811df63fe93dba943a
-
SHA1
2aaa0f40c33a0eccd51a2a26d0a118c7e2797e41
-
SHA256
3cf3e4125f55986bd7bfc6d52890fbd40b2444397ebd798f72b90ba9ed597c57
-
SHA512
f9e1ed8c70b91d4029c78e810bb066f7e97c910909da230e44ece29d97b7c0842701875552af2b134d6689191e1254d6134c139b0e580eafa36c7088fa1443bf
-
SSDEEP
12288:gNrhTLpMP+R+QDCfA832AtBYmz6af0F7Z1QVjSOsJ/c:gthTiP+ffCfB5Lf0F7Z1EDsVc
Malware Config
Signatures
-
UAC bypass 3 TTPs 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\KkKL23yz.exe"C:\Users\Admin\AppData\Local\Temp\KkKL23yz.exe"1⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- System policy modification
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
1.2MB