Analysis
-
max time kernel
67s -
max time network
54s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
27/04/2024, 20:29
General
-
Target
Get-started_806403.exe
-
Size
22.6MB
-
MD5
08ea1813d6b205c446e6ae655c4e6715
-
SHA1
76f4d2af1c04ec157fc8a270da5980ee6bcb5def
-
SHA256
12288224d26607b30d026a32faf2ac7b49fc32acc8950eeaf60b933f2e39f48f
-
SHA512
a900bd2c4f33dc915fa27911620fafad76139da7c3d58ce3f40b7c2a1dcb11e893dc5b0cde7a74f93d6f1f5dc2ff949141b20f9c7d09a8bc3b9517f861c361e1
-
SSDEEP
393216:m8bMktzgHgxUv/1n6b121UnyuecRZndSk9bGWqCgu5op+wiCYCr2sfqisfU:m8bMkM1n6b121UnyuLEkTqA5a+Nc2sf6
Score
4/10
Malware Config
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Get-started_806403.exe"C:\Users\Admin\AppData\Local\Temp\Get-started_806403.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow