3d14045e08c93efc3c34122ffb16d51d7fb7e2c996fd8a64286c0cea4881afff | Triage

Resubmissions

18-11-2023 11:30

231118-nl8h4seg9s 7

18-11-2023 11:29

231118-nlqy3adh46 7

17-11-2023 18:33

231117-w66t1sce73 7

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
17-11-2023 18:33

Sharing

Report Analysis Logs

General

Target

formulario -108761.msi
Size

2.2MB
MD5

0f2d05260d98855af09f1dcbb90ede93
SHA1

61eee2e226a46dbcc63b4668fee56f8b27c57a4f
SHA256

6c18f4ce0d3f5e39d28139b22acafff5f4d421dee840acc3871a83421d8ffc21
SHA512

5a317ab1d55af3f23c1ea9b62ba04d3c7520d18eb6e9e1e4c6b87f6d765d50b898e8a99d620d992e3b25178375ab59ee1e067b64d1bdd52b42af343c1391b729
SSDEEP

49152:4lhvk+q4E5q8g73wn43+iFE/nK6UWQvuzK4Ysi:3+XCn3iZ6UW0Ll

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

msiexec.exe

description pid process

Token: SeShutdownPrivilege 4104 msiexec.exe
Token: SeIncreaseQuotaPrivilege 4104 msiexec.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

msiexec.exe

pid process

4104 msiexec.exe
4104 msiexec.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\payload.msi
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4104

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads