e73b3c939cf1dc3054fb57ec128cb139d369a46f042f7e5129eab36f1bfba109

Analysis

max time kernel
1694s
max time network
1171s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 18:07

Target

$INTERNET_CACHE/Option
Size

91KB
MD5

09dbf2c646acb481876674dad686b3cd
SHA1

d12b89c2721390bcce5df81b5e8e2dc11463721c
SHA256

ad09a9f6d2ccc9723227af3320344c9f76fc7c5d26b7ebca4a5fc9402437ed3b
SHA512

36b3057b16a699b795ca5293af49811285d4078380c65ecc7486d961733b5fd6a68375448fee0eeb7235f6e0d94ded5f73d510115719a04de100750cb91cfe95
SSDEEP

1536:aO2NxVQvWPq2FSskcVKNIJ4q7gj2LTpHcewz1mWStIuHWt+72Hr2G2oKwWFHE8FS:aO2rVYj3IXlz+19uHWt+72L2G2Bf68fi

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeManageVolumePrivilege 2660 svchost.exe

description	pid	process
Token: SeManageVolumePrivilege	2660	svchost.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Option
1⤵
PID:2488

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:2544

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2660

memory/2660-0-0x0000027C6CA40000-0x0000027C6CA50000-memory.dmp

Filesize
64KB

Download
memory/2660-16-0x0000027C6CB40000-0x0000027C6CB50000-memory.dmp

Filesize
64KB

Download
memory/2660-32-0x0000027C74EB0000-0x0000027C74EB1000-memory.dmp

Filesize
4KB

Download
memory/2660-34-0x0000027C74EE0000-0x0000027C74EE1000-memory.dmp

Filesize
4KB

Download
memory/2660-35-0x0000027C74EE0000-0x0000027C74EE1000-memory.dmp

Filesize
4KB

Download
memory/2660-36-0x0000027C74FF0000-0x0000027C74FF1000-memory.dmp

Filesize
4KB

Download