hxxps://dl[.]filehorse[.]com/win/developer-tools/tortoisesvn-64/TortoiseSVN-1[.]14[.]5[.]29465-x64-svn-1[.]14[.]2[.]msi?st\=25PKDOX0pA6D9bpUBUvMRw&e\=1691059066&fn\=TortoiseSVN-1[.]14[.]5[.]29465-x64-svn-1[.]14[.]2[.]msi | Triage

Analysis

max time kernel
99s
max time network
109s
platform
windows10-1703_x64
resource
win10-20230703-en
resource tags

arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
submitted
03-08-2023 04:28

Sharing

Report Analysis Logs

General

Target

https://dl.filehorse.com/win/developer-tools/tortoisesvn-64/TortoiseSVN-1.14.5.29465-x64-svn-1.14.2.msi?st\=25PKDOX0pA6D9bpUBUvMRw&e\=1691059066&fn\=TortoiseSVN-1.14.5.29465-x64-svn-1.14.2.msi

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
2	4988	msiexec.exe

Unknown use of msiexec with remote resource 1 IoCs

pid	Process
4988	msiexec.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4988	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4988	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4988	msiexec.exe
4988	msiexec.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I https://dl.filehorse.com/win/developer-tools/tortoisesvn-64/TortoiseSVN-1.14.5.29465-x64-svn-1.14.2.msi?st\=25PKDOX0pA6D9bpUBUvMRw&e\=1691059066&fn\=TortoiseSVN-1.14.5.29465-x64-svn-1.14.2.msi
1⤵
- Blocklisted process makes network request
- Unknown use of msiexec with remote resource
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4988

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads