11ac8b313e17391ba1c40d40d400b477bbc4bd48fc72967e308899319c9ec7bf

Analysis

max time kernel
1775s
max time network
1738s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04-04-2024 17:02

Target

BotNets/WarBot/(HTTP Botnet) Warbot Botnet Tutorial.url
Size

140B
MD5

44f672e30a0b21b02416442ea677054d
SHA1

21b1a5a5a60643015e4b17641a824229a6de58cc
SHA256

930cf43badc59d3bf4afa9cdb66c00e1e8490407442747a16fa1db280ca87e64
SHA512

1244338c62e97a0d781f9c8f961208406bcdc28e8cc188372eb03c0356e624b83056b4ef58dd0cbc020fcf685959c7d04972cb9b370e861f1f7350a7a0dac4a3

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeManageVolumePrivilege 5032 svchost.exe

description	pid	process
Token: SeManageVolumePrivilege	5032	svchost.exe

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL "C:\Users\Admin\AppData\Local\Temp\BotNets\WarBot\(HTTP Botnet) Warbot Botnet Tutorial.url"
1⤵
PID:1992

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:3872

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5032

memory/5032-0-0x000001E139040000-0x000001E139050000-memory.dmp

Filesize
64KB

Download
memory/5032-16-0x000001E139140000-0x000001E139150000-memory.dmp

Filesize
64KB

Download
memory/5032-32-0x000001E141450000-0x000001E141451000-memory.dmp

Filesize
4KB

Download
memory/5032-34-0x000001E141480000-0x000001E141481000-memory.dmp

Filesize
4KB

Download
memory/5032-35-0x000001E141480000-0x000001E141481000-memory.dmp

Filesize
4KB

Download
memory/5032-36-0x000001E141590000-0x000001E141591000-memory.dmp

Filesize
4KB

Download