2c00a1ae6e31c8e70dcf68c3d888f7f08a19cb0433356b525540a459bc8ab4e0 | Triage

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 17:16

Sharing

Report Analysis Logs

General

Target

InstallNow_01234.exe
Size

24.0MB
MD5

51aa2e5354fbab31166c783100c7fb56
SHA1

bf71afe7dd17d7e20565af17069e9c3aa0a59d3f
SHA256

909705b45c90047003e16076eee3ce63d2809eaacb2fb0429c0950e3f21ea619
SHA512

478aa769e43731822663f4a14b4ba1e44a7b57cae8198949e052c2b9e634f767341af1580594e0aa286b8a8f5c3abed2877db61231191f8063ad0c26597ab570
SSDEEP

786432:sOdpT/WbKV55j0lN1EkTqA5a+Nc2sfqVfO:sOhOS0c2PO

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5016	InstallNow_01234.exe
5016	InstallNow_01234.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5016	InstallNow_01234.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5016	InstallNow_01234.exe

C:\Users\Admin\AppData\Local\Temp\InstallNow_01234.exe
"C:\Users\Admin\AppData\Local\Temp\InstallNow_01234.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads