Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
-
submitted
19-11-2023 02:13
General
-
Target
formulario -108761.msi
-
Size
2.2MB
-
MD5
0f2d05260d98855af09f1dcbb90ede93
-
SHA1
61eee2e226a46dbcc63b4668fee56f8b27c57a4f
-
SHA256
6c18f4ce0d3f5e39d28139b22acafff5f4d421dee840acc3871a83421d8ffc21
-
SHA512
5a317ab1d55af3f23c1ea9b62ba04d3c7520d18eb6e9e1e4c6b87f6d765d50b898e8a99d620d992e3b25178375ab59ee1e067b64d1bdd52b42af343c1391b729
-
SSDEEP
49152:4lhvk+q4E5q8g73wn43+iFE/nK6UWQvuzK4Ysi:3+XCn3iZ6UW0Ll
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\payload.msi1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB