Analysis
-
max time kernel
8s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
04/07/2023, 04:45
Static task
static1
Behavioral task
behavioral1
Sample
AppInstaller 11.6.exe
Resource
win7-20230703-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
AppInstaller 11.6.exe
Resource
win10v2004-20230703-en
2 signatures
150 seconds
General
-
Target
AppInstaller 11.6.exe
-
Size
20.0MB
-
MD5
bc4915dd472d41ab5aa5bb7d64a6be86
-
SHA1
f5892a4ea271ed22c391efe41473211165db2b70
-
SHA256
1c7dfa1e4b1ab71105b75c8a75af52317e901f7160e28765303da7f7988fa8da
-
SHA512
4a7901e2018c800b86761a660a77a88b99189b0bd50875eb41363fc24649033687d13d36bafb622ca049db1846635a20034944a8c9b71291bd87e6006a7b0118
-
SSDEEP
393216:2kJvkICSBwFjNiiFz62aBUyx7Whgt6sS1RT01snRzP9pzXo:ZJsICS8JrzhaBLJWiUsEB01snt9pzX
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: AppInstaller 11.6.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3880 AppInstaller 11.6.exe 3880 AppInstaller 11.6.exe 3880 AppInstaller 11.6.exe 3880 AppInstaller 11.6.exe 3880 AppInstaller 11.6.exe 3880 AppInstaller 11.6.exe 3880 AppInstaller 11.6.exe 3880 AppInstaller 11.6.exe