915513f1dd444148363ca8a0fd92feafe54f121ab7fadc5ff2b0c8c43bf8c91b

Resubmissions

26/01/2024, 15:47

max time kernel
147s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/01/2024, 15:47

Target

915513f1dd444148363ca8a0fd92feafe54f121ab7fadc5ff2b0c8c43bf8c91b.js
Size

14KB
MD5

303182f4b16d0415210593440242ced9
SHA1

b2927668a8b4754a600743a4dd9707e384f44737
SHA256

915513f1dd444148363ca8a0fd92feafe54f121ab7fadc5ff2b0c8c43bf8c91b
SHA512

6ce2e4cb9b0f6e27382d765c5760b00091ee06203d64561cca5fe4712ce1bb97d7c2d43d4d57f0c122f2099b25f1ec631b28e4a99eee303f9aa7b67e7719f053
SSDEEP

192:YUupscF6wC3xT5J3xEVarzsyAnpq/GYbjYn9IkcTjczSVjaIz5zbX8ZCszLM:HupscEDXuMrz1PbAhCc3M

Score

1^/10

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeBackupPrivilege	1300	svchost.exe
Token: SeRestorePrivilege	1300	svchost.exe
Token: SeSecurityPrivilege	1300	svchost.exe
Token: SeTakeOwnershipPrivilege	1300	svchost.exe
Token: 35	1300	svchost.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\915513f1dd444148363ca8a0fd92feafe54f121ab7fadc5ff2b0c8c43bf8c91b.js
1⤵
PID:400

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1300