d0a18e2a595ad8d2ba39a279eea1df3b8c0f99704f902fcea173be1fb17a9ac5

Resubmissions

21/07/2026, 02:42

21/07/2026, 02:40

user interaction
yes
max time kernel
82s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 02:42

Target
Vega R6.exe
Size 110KB
Sample260721-c66pgacy8l
SHA256 d0a18e2a595ad8d2ba39a279eea1df3b8c0f99704f902fcea173be1fb17a9ac5
MD5 c323e62535214b66b2193309129b3781
SHA1 664496312ea1043775d9b9d1b794cbacf3039e97
SHA512 7030f7a052d08c0ded05aa0efe0f98b4010b0721216501ed73e4b471f8018816fb128db59b4d9ac007ed109964e412f8e061d6a7b15a458248170c5cff12b8f6
SSDEEP 1536:zoym+ersPEJTZ3SLofBpycbP/7SqsfWqh3KAUo9OlSwZdA7vMi3o3x5keUCnCzbc:KBIykeybpIEDwZmO2lHFk
TLSH
T1E9B32A0AE5A3203DC3A3803ACB465545EEA27C6987998DFB63D68EF10CE55907F3D613
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeBackupPrivilege	2532	svchost.exe
Token: SeRestorePrivilege	2532	svchost.exe
Token: SeSecurityPrivilege	2532	svchost.exe
Token: SeTakeOwnershipPrivilege	2532	svchost.exe
Token: 35	2532	svchost.exe

C:\Users\Admin\AppData\Local\Temp\Vega R6.exe
"C:\Users\Admin\AppData\Local\Temp\Vega R6.exe"
1⤵
PID:3856

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2492

C:\Users\Admin\AppData\Local\Temp\Vega R6.exe
"C:\Users\Admin\AppData\Local\Temp\Vega R6.exe"
1⤵
PID:2724

C:\Users\Admin\AppData\Local\Temp\Vega R6.exe
"C:\Users\Admin\AppData\Local\Temp\Vega R6.exe"
1⤵
PID:4584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2532