SUSPICIOUS — ntoskrnl.exe
SUSPICIOUS — ntoskrnl.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (55/100). 1 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
d90c69cfa925d42037ef1cdba3ff5b3f13cc14e16060938073b97e396fdde2f2 - SHA-1:
df530b91eb9687d5541dcee03c55c352a9fb6acc - MD5:
c925d336cd7266a7e7d340059b14e725 - imphash:
952fb56a38c2d2b7d1be23ebb342f29a - ssdeep:
196608:UR1Mlgruy8EzftgXmapNhJ1lI2CNM2I7UxTayT:I1qgB8EztgX/TCV - TLSH:
T12E6D8E6585273221E0BAFC94BC6189DDC023F26CA1718E4D2707DC6E94E9E37DAE12D4 - Submitted as: ntoskrnl.exe
- File type: pe · Size: 13104632 bytes
- Verdict: suspicious (55/100)
Detections (1 of 56 engines)
- capa (capabilities): capability:credential-access
MITRE ATT&CK
Why this verdict
The suspicious score of 55/100 is the fusion of 2 weighted signals:
- access stored credentials (rule
access stored credentials) - capa signal, weight 0.50, confidence 0.80 - capa (capabilities) flagged capability:credential-access (rule
capability:credential-access) - engine signal, weight 0.35, confidence 0.70
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
- http://www.microsoft.com/windows0
- https://www.windows.com/stopcode
Embedded domains
- www.microsoft.com
- crl.microsoft.com
- www.windows.com
File paths
- C:\pagefile.sys
- C:\Windows
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report