1d2b8e3bbfcd7546b402c2f379e40d850fd4eceaf20c45fdbfcba0b859e0a7fb

Analysis

max time kernel
298s
max time network
236s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/04/2026, 08:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
189231.exe
Size 77KB
Sample260427-j4b6eaew91
SHA256 1d2b8e3bbfcd7546b402c2f379e40d850fd4eceaf20c45fdbfcba0b859e0a7fb
MD5 e33b0942f46cf3541d695a55bfd9d69c
SHA1 eace3ab152ed327061a4819bcf4e7e774cb3c0d3
SHA512 1b81ca5b9fe929ad255913c2490f0efa9977753a754a345d15586c2ff277006b48eb3ccb97b90a9f6ebf55fe53e00a1decca2d9d5e85aaffa72ae082f8909cab
SSDEEP 1536:kVeDb06mF8gZXcsvYjBqNsL+oz8h2lCX:kab09I1BVicl
TLSH
T1BB732961A2F425B9D5A68235CA7A2316DB31B40E3F218BCF1230951D2F136F25F7DB26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

persistence

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4604	189231.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\189231.exe
"C:\Users\Admin\AppData\Local\Temp\189231.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4604-0-0x000001B20AEE0000-0x000001B20AF10000-memory.dmp

Download