24a1e148feb1ecf9f30990a10c082da08da2b7ec16c9df522f77acc43a3bdc71 | Triage

Analysis

max time kernel
136s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 15:03

Sharing

Report Analysis Logs

General

Target

Setupprogram_01234.exe
Size

26.1MB
MD5

a7a48de11a050ce9cd002f2cbbbfa7e1
SHA1

80eb821df6f2a71c0612ac8db71d89baf34e50b3
SHA256

a1d1713242387e6a13f0f412fc1ecb581909e150eead5c84daf8787da52aa346
SHA512

7cefaeed44635d16eb155e4b77492c4ba084734969cc0c5372f24b306ffd8b8ed7a71aff3fde0cffe3df89c259933e7936be056b3f14e606890f3fc398cde29f
SSDEEP

786432:rXfKw2NSNWKkIG8ZUXwlD94Ks7EKpsOsPo1jsTvNLaWOC:r8X/KEEKfsAR0R

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
872	Setupprogram_01234.exe
872	Setupprogram_01234.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	872	Setupprogram_01234.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
872	Setupprogram_01234.exe

C:\Users\Admin\AppData\Local\Temp\Setupprogram_01234.exe
"C:\Users\Admin\AppData\Local\Temp\Setupprogram_01234.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:872

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads