46c6d4e944983f345a0851e6f0e31283c0d8537f19b2de1f8e35f34a31528d1c | Triage

Analysis

max time kernel
177s
max time network
200s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 06:36

Sharing

Report Analysis Logs

General

Target

46c6d4e944983f345a0851e6f0e31283c0d8537f19b2de1f8e35f34a31528d1c.exe
Size

3KB
MD5

6717895d5f8c1c8d272dd2159c071240
SHA1

6037df850fc9e14dac24f80e4020504a42d5bfbe
SHA256

46c6d4e944983f345a0851e6f0e31283c0d8537f19b2de1f8e35f34a31528d1c
SHA512

7bf8f446d6c88a6653681122987427e1f01ab4c60b4a327e0579e04a638bcd235d7f7e272c1299a33f54a736ce1a9e84dd59c2becf15b55ba3020783f66345c6

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTcbPrivilege	4680	svchost.exe
Token: SeTcbPrivilege	4680	svchost.exe

C:\Users\Admin\AppData\Local\Temp\46c6d4e944983f345a0851e6f0e31283c0d8537f19b2de1f8e35f34a31528d1c.exe
"C:\Users\Admin\AppData\Local\Temp\46c6d4e944983f345a0851e6f0e31283c0d8537f19b2de1f8e35f34a31528d1c.exe"
1⤵
PID:2128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads