e73b3c939cf1dc3054fb57ec128cb139d369a46f042f7e5129eab36f1bfba109

Analysis

max time kernel
1704s
max time network
1175s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 18:07

Target

$INTERNET_CACHE/Indiana
Size

197B
MD5

ed19ffcfd341f0e04d2e4e6cee02efeb
SHA1

22216f02cb4d146a2c5f207bd4f62934e82a0cac
SHA256

58c2bdb1517566272d4b0ea2e8bcc9b61031fb44b19127c0b5cf9fb1a0739dae
SHA512

291e23d6b993c0a15bc94c1a11770f20ff449b08f1040527a55e2304cdf374d990babdd3bb74c188e63d71b1a587379b7602693eaac299c4758e6a022f69f881

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeManageVolumePrivilege 920 svchost.exe

description	pid	process
Token: SeManageVolumePrivilege	920	svchost.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Indiana
1⤵
PID:4564

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:2068

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:920

memory/920-0-0x0000021788140000-0x0000021788150000-memory.dmp

Filesize
64KB

Download
memory/920-16-0x0000021788240000-0x0000021788250000-memory.dmp

Filesize
64KB

Download
memory/920-32-0x0000021790540000-0x0000021790541000-memory.dmp

Filesize
4KB

Download
memory/920-34-0x0000021790570000-0x0000021790571000-memory.dmp

Filesize
4KB

Download
memory/920-36-0x0000021790680000-0x0000021790681000-memory.dmp

Filesize
4KB

Download
memory/920-35-0x0000021790570000-0x0000021790571000-memory.dmp

Filesize
4KB

Download