6c2e59b3ecc0e453a141e7229e25cafeb286ebe27c0c68096c18bfb3ce97b50a

Resubmissions

21-05-2024 14:05

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 14:05

Target

IntegrationWizard32.exe
Size

614KB
MD5

8d188050b9e4c0a5f0f24fcea65b1133
SHA1

3b1d04ee1adec2cd53d8721aee45fc112b5700da
SHA256

6c2e59b3ecc0e453a141e7229e25cafeb286ebe27c0c68096c18bfb3ce97b50a
SHA512

e220c535bd4bcc6897eb892e5731ad6e78ffb6d642dffb2ae104e8b5d642cdb53bd2a8e3e90ca62c7b199f85559467f2af0ebee62c1e75b3ca5e2e90c1b53ba8
SSDEEP

12288:8iB7dH1DCGUOdUQ0W+c2B7iQnPnaUwwi99Jygpji//y1z79clq1HIJA+lv:845NUdvaUwwD6i//Y39tZIJAS

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

IntegrationWizard32.exe

description pid process

Token: SeRestorePrivilege 4836 IntegrationWizard32.exe
Token: SeTakeOwnershipPrivilege 4836 IntegrationWizard32.exe

description	pid	process
Token: SeRestorePrivilege	4836	IntegrationWizard32.exe
Token: SeTakeOwnershipPrivilege	4836	IntegrationWizard32.exe

C:\Users\Admin\AppData\Local\Temp\IntegrationWizard32.exe
"C:\Users\Admin\AppData\Local\Temp\IntegrationWizard32.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4000 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8
1⤵
PID:2500