e73b3c939cf1dc3054fb57ec128cb139d369a46f042f7e5129eab36f1bfba109

Analysis

max time kernel
1600s
max time network
1174s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 18:07

Target

Celery/dll/celeryuwpver
Size

3B
MD5

cb5ae17636e975f9bf71ddf5bc542075
SHA1

180505679cfe0cca79bae51fdda0296b7cd9c493
SHA256

14be4b45f18e0d8c67b4f719b5144eee88497e413709d11d85b096d8e2346310
SHA512

957f720b6d516c8e273968c9be2ffbe146329c1a11a2097844206f030dfde1f4efe3379eb68316d1c7426457144d9576dad04e46b10c0ca8d8b9a5d668387a1b

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

svchost.exe

description pid process

Token: SeManageVolumePrivilege 4252 svchost.exe

description	pid	process
Token: SeManageVolumePrivilege	4252	svchost.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Celery\dll\celeryuwpver
1⤵
PID:2432

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:2424

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4252

memory/4252-0-0x000001EFE9940000-0x000001EFE9950000-memory.dmp

Filesize
64KB

Download
memory/4252-16-0x000001EFE9A40000-0x000001EFE9A50000-memory.dmp

Filesize
64KB

Download
memory/4252-32-0x000001EFF1D30000-0x000001EFF1D31000-memory.dmp

Filesize
4KB

Download
memory/4252-34-0x000001EFF1D60000-0x000001EFF1D61000-memory.dmp

Filesize
4KB

Download
memory/4252-35-0x000001EFF1D60000-0x000001EFF1D61000-memory.dmp

Filesize
4KB

Download
memory/4252-36-0x000001EFF1E70000-0x000001EFF1E71000-memory.dmp

Filesize
4KB

Download