Analysis
-
max time kernel
144s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22-11-2024 08:27
General
-
Target
KkKL23yz.exe
-
Size
475KB
-
MD5
ce0c97958ef707811df63fe93dba943a
-
SHA1
2aaa0f40c33a0eccd51a2a26d0a118c7e2797e41
-
SHA256
3cf3e4125f55986bd7bfc6d52890fbd40b2444397ebd798f72b90ba9ed597c57
-
SHA512
f9e1ed8c70b91d4029c78e810bb066f7e97c910909da230e44ece29d97b7c0842701875552af2b134d6689191e1254d6134c139b0e580eafa36c7088fa1443bf
-
SSDEEP
12288:gNrhTLpMP+R+QDCfA832AtBYmz6af0F7Z1QVjSOsJ/c:gthTiP+ffCfB5Lf0F7Z1EDsVc
Malware Config
Signatures
-
UAC bypass 3 TTPs 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 30 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\KkKL23yz.exe"C:\Users\Admin\AppData\Local\Temp\KkKL23yz.exe"1⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- System policy modification
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
349B
MD58033a4b06499face1c5dea87d96e12db
SHA1b032ff606c195592566ecfe55566775f08d75102
SHA25607418d5fdf9090f680bf761debfeed9516a0e67de234d988b393b53e3c105d00
SHA512268d5ba15c1cb6a826d87d54319a90e45bdd918f9bdbc8a1498166c430e0fe958111faae9176281c1ea71411db8659a3f925896214eca53adc205f77177202ae
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
364KB
-
Filesize
364KB
-
Filesize
1.2MB