DESKTOP-LURLNN8
Threats /
pgp_install.exe
overview
explore
timeline
Actions
Threat Status:
Not Mitigated
AI Confidence Level:
suspicious
Analyst Verdict:
Undefined
Incident Status:
Unresolved
No actions taken yet
Identified Time
Apr 12, 2024 00:55:43
Reporting Time
Apr 12, 2024 00:55:44
NETWORK HISTORY
First seen
Apr 09, 2024 21:29:58
Last seen
Apr 12, 2024 00:55:44
14 times
on
2 endpoints
1 Account / 2 Sites / 2 Groups
Find this hash on Deep Visibility
Hunt Now
THREAT
FILE
NAME
pgp_install.exe
Copy Details
Download Threat File
Path
\Device\HarddiskVolume1\Users\Administrator\Downloads\pgp_install.exe
Command Line Arguments
"C:\Users\Administrator\Downloads\pgp_install.exe"
Process User
EC2AMAZ-HS2QTB1\Administrator
Publisher Name
N/A
Signer Identity
N/A
Signature Verification
NotSigned
Originating Process
explorer.exe
SHA1
93e726dc3582593af16492843fc256e133ba38b0
Initiated By
Agent Policy
Engine
Behavioral AI
Detection type
Dynamic
Classification
Malware
File Size
175.00 KB
Storyline
8B3F68DD1E8E3313
Threat Id
1926602743647781647
ENDPOINT
CLOUD
Real-time data about the endpoint:
EC2AMAZ-HS2QTB1
TIARC, Inc. / tiarc / Default Group
Console Connectivity
Online
Full Disk Scan
Completed at Apr 12, 2024 01:02:42
Pending reboot
No
Number of not mitigated threats
0
Network Status
Connected
At detection time:
Scope
TIARC, Inc. / tiarc / Default Group
OS Version
Windows Server 2022 Datacenter 20348
Agent Version
23.4.2.216
Policy
detect
Logged In User
N/A
UUID
bdb0e8f8a3e4484f8723f611449b8e77
Domain
WORKGROUP
IP v4 Address
10.0.7.99
IP v6 Address
fe80::6367:caa0:e520:9cb9
Console Visible IP Address
34.208.170.80
Subscription Time
Apr 12, 2024 00:45:30
Threat Indicators
(4)
Notes
xdr
Injection
Unusual code injection into a sensitive process to a remote process
MITRE : Defense Evasion
[
T1055
]
MITRE : Privilege Escalation
[
T1055
]
Code injection to a remote process
MITRE : Defense Evasion
[
T1055
]
[
T1055.002
]
MITRE : Privilege Escalation
[
T1055
]
[
T1055.002
]
Evasion
Process executed shellcode in another process
MITRE : Defense Evasion
[
T1055
]
[
T1055.002
]
MITRE : Privilege Escalation
[
T1055
]
[
T1055.002
]
Persistence
Application registered itself to become persistent via scheduled task
MITRE : Persistence
[
T1053.005
]
MITRE : Execution
[
T1053.005
]
MITRE : Privilege Escalation
[
T1053.005
]
DEFAULT VALUE