4e9d20fe0cb8292b6b2f4fd20ad98a77294542b43e1742a022ced1d2f9809505

Analysis

max time kernel
135s
max time network
136s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
29/06/2024, 18:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

__MACOSX/._setup.msi
Size

176B
MD5

bcc9aea5548d27e3067b68b4b468f8c1
SHA1

44de4efd906b40f9cf54074c7563ef5cb2efb1d3
SHA256

cde7eb104c47a8dc05f6f88b716cf5e93da897df6908cf6b1d1f64aff325f35d
SHA512

8b9667440d2be116ce3f4e0bac2e0e4b69375786cc59f1b83fc5a164494e163cc9c32f86e1a4a0b70e8e9ab149150cc0215a9f00a152962b99fa26aff1e315e6

Score

3^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Installer Packages 1 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

pid	Process
2100	msiexec.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2100	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2100	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2100	msiexec.exe
2100	msiexec.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\__MACOSX\._setup.msi
1⤵
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads