9127560918eaefe69f1959bcb7f7e13b7e3a7ac156b564922829faaec9b96f67

Analysis

max time kernel
1718s
max time network
1162s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26/03/2024, 18:41

Target

salinewin/PayloadMBR/Programs/compress.exe
Size

50KB
MD5

884e43a197998dfeac6865c525321935
SHA1

32c27b036332e795fbe1060bcb43fe84468e423b
SHA256

abccc981147d5f9b43463e0f9ec6b7f168b7444626048c6c6a1c4dd7f8137096
SHA512

558d587ec0d0f07555d13d9d3262dcfdd5c344d735a2b5220356554467f255c42345b2b2443ea373537a9c4098c66ad0368fb8b2c62dd1922308276df5a3775e
SSDEEP

768:K4u2i8xCuM5AFEApuz7WHLeEA6vyFuu8A5U:ru0MApuereN6j

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	4776	svchost.exe

C:\Users\Admin\AppData\Local\Temp\salinewin\PayloadMBR\Programs\compress.exe
"C:\Users\Admin\AppData\Local\Temp\salinewin\PayloadMBR\Programs\compress.exe"
1⤵
PID:3640

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:3900

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4776

memory/3640-0-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4776-1-0x0000019E47640000-0x0000019E47650000-memory.dmp

Filesize
64KB

Download
memory/4776-17-0x0000019E47740000-0x0000019E47750000-memory.dmp

Filesize
64KB

Download
memory/4776-33-0x0000019E4FA30000-0x0000019E4FA31000-memory.dmp

Filesize
4KB

Download
memory/4776-35-0x0000019E4FA60000-0x0000019E4FA61000-memory.dmp

Filesize
4KB

Download
memory/4776-36-0x0000019E4FA60000-0x0000019E4FA61000-memory.dmp

Filesize
4KB

Download
memory/4776-37-0x0000019E4FB70000-0x0000019E4FB71000-memory.dmp

Filesize
4KB

Download