34f043e2eaf76b34e7dc236624a79d62cae1605f759eda1175e4a0cc18512223 | Triage

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 05:02

Sharing

Report Analysis Logs

General

Target

0f726a3b053eb69a2dd7c80152d19ad4.msi
Size

992KB
MD5

0f726a3b053eb69a2dd7c80152d19ad4
SHA1

1b662b3114c8f70d99df04da54493e25b2bed5b9
SHA256

34f043e2eaf76b34e7dc236624a79d62cae1605f759eda1175e4a0cc18512223
SHA512

70ccd5a2e5c442ad7394c7a454acb4676e6a95b8f60910ccb59e6ffc7753a4cf7d771337a2dfcf040f16c3b67283faec64801d734fa0f0b39b55900d5599ed81
SSDEEP

24576:aN88PVH63n6/8xEFE1jwBcgurhwQUvrCnuYpH:g96X6u+g1gXYpH

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2480	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2480	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2480	msiexec.exe
2480	msiexec.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\0f726a3b053eb69a2dd7c80152d19ad4.msi
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2480

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2480-0-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download