e55704522d066cbf90e9bf12f06043fd0258b5b5340eba306241c51cb2716ffe

Analysis

max time kernel
4s
max time network
0s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21-07-2024 02:12

Target

Client.exe
Size

303KB
MD5

32089bda090f1fe8229c499507913e79
SHA1

1299626fdf97924a1feea6526f2c23262bbf3241
SHA256

e55704522d066cbf90e9bf12f06043fd0258b5b5340eba306241c51cb2716ffe
SHA512

562caba1372542bf175fdd9a0d94d23a46bf0a8e90f586225b776ebc3e12f3d234188d296c8d459ccd51cb201e22c6fe647db12479bba1cb0bb8ce35b2768f78
SSDEEP

6144:fdECobn02Lbt0oGFULDv7zQWE7MEmdrbgl+XlvN:fuCy+FU3XNzEmpg01

Score

1^/10

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2676	Client.exe
Token: SeSecurityPrivilege	2676	Client.exe
Token: SeTakeOwnershipPrivilege	2676	Client.exe
Token: SeLoadDriverPrivilege	2676	Client.exe
Token: SeSystemProfilePrivilege	2676	Client.exe
Token: SeSystemtimePrivilege	2676	Client.exe
Token: SeProfSingleProcessPrivilege	2676	Client.exe
Token: SeIncBasePriorityPrivilege	2676	Client.exe
Token: SeCreatePagefilePrivilege	2676	Client.exe
Token: SeBackupPrivilege	2676	Client.exe
Token: SeRestorePrivilege	2676	Client.exe
Token: SeShutdownPrivilege	2676	Client.exe
Token: SeDebugPrivilege	2676	Client.exe
Token: SeSystemEnvironmentPrivilege	2676	Client.exe
Token: SeRemoteShutdownPrivilege	2676	Client.exe
Token: SeUndockPrivilege	2676	Client.exe
Token: SeManageVolumePrivilege	2676	Client.exe
Token: 33	2676	Client.exe
Token: 34	2676	Client.exe
Token: 35	2676	Client.exe

C:\Users\Admin\AppData\Local\Temp\Client.exe
"C:\Users\Admin\AppData\Local\Temp\Client.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2676

memory/2676-0-0x000007FEF5833000-0x000007FEF5834000-memory.dmp

Filesize
4KB

Download
memory/2676-1-0x0000000000350000-0x00000000003A2000-memory.dmp

Filesize
328KB

Download
memory/2676-2-0x000007FEF5830000-0x000007FEF621C000-memory.dmp

Filesize
9.9MB

Download
memory/2676-3-0x000007FEF5830000-0x000007FEF621C000-memory.dmp

Filesize
9.9MB

Download