6c430e9e392cb1811204eeef047bf39fd93f5e6b557a9070ddb9a04684bed350 | Triage

Analysis

max time kernel
138s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 15:48

Sharing

Report Analysis Logs

General

Target

Setupprogram_01234.exe
Size

26.1MB
MD5

1a2f3e4e116765c58b67fec5d234a9fd
SHA1

2bd1db6bce026af6809aaba44f89172b93b1ee4c
SHA256

f93228ebf9b4cc8495f20c1ec646acdb6b35d877e334c6b41a3fff764a574b58
SHA512

448be4c63e9cc6bde1133c0496101fd905718ea911cf2be56b72aead18462dbeda7ea48863771f7391e243cbce8400bf2f502a613bf22e32a804c9f6342a0ecf
SSDEEP

786432:JXfKw2NSNWKkIG8ZUXwlD94Ks7EKpsOsPo1jsTvNLaWOw:J8X/KEEKfsAR0n

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4640	Setupprogram_01234.exe
4640	Setupprogram_01234.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4640	Setupprogram_01234.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4640	Setupprogram_01234.exe

C:\Users\Admin\AppData\Local\Temp\Setupprogram_01234.exe
"C:\Users\Admin\AppData\Local\Temp\Setupprogram_01234.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4640

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads