3db99bc3bcc354e3780950d947c1d251b97683c2e0d57e75a474ef253da51758 | Triage

Analysis

max time kernel
142s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 17:53

Sharing

Report Analysis Logs

General

Target

InstallNow_01234.exe
Size

24.0MB
MD5

d7c97a17cba88cfad40e6b6865d36b69
SHA1

27874d972274cbf7ead81a5d72409f230d4c2efb
SHA256

3ea7307cb1f9474766bb2c94e0cfe64c767683b4aac4e2af13aa081cafa532a8
SHA512

553c648df31feaa06d30ef4e2e2d23e67fb2559eac80c40e76bb366f19cfc87d90b8efb3a047d653494b34424bd438235781a4e8ca232e9530f66232460a40ba
SSDEEP

786432:gOdpT/WbKV55j0lN1EkTqA5a+Nc2sfqVfE:gOhOS0c2PE

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2348	InstallNow_01234.exe
2348	InstallNow_01234.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2348	InstallNow_01234.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2348	InstallNow_01234.exe

C:\Users\Admin\AppData\Local\Temp\InstallNow_01234.exe
"C:\Users\Admin\AppData\Local\Temp\InstallNow_01234.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4072 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:4552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads