50ea6c698e72e13b8132b66bbca9479b7f4815ebb2f8adb3ca1cfec79523107e | Triage

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/02/2024, 23:32

Sharing

Report Analysis Logs

General

Target

fvgbm0216001.msi
Size

17B
MD5

c965aa525ae4cfbc3b45c6b7e9271a59
SHA1

3a84d4c1c9277173b530263107af4caf1f61213f
SHA256

50ea6c698e72e13b8132b66bbca9479b7f4815ebb2f8adb3ca1cfec79523107e
SHA512

bfddf9f5cb766b20f564b6a94048d1779431794b02cbd0993f4f3554b46b1a4e17bd3def58200da665fd991d1480b22992181ef543413d8013a19889484c3f1c

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2680	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2680	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2680	msiexec.exe
2680	msiexec.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\fvgbm0216001.msi
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2680-0-0x0000000001EF0000-0x0000000001EF1000-memory.dmp

Filesize
4KB

Download