d86abf959f69474d575c5205893ddf68baafe44a51ca3f5127e61438569cca61 | Triage

Analysis

max time kernel
140s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 15:23

Sharing

Report Analysis Logs

General

Target

Setupprogram_01234.exe
Size

26.0MB
MD5

fe75bc6464d642d769299008734cfb90
SHA1

e8d150f60ccc22613e167b03915d310be5ab0514
SHA256

dd982e149746c91a6860851bfe4d692ca360b40a51e3099300f4fa655350ecfa
SHA512

068716e75f551b43bf6b19a7adfeb1809bb9ca89dd5a135e66ab8d5a8d4e4a0e4db0c809a660fed572c3281e2f69c7e26e8d09bc532716fb616b0c14f593ef1e
SSDEEP

786432:1XfKw2NSNWKkIG8ZUXwlD94Ks7EKpsOsPo1jsTvNLaWO5:18X/KEEKfsAR0K

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4708	Setupprogram_01234.exe
4708	Setupprogram_01234.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4708	Setupprogram_01234.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4708	Setupprogram_01234.exe

C:\Users\Admin\AppData\Local\Temp\Setupprogram_01234.exe
"C:\Users\Admin\AppData\Local\Temp\Setupprogram_01234.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads