d1b9e3a7e548eedbbe122287b8589f1eb42023f77e8f7d6856dc1644f038f617 | Triage

Analysis

max time kernel
92s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29-03-2024 05:43

Sharing

Report Analysis Logs

General

Target

tcmd1103x64.exe
Size

6.2MB
MD5

2bc1009b18915f773803aa5ce0c8c5aa
SHA1

e7ce87c81da0ed4eda263c0bc1a6e87ea2f5b6ec
SHA256

d1b9e3a7e548eedbbe122287b8589f1eb42023f77e8f7d6856dc1644f038f617
SHA512

cecff47bc915b4ca56ca6e524a78835adbe1d14d822f4e1fb7746fc9f5aeaa6ec50a4f2607b7b9a587165d30bce025395421a70832dfd08514fe44531d8d997c
SSDEEP

196608:fuoi4HImqMBbtrrxzf04DC4CycKkPpOMLvo:Gcz3uZlxOMk

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3052	tcmd1103x64.exe
3052	tcmd1103x64.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3052	tcmd1103x64.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3052	tcmd1103x64.exe

C:\Users\Admin\AppData\Local\Temp\tcmd1103x64.exe
"C:\Users\Admin\AppData\Local\Temp\tcmd1103x64.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3052

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads