50ea6c698e72e13b8132b66bbca9479b7f4815ebb2f8adb3ca1cfec79523107e | Triage

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 23:32

Sharing

Report Analysis Logs

General

Target

fvgbm0216001.msi
Size

17B
MD5

c965aa525ae4cfbc3b45c6b7e9271a59
SHA1

3a84d4c1c9277173b530263107af4caf1f61213f
SHA256

50ea6c698e72e13b8132b66bbca9479b7f4815ebb2f8adb3ca1cfec79523107e
SHA512

bfddf9f5cb766b20f564b6a94048d1779431794b02cbd0993f4f3554b46b1a4e17bd3def58200da665fd991d1480b22992181ef543413d8013a19889484c3f1c

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1092	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1092	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1092	msiexec.exe
1092	msiexec.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\fvgbm0216001.msi
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads