Analysis
-
max time kernel
147s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
26-03-2024 23:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b14c96f02589e91b2e2cad323c99b177735b51eb4bdf4596d563eeaa27e5d2ef.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
b14c96f02589e91b2e2cad323c99b177735b51eb4bdf4596d563eeaa27e5d2ef.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
b14c96f02589e91b2e2cad323c99b177735b51eb4bdf4596d563eeaa27e5d2ef.exe
-
Size
14KB
-
MD5
911af98bf6da1d3209257de765843754
-
SHA1
db8bb3297159ad846bf014b2da47b926ab8e1f27
-
SHA256
b14c96f02589e91b2e2cad323c99b177735b51eb4bdf4596d563eeaa27e5d2ef
-
SHA512
1105033935d261afe285396db27d387188c208f02c0edcbc83fdbbdcf52e49535cfdde86604cf4a13dffb54d8845101986d9e4fc7eaa7062979bbe164be0de9a
-
SSDEEP
384:1+SopZ3lqO84BSugDcZ6czPpDE045Hh8:QLTgDcZ6+JA38
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeManageVolumePrivilege 1556 svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b14c96f02589e91b2e2cad323c99b177735b51eb4bdf4596d563eeaa27e5d2ef.exe"C:\Users\Admin\AppData\Local\Temp\b14c96f02589e91b2e2cad323c99b177735b51eb4bdf4596d563eeaa27e5d2ef.exe"1⤵PID:1496
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵PID:4124
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1556