175af219509b55f74dda8e625390db42261fca6b425331ca8978144e6d4c2b02 | Triage

Analysis

max time kernel
6s
max time network
5s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
10-04-2024 01:07

Sharing

Report Analysis Logs

General

Target

PSemuX-7z2201-x64_796294.exe
Size

30.0MB
MD5

b6306d17355e249c63ee6e052a5950c6
SHA1

669dacf44d5cc06f4209bdc2faedd9ce1980e5b1
SHA256

175af219509b55f74dda8e625390db42261fca6b425331ca8978144e6d4c2b02
SHA512

197e0a5b42bc761de93237ea8d8bd13a9becf1c394601b8f81b7385d68926f035fd29197efe6d473a40c02679db380e6f0a17fec0c20193cdebb0f3de9821563
SSDEEP

786432:nrrrr8UhqpakPyTGhTi/btOWVMpmyovt23XuyeK2:MrokqTGhSUWOAyovaHen

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4056	PSemuX-7z2201-x64_796294.exe
4056	PSemuX-7z2201-x64_796294.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4056	PSemuX-7z2201-x64_796294.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4056	PSemuX-7z2201-x64_796294.exe

C:\Users\Admin\AppData\Local\Temp\PSemuX-7z2201-x64_796294.exe
"C:\Users\Admin\AppData\Local\Temp\PSemuX-7z2201-x64_796294.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads