247f8bde8f95a9c1965a99a186153160499f32b6269642ac9ec06a30bcee40f2

Analysis

max time kernel
1619s
max time network
1180s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20/04/2024, 23:40

Target

virus.bat
Size

155B
MD5

8c5d353a43541c65a6bcf93104ecd20a
SHA1

c14d5c6f94d77c7265d6b2f521cc60be26ea32b6
SHA256

247f8bde8f95a9c1965a99a186153160499f32b6269642ac9ec06a30bcee40f2
SHA512

dacade80f91c9e3c802f6b10f785f0bb11cdf8f2bd5d934133577883fdc30d03cc3d64ba28a27c0589e830d62699dc62d460b574023eba4f640f1a48689f3db7

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	3868	svchost.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\virus.bat"
1⤵
PID:4776

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4396

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:2892

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3868

memory/3868-0-0x0000021B7E840000-0x0000021B7E850000-memory.dmp

Filesize
64KB

Download
memory/3868-16-0x0000021B7E940000-0x0000021B7E950000-memory.dmp

Filesize
64KB

Download
memory/3868-32-0x0000021B7EC30000-0x0000021B7EC31000-memory.dmp

Filesize
4KB

Download
memory/3868-34-0x0000021B7EC60000-0x0000021B7EC61000-memory.dmp

Filesize
4KB

Download
memory/3868-35-0x0000021B7EC60000-0x0000021B7EC61000-memory.dmp

Filesize
4KB

Download
memory/3868-36-0x0000021B7ED70000-0x0000021B7ED71000-memory.dmp

Filesize
4KB

Download