4575e9810eb141032f5d72c52be516b6b9b6a3f0fec156b275e1c3f7e3a809ae | Triage

Analysis

max time kernel
112s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 16:01

Sharing

Report Analysis Logs

General

Target

Setups_02028.exe
Size

24.0MB
MD5

b2a7db84017026eba92868a082f5915a
SHA1

c4c6733635e505bb11d2f9c7fb64de9ac3759920
SHA256

47dede6fd466560c1a0f56c7228e906d8b737abc860ba9416cd35a732c2f82a4
SHA512

3c70e50e4b23439f6c0718f4fabc75a992f3de86e88ba0a585b78315e0a0b8dbdff3b043741ad0b4a9c10638c7d4066aacfe98bc4bc7378275a09ed25ceeb311
SSDEEP

786432:RnxHs2AVMk9UbcUUJy5+vNQ1QdGP0SBpkp7h4YJNYWHaUqtYUd1EUHsv9by:xyhXpa7ZdbMI

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1776	Setups_02028.exe
1776	Setups_02028.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1776	Setups_02028.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1776	Setups_02028.exe

C:\Users\Admin\AppData\Local\Temp\Setups_02028.exe
"C:\Users\Admin\AppData\Local\Temp\Setups_02028.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3784 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8
1⤵
PID:3156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads