e687b9d26149f7320a82e2dde3b044945f1ad5d12968bdc5c4b976602ef9d175

Analysis

max time kernel
1696s
max time network
1167s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
23-09-2023 14:30

Target

discord-reg/bypass/browser/node_modules/call-bind/index.js
Size

1KB
MD5

f5d72536971e8d293cc95ef30bc7584b
SHA1

ac50fedd268af62d235f9229b491e3a7bf2c8444
SHA256

51b2bc9d457a3fc35c7d0432adda3d9c3022d490e3c51d82bd2e6fbc00407930
SHA512

fa5374955e8b4759e6d499a0d33dbf819f8d0d55967fdd5c6ef82e083cbd3cb44fecd02e4c5f583cfb89e2b538fff40e8e253caf49750f2404717ee290f163c0

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeManageVolumePrivilege 888 svchost.exe

description	pid	process
Token: SeManageVolumePrivilege	888	svchost.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\discord-reg\bypass\browser\node_modules\call-bind\index.js
1⤵
PID:508

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:2180

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:888

memory/888-0-0x000001D70CA90000-0x000001D70CAA0000-memory.dmp

Filesize
64KB

Download
memory/888-16-0x000001D70CB90000-0x000001D70CBA0000-memory.dmp

Filesize
64KB

Download
memory/888-32-0x000001D714F00000-0x000001D714F01000-memory.dmp

Filesize
4KB

Download
memory/888-34-0x000001D714F30000-0x000001D714F31000-memory.dmp

Filesize
4KB

Download
memory/888-35-0x000001D714F30000-0x000001D714F31000-memory.dmp

Filesize
4KB

Download
memory/888-36-0x000001D715040000-0x000001D715041000-memory.dmp

Filesize
4KB

Download