b0baf071692d63267aaf41bd3db933826523b59e8fca49655e1656ce0c656c71

Resubmissions

30-11-2023 19:32

28-06-2021 11:05

max time kernel
1746s
max time network
1177s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2023 19:32

Target

31.214.157.40_#[email protected]
Size

7.1MB
MD5

bb1570ca408cf76448102c7ecbbe322c
SHA1

0445c648174ca1930c2cdb0b89902cd4e984a9ea
SHA256

b0baf071692d63267aaf41bd3db933826523b59e8fca49655e1656ce0c656c71
SHA512

53efbbd752d2b0dd1e13231bf8d917a5ac512962860f6ac46f76d6fb618b4a83a54cabdee5295b20805bbd6a9ce343ff2967257679419185ede4b4ab45294a3f
SSDEEP

196608:qLcWN3KlidmQtekNXjglGHglGKglG05Pu0uCET7+y:MNxJHgKgBgtM1+y

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeManageVolumePrivilege 1924 svchost.exe

description	pid	process
Token: SeManageVolumePrivilege	1924	svchost.exe

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\31.214.157.40_#[email protected]
1⤵
PID:2024

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:5100

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1924

memory/1924-0-0x000001F045F40000-0x000001F045F50000-memory.dmp

Filesize
64KB

Download
memory/1924-16-0x000001F046040000-0x000001F046050000-memory.dmp

Filesize
64KB

Download
memory/1924-32-0x000001F04E380000-0x000001F04E381000-memory.dmp

Filesize
4KB

Download
memory/1924-34-0x000001F04E3B0000-0x000001F04E3B1000-memory.dmp

Filesize
4KB

Download
memory/1924-35-0x000001F04E3B0000-0x000001F04E3B1000-memory.dmp

Filesize
4KB

Download
memory/1924-36-0x000001F04E4C0000-0x000001F04E4C1000-memory.dmp

Filesize
4KB

Download