b574565d37846e943f495907b43c6b9f3eb6b60615ae91cb5a105e3ccb78a011 | Triage

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 18:15

Sharing

Report Analysis Logs

General

Target

InstallNow_01234.exe
Size

24.0MB
MD5

f3ea63c3508a8e37baeaf8582e72b955
SHA1

d1b7be4198fb003d324119d63f3acafce35bae01
SHA256

9af61556a045bd24f53deb6acef08487b98162d83e33fe0084bf4b9fd93ff1da
SHA512

9d7414b3b2765e3388459fdc8564a62e3a43cfc4a1903e88a934e741d51878df5ea23828ecb835ad36f903e792f9b85ee2c1d4e53046f4383891d9ddec39ac8e
SSDEEP

786432:gOdpT/WbKV55j0lN1EkTqA5a+Nc2sfqVfi:gOhOS0c2Pi

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1808	InstallNow_01234.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1808	InstallNow_01234.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1808	InstallNow_01234.exe

C:\Users\Admin\AppData\Local\Temp\InstallNow_01234.exe
"C:\Users\Admin\AppData\Local\Temp\InstallNow_01234.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads