3de0723c12d340b6995a6fa94bee75a83fb35f83b1efefe3192c7b6d6e80a250 | Triage

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
19-11-2023 02:13

Sharing

Report Analysis Logs

General

Target

formulario -108761.msi
Size

2.2MB
MD5

0f2d05260d98855af09f1dcbb90ede93
SHA1

61eee2e226a46dbcc63b4668fee56f8b27c57a4f
SHA256

6c18f4ce0d3f5e39d28139b22acafff5f4d421dee840acc3871a83421d8ffc21
SHA512

5a317ab1d55af3f23c1ea9b62ba04d3c7520d18eb6e9e1e4c6b87f6d765d50b898e8a99d620d992e3b25178375ab59ee1e067b64d1bdd52b42af343c1391b729
SSDEEP

49152:4lhvk+q4E5q8g73wn43+iFE/nK6UWQvuzK4Ysi:3+XCn3iZ6UW0Ll

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2352	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2352	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2352	msiexec.exe
2352	msiexec.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\payload.msi
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2352

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2352-0-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download