Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/04/2026, 03:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0b7fe2dd79aa218412465207fd095b21942cb2102b50365f2e599914911242b2.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
0b7fe2dd79aa218412465207fd095b21942cb2102b50365f2e599914911242b2.exe
Resource
win11-20260130-en
windows11-21h2-x64
2 signatures
150 seconds
General
- Target 0b7fe2dd79aa218412465207fd095b21942cb2102b50365f2e599914911242b2.exe
- Size 27KB
- Sample260420-d68phags2q
- SHA256 0b7fe2dd79aa218412465207fd095b21942cb2102b50365f2e599914911242b2
- MD5 5287023a6f56f2e2b26790f2b4b1b289
- SHA1 c26af158dfbf7f05668c3973fe9ee7d314a36f52
- SHA512 4d508e358ea3357f901c0a4b4ac96ae14df7a4e1fa81bd7d48c0ed28eb97622ddc2becb91ed16815ff853747558a192f6e25df8373bbe0e85e15b8312f77e7e4
- SSDEEP 384:3NxysR3YvGUeu2l07PCOSB1qUCWOFUBduN+TW4gCwL1rb+PiGkWiPVju:9wtk07PCOE8UCWOYdu8Iv1rbJ3Ps
- TLSH T1BCC22B4976E8CA1ED66F4B7C76F307200236A34E5026DB86AECC4D9E1D6372419613EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 4432 0b7fe2dd79aa218412465207fd095b21942cb2102b50365f2e599914911242b2.exe - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 4432 0b7fe2dd79aa218412465207fd095b21942cb2102b50365f2e599914911242b2.exe Token: SeIncreaseQuotaPrivilege 4432 0b7fe2dd79aa218412465207fd095b21942cb2102b50365f2e599914911242b2.exe Token: SeSecurityPrivilege 4432 0b7fe2dd79aa218412465207fd095b21942cb2102b50365f2e599914911242b2.exe Token: SeTakeOwnershipPrivilege 4432 0b7fe2dd79aa218412465207fd095b21942cb2102b50365f2e599914911242b2.exe Token: SeLoadDriverPrivilege 4432 0b7fe2dd79aa218412465207fd095b21942cb2102b50365f2e599914911242b2.exe Token: SeSystemProfilePrivilege 4432 0b7fe2dd79aa218412465207fd095b21942cb2102b50365f2e599914911242b2.exe Token: SeSystemtimePrivilege 4432 0b7fe2dd79aa218412465207fd095b21942cb2102b50365f2e599914911242b2.exe Token: SeProfSingleProcessPrivilege 4432 0b7fe2dd79aa218412465207fd095b21942cb2102b50365f2e599914911242b2.exe Token: SeIncBasePriorityPrivilege 4432 0b7fe2dd79aa218412465207fd095b21942cb2102b50365f2e599914911242b2.exe Token: SeCreatePagefilePrivilege 4432 0b7fe2dd79aa218412465207fd095b21942cb2102b50365f2e599914911242b2.exe Token: SeBackupPrivilege 4432 0b7fe2dd79aa218412465207fd095b21942cb2102b50365f2e599914911242b2.exe Token: SeRestorePrivilege 4432 0b7fe2dd79aa218412465207fd095b21942cb2102b50365f2e599914911242b2.exe Token: SeShutdownPrivilege 4432 0b7fe2dd79aa218412465207fd095b21942cb2102b50365f2e599914911242b2.exe Token: SeDebugPrivilege 4432 0b7fe2dd79aa218412465207fd095b21942cb2102b50365f2e599914911242b2.exe Token: SeSystemEnvironmentPrivilege 4432 0b7fe2dd79aa218412465207fd095b21942cb2102b50365f2e599914911242b2.exe Token: SeRemoteShutdownPrivilege 4432 0b7fe2dd79aa218412465207fd095b21942cb2102b50365f2e599914911242b2.exe Token: SeUndockPrivilege 4432 0b7fe2dd79aa218412465207fd095b21942cb2102b50365f2e599914911242b2.exe Token: SeManageVolumePrivilege 4432 0b7fe2dd79aa218412465207fd095b21942cb2102b50365f2e599914911242b2.exe Token: 33 4432 0b7fe2dd79aa218412465207fd095b21942cb2102b50365f2e599914911242b2.exe Token: 34 4432 0b7fe2dd79aa218412465207fd095b21942cb2102b50365f2e599914911242b2.exe Token: 35 4432 0b7fe2dd79aa218412465207fd095b21942cb2102b50365f2e599914911242b2.exe Token: 36 4432 0b7fe2dd79aa218412465207fd095b21942cb2102b50365f2e599914911242b2.exe Token: SeIncreaseQuotaPrivilege 4432 0b7fe2dd79aa218412465207fd095b21942cb2102b50365f2e599914911242b2.exe Token: SeSecurityPrivilege 4432 0b7fe2dd79aa218412465207fd095b21942cb2102b50365f2e599914911242b2.exe Token: SeTakeOwnershipPrivilege 4432 0b7fe2dd79aa218412465207fd095b21942cb2102b50365f2e599914911242b2.exe Token: SeLoadDriverPrivilege 4432 0b7fe2dd79aa218412465207fd095b21942cb2102b50365f2e599914911242b2.exe Token: SeSystemProfilePrivilege 4432 0b7fe2dd79aa218412465207fd095b21942cb2102b50365f2e599914911242b2.exe Token: SeSystemtimePrivilege 4432 0b7fe2dd79aa218412465207fd095b21942cb2102b50365f2e599914911242b2.exe Token: SeProfSingleProcessPrivilege 4432 0b7fe2dd79aa218412465207fd095b21942cb2102b50365f2e599914911242b2.exe Token: SeIncBasePriorityPrivilege 4432 0b7fe2dd79aa218412465207fd095b21942cb2102b50365f2e599914911242b2.exe Token: SeCreatePagefilePrivilege 4432 0b7fe2dd79aa218412465207fd095b21942cb2102b50365f2e599914911242b2.exe Token: SeBackupPrivilege 4432 0b7fe2dd79aa218412465207fd095b21942cb2102b50365f2e599914911242b2.exe Token: SeRestorePrivilege 4432 0b7fe2dd79aa218412465207fd095b21942cb2102b50365f2e599914911242b2.exe Token: SeShutdownPrivilege 4432 0b7fe2dd79aa218412465207fd095b21942cb2102b50365f2e599914911242b2.exe Token: SeDebugPrivilege 4432 0b7fe2dd79aa218412465207fd095b21942cb2102b50365f2e599914911242b2.exe Token: SeSystemEnvironmentPrivilege 4432 0b7fe2dd79aa218412465207fd095b21942cb2102b50365f2e599914911242b2.exe Token: SeRemoteShutdownPrivilege 4432 0b7fe2dd79aa218412465207fd095b21942cb2102b50365f2e599914911242b2.exe Token: SeUndockPrivilege 4432 0b7fe2dd79aa218412465207fd095b21942cb2102b50365f2e599914911242b2.exe Token: SeManageVolumePrivilege 4432 0b7fe2dd79aa218412465207fd095b21942cb2102b50365f2e599914911242b2.exe Token: 33 4432 0b7fe2dd79aa218412465207fd095b21942cb2102b50365f2e599914911242b2.exe Token: 34 4432 0b7fe2dd79aa218412465207fd095b21942cb2102b50365f2e599914911242b2.exe Token: 35 4432 0b7fe2dd79aa218412465207fd095b21942cb2102b50365f2e599914911242b2.exe Token: 36 4432 0b7fe2dd79aa218412465207fd095b21942cb2102b50365f2e599914911242b2.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5gqj5yts.vhf.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH