b9af69ac821a649f211c99e3edf32a76a213e9450b5e972a6cdda5758af530dd

max time kernel
133s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 16:00

Sharing

Target
SecureBootEncodeUEFI.exe
Size 116KB
Sample240823-tf47dsteqe
SHA256 0fc9f6f6b9c93025410e79f235762c8cd37efd7b9ce780128563bf292ac5ac7b
MD5 ce462e1804e1ce9675c363a4ef5ae7ce
SHA1 eee7a777182197096f4d0101ca08e530d59825c1
SHA512 711e7049166ba76a9d401ac345af04ae3ed26abcad480f4ae19cb41596abd3f72405c4cd5cd1a989fef161e776525d9ce94cc7a9cce400caf987982f6b9ef7b4
SSDEEP 1536:FJ45f3EDGyLP4hO999pMGmAFy4VjexI68Fxc4olW7/qWt/pUc/7gvq:fhlgMLGK6l8kVk7/xZ/m
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeSystemEnvironmentPrivilege	2296	SecureBootEncodeUEFI.exe
Token: SeSystemEnvironmentPrivilege	2296	SecureBootEncodeUEFI.exe
Token: SeSystemEnvironmentPrivilege	2296	SecureBootEncodeUEFI.exe
Token: SeSystemEnvironmentPrivilege	2296	SecureBootEncodeUEFI.exe

C:\Users\Admin\AppData\Local\Temp\SecureBootEncodeUEFI.exe
"C:\Users\Admin\AppData\Local\Temp\SecureBootEncodeUEFI.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2296