1d78d380de98a9a2d38af20b324cd87e83df1da2419b0f1990dc99490ed9c0ef | Triage

Analysis

max time kernel
139s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 18:09

Sharing

Report Analysis Logs

General

Target

InstallNow_01234.exe
Size

24.0MB
MD5

9b86ef261869ac2551a45625d092d6d5
SHA1

5a0ae67084aab8d66c4d41cc987661b83a791e09
SHA256

9fcc804b5f6da1355d64c632a70ef86a830234b7bef6867076cae540d03e1d1c
SHA512

00a86adaa29ac1e2e556b87aa2051705fbed76838450a7c9af894211e281ae91f07c282a743a0c8d9f70654fa9738eff2dfac62359c2d66d56c243a03d83ffbc
SSDEEP

786432:XOdpT/WbKV55j0lN1EkTqA5a+Nc2sfqVfO:XOhOS0c2PO

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1900	InstallNow_01234.exe
1900	InstallNow_01234.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1900	InstallNow_01234.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1900	InstallNow_01234.exe

C:\Users\Admin\AppData\Local\Temp\InstallNow_01234.exe
"C:\Users\Admin\AppData\Local\Temp\InstallNow_01234.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3704 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:652

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads