e73b3c939cf1dc3054fb57ec128cb139d369a46f042f7e5129eab36f1bfba109

Analysis

max time kernel
1768s
max time network
1163s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 18:07

Target

$INTERNET_CACHE/Somebody
Size

15KB
MD5

7b6406e22b8b8bbd386e1b1108e6ddc9
SHA1

7ef14e132bce74f43a55d5c317205cacfba99c00
SHA256

ef8e05c01549775fdb2fc614f5e07dad510c4573f5c77a26ddd27bcb73417de0
SHA512

ffc4ae959dcf735de00b9f36c19c50757ef6a2d685626122fd17500ae49013ea2b1d22838a0859f685accc1c60bb20c5d5373588cd8d45e209a7ca711b0fc8ff
SSDEEP

192:iZN0Vz8u6vSQD1XbXFPX6WOSWDsN8CC2fmIVVG0jbIUXiZHUXFvCfk+E+YjX80rr:ON063vpRINSlZzVA6LYdOTfJTJ

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeManageVolumePrivilege 5008 svchost.exe

description	pid	process
Token: SeManageVolumePrivilege	5008	svchost.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\$INTERNET_CACHE\Somebody
1⤵
PID:4780

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:4436

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5008

memory/5008-0-0x000001B1ECE40000-0x000001B1ECE50000-memory.dmp

Filesize
64KB

Download
memory/5008-16-0x000001B1ECF40000-0x000001B1ECF50000-memory.dmp

Filesize
64KB

Download
memory/5008-32-0x000001B1F5230000-0x000001B1F5231000-memory.dmp

Filesize
4KB

Download
memory/5008-34-0x000001B1F5260000-0x000001B1F5261000-memory.dmp

Filesize
4KB

Download
memory/5008-35-0x000001B1F5260000-0x000001B1F5261000-memory.dmp

Filesize
4KB

Download
memory/5008-36-0x000001B1F5370000-0x000001B1F5371000-memory.dmp

Filesize
4KB

Download