Analysis
-
max time kernel
120s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
15-03-2024 20:16
General
-
Target
SetupShim.exe
-
Size
134KB
-
MD5
6d683c23bab272e6aa3b41167d3cafd3
-
SHA1
1738b9242401846d40be6814d08d6d969aa15394
-
SHA256
7abea50aecce1c28c6312c6554dce3d72165b902241fa3a2b6d3fc09117b57ef
-
SHA512
01818bde9490336914d2190cb9c98ce630fb3eb38634c5d231ba027e6e8b4f0d8fc1554c1094bcf669bdd01e02a98d558c7f73f3ea38b391fab0d3d608d9269b
-
SSDEEP
3072:CIxhlOHEbzW5vMlS6NUX1qo4BE/9ugl+IHhrE90JGsfTyIBvzoTEVhY9HqqXf5I:sHEbzWajik9BEJBr5fTPjwKKxI
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SetupShim.exe"C:\Users\Admin\AppData\Local\Temp\SetupShim.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SetupFrontEnd.exe"SetupFrontEnd.exe" "C:\Users\Admin\AppData\Local\Temp\SetupShim.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
581B
MD54747853c42c370c48fc71e4c7169f474
SHA14a19881efb5a5c549294e9d995e7d085ca7b7975
SHA2568f3df537a3113c6a8e7ec616b945dd4fc54f4fa744a1611883afac391539ec31
SHA5122e3e7c9f1a148461dc3341cb792e6b9f9f7fb4d356d4929c66f8ca8762caa177da970731d58e3e5c4d23c83c39fa303f43c582b2b5914ec823bffa9810e3076b
-
Filesize
104KB
-
Filesize
480KB
-
Filesize
960KB
-
Filesize
9.9MB
-
Filesize
2.0MB
-
Filesize
608KB
-
Filesize
2.0MB
-
Filesize
1008KB
-
Filesize
1.6MB
-
Filesize
4KB
-
Filesize
128KB
-
Filesize
32KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB