34f043e2eaf76b34e7dc236624a79d62cae1605f759eda1175e4a0cc18512223 | Triage

Analysis

max time kernel
144s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 05:02

Sharing

Report Analysis Logs

General

Target

0f726a3b053eb69a2dd7c80152d19ad4.msi
Size

992KB
MD5

0f726a3b053eb69a2dd7c80152d19ad4
SHA1

1b662b3114c8f70d99df04da54493e25b2bed5b9
SHA256

34f043e2eaf76b34e7dc236624a79d62cae1605f759eda1175e4a0cc18512223
SHA512

70ccd5a2e5c442ad7394c7a454acb4676e6a95b8f60910ccb59e6ffc7753a4cf7d771337a2dfcf040f16c3b67283faec64801d734fa0f0b39b55900d5599ed81
SSDEEP

24576:aN88PVH63n6/8xEFE1jwBcgurhwQUvrCnuYpH:g96X6u+g1gXYpH

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3960	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3960	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3960	msiexec.exe
3960	msiexec.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\0f726a3b053eb69a2dd7c80152d19ad4.msi
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads