e73b3c939cf1dc3054fb57ec128cb139d369a46f042f7e5129eab36f1bfba109

Analysis

max time kernel
1793s
max time network
1802s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 18:07

Target

$INTERNET_CACHE/He
Size

137KB
MD5

7328c53b25849bbfaae94346e50f6884
SHA1

def55d4b548414ed80e19f14d9c8f0b000a96009
SHA256

ace16185c0ad1a3b52d91c7f02a956f1f3354266abeb2430cf3db821b570a33b
SHA512

4d02ac36d1a5e0c8f826080492e114a4c59cef5756b938166f9db18a207c40114fbca04efa2d595701c4e5d6b3dc698dbf8db9944765999dd21412cc0084af3c
SSDEEP

3072:Pb2Xo2IkVvh8p65Nu+dVtqi/x4Rqf21Rgat0g/bZav:Pb2M8JTDD/xcq21R1p/k

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeManageVolumePrivilege 2988 svchost.exe

description	pid	process
Token: SeManageVolumePrivilege	2988	svchost.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\He
1⤵
PID:1140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1340 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
1⤵
PID:3792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1388 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
1⤵
PID:4312

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:1136

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2988

memory/2988-0-0x000002326B240000-0x000002326B250000-memory.dmp

Filesize
64KB

Download
memory/2988-16-0x000002326B340000-0x000002326B350000-memory.dmp

Filesize
64KB

Download
memory/2988-32-0x00000232736A0000-0x00000232736A1000-memory.dmp

Filesize
4KB

Download
memory/2988-34-0x00000232736D0000-0x00000232736D1000-memory.dmp

Filesize
4KB

Download
memory/2988-35-0x00000232736D0000-0x00000232736D1000-memory.dmp

Filesize
4KB

Download
memory/2988-36-0x00000232737E0000-0x00000232737E1000-memory.dmp

Filesize
4KB

Download