0c55f02a269e7b924191b31261228133e1c211116fdf6025dd247c4213478224 | Triage

Analysis

max time kernel
144s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 17:55

Sharing

Report Analysis Logs

General

Target

InstallNow_01234.exe
Size

24.0MB
MD5

af6b6f42ee54eef9ede87f8c0172671d
SHA1

24e3fdf1cbf31d679df0924b59ad6e2eaf32bcb1
SHA256

ace1a42cb2c8a891350663381b528768822358b4c95995b622d7b1eb4754708c
SHA512

502b76cd783db1f9c06af217c796f3413bfc5fd2a538cba1f34ff4aa65683972a6f11240f16996ee8a1e2912855367dff6162ed1c941a385c72a3ac251e9fe01
SSDEEP

786432:3OdpT/WbKV55j0lN1EkTqA5a+Nc2sfqVf:3OhOS0c2P

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1900	InstallNow_01234.exe
1900	InstallNow_01234.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1900	InstallNow_01234.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1900	InstallNow_01234.exe

C:\Users\Admin\AppData\Local\Temp\InstallNow_01234.exe
"C:\Users\Admin\AppData\Local\Temp\InstallNow_01234.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1900

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads