815eb0c2591ffa6d6de7e8ae52ebdcccfc0d88d45571b376c3d75425e1e719d5 | Triage

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/04/2024, 02:17

Sharing

Report Analysis Logs

General

Target

PrimoRun.exe
Size

85KB
MD5

46ddb0dbe5d2dcb64ea73c7bd5a0ba1c
SHA1

d23da916b4881434045170ce6b3bf5dc0386b8de
SHA256

b177b69eb313417acd0a91f8d1cdbe7cf2ec61bc81036916970d622a73c79658
SHA512

e0f1b377feea30de995ef0a7f1a2e1850c5cb5e2c80255d535a22eb1608f7dbca8671e718f7c1de0b02fde78463d56802d7c8860c9259c6aae3a29e6bdcac325
SSDEEP

1536:I3bfn675aJdBaVHbTa2L5SQs+2Dzs7kfS566iAyKy:ibfW5uXCFLIQgS566iA4

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeTcbPrivilege	1936	PrimoRun.exe
Token: SeAssignPrimaryTokenPrivilege	1936	PrimoRun.exe
Token: SeIncreaseQuotaPrivilege	1936	PrimoRun.exe

C:\Users\Admin\AppData\Local\Temp\PrimoRun.exe
"C:\Users\Admin\AppData\Local\Temp\PrimoRun.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads