b5b526b4b8c2d4396a91d7daf5f5fe804538c001087d8c4b32e01899b396b6b3 | Triage

Analysis

max time kernel
133s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
20-05-2022 05:09

Sharing

Report Analysis Logs

General

Target

Windows Update Service.exe
Size

5KB
MD5

084b7cfbd33d651eb91b5e739b7b7273
SHA1

f4a0b3e186d47cf337181bc43dc0dcf1b3aeda4c
SHA256

0513879a40c9116c6ff959bbec11c2aa45ecfb9324d912fcd061ace056c9ece8
SHA512

7807be70fd20a1ba99d8d8956e736e4326bd6c3da770f6004e9e8ac84b7b725062992da700c8e78ddeed481dbb312d8cbcb73beae8ad055ce69e7d135c450580

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Windows Update Service.exe

description pid process

Token: SeLockMemoryPrivilege 4748 Windows Update Service.exe
Token: SeLockMemoryPrivilege 4748 Windows Update Service.exe

C:\Users\Admin\AppData\Local\Temp\Windows Update Service.exe
"C:\Users\Admin\AppData\Local\Temp\Windows Update Service.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4748-130-0x0000000000CB0000-0x0000000000CB6000-memory.dmp

Filesize
24KB

Download
memory/4748-132-0x00007FF822A90000-0x00007FF823551000-memory.dmp

Filesize
10.8MB

Download