0f6d6892fd36483c9208411f8e1b1240093fad3f0cb00da09e178fe9d561775a | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-04-2024 16:56

Sharing

Report Analysis Logs

General

Target

InstallNow_01234.exe
Size

24.0MB
MD5

1e83224998b90fbccb97dcd372957527
SHA1

6be8698c2a43f52eafda7e0f870548e2895ae38b
SHA256

169658247c06cb638624a9ecde33531aed8ebf7ff16080738fcdec4974c397e0
SHA512

9223da98d76cb739229a0d40726b34aa52c78319182c59ff4cbe49699e73527c3c93eed8feff2c97b030979cf39cddbe4c8866823f3a2fec8841395494e3b229
SSDEEP

786432:3OdpT/WbKV55j0lN1EkTqA5a+Nc2sfqVfU:3OhOS0c2PU

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1808	InstallNow_01234.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1808	InstallNow_01234.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1808	InstallNow_01234.exe

C:\Users\Admin\AppData\Local\Temp\InstallNow_01234.exe
"C:\Users\Admin\AppData\Local\Temp\InstallNow_01234.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads