8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85

Analysis

max time kernel
1463s
max time network
1164s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11-03-2024 15:06

Target

New Compressed (zipped) Folder.zip
Size

22B
MD5

76cdb2bad9582d23c1f6f4d868218d6c
SHA1

b04f3ee8f5e43fa3b162981b50bb72fe1acabb33
SHA256

8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85
SHA512

5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeManageVolumePrivilege 4536 svchost.exe

description	pid	process
Token: SeManageVolumePrivilege	4536	svchost.exe

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\New Compressed (zipped) Folder.zip"
1⤵
PID:264

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:3056

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4536

memory/4536-0-0x0000020BD7250000-0x0000020BD7260000-memory.dmp

Filesize
64KB

Download
memory/4536-16-0x0000020BD7350000-0x0000020BD7360000-memory.dmp

Filesize
64KB

Download
memory/4536-32-0x0000020BDF6C0000-0x0000020BDF6C1000-memory.dmp

Filesize
4KB

Download
memory/4536-34-0x0000020BDF6F0000-0x0000020BDF6F1000-memory.dmp

Filesize
4KB

Download
memory/4536-35-0x0000020BDF6F0000-0x0000020BDF6F1000-memory.dmp

Filesize
4KB

Download
memory/4536-36-0x0000020BDF800000-0x0000020BDF801000-memory.dmp

Filesize
4KB

Download