7b9fe823f82af1d9facc30768efe947b6b9863cdc414d0de7747e612f0ddbe2a | Triage

Analysis

max time kernel
112s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 15:56

Sharing

Report Analysis Logs

General

Target

App_02029.exe
Size

26.1MB
MD5

cf366e9b7c76f4f8dc15d5ae3adef332
SHA1

b76b53a6a4de94f9cc17cb376a82554b5ae9f813
SHA256

67939a5f1e69cb4f1c7b0c052e1b40253e9e46a9f6a1e94000e5a7929aaed3e6
SHA512

198086ed67885b87c799a4f4067cfdc4be616aad4f5f7fee791368f898ca7b16ebee983671b9f19ed04218277b178ee9b359bb86cfee2ae89eee92319e5a0162
SSDEEP

786432:xmqFdv31wrLC8vQY7EKpsOsPo1jsTvNLaWOw:RgEKfsAR0X

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4300	App_02029.exe
4300	App_02029.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4300	App_02029.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4300	App_02029.exe

C:\Users\Admin\AppData\Local\Temp\App_02029.exe
"C:\Users\Admin\AppData\Local\Temp\App_02029.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3932 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8
1⤵
PID:1196

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads