2aa3899ab7fb9ab4899fcbe7d56b6b8d3a6eb891125d6f4b74147fb9d65c8963

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 00:54

Target
2aa3899ab7fb9ab4899fcbe7d56b6b8d3a6eb891125d6f4b74147fb9d65c8963.exe
Size 10.0MB
Sample260804-a9ghmss1ex
SHA256 2aa3899ab7fb9ab4899fcbe7d56b6b8d3a6eb891125d6f4b74147fb9d65c8963
MD5 8dba42ce8e979157a6880bad4549c55f
SHA1 060cf5cda7fa4c2940757350c112c25fda37d027
SHA512 c70c7043023d04b2dd138efaa518bde1c5273197ee5525de0064cf549b5733b433edd316880c737228422c6509f1a4806374708de5852d83d471f8eaeee03ed1
SSDEEP 196608:1oYa08UT1/qSimt4rgRO2R0a0VEbfv74o9Shise1:raiT1/qSimt4rgRO2Oa0mbB4h
TLSH
T13AB67C2B764001FFD86A82BD89864612C379BC974735A7CF12A876992F737D41E3E312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeSystemEnvironmentPrivilege	5888	2aa3899ab7fb9ab4899fcbe7d56b6b8d3a6eb891125d6f4b74147fb9d65c8963.exe
Token: SeDebugPrivilege	5888	2aa3899ab7fb9ab4899fcbe7d56b6b8d3a6eb891125d6f4b74147fb9d65c8963.exe

C:\Users\Admin\AppData\Local\Temp\2aa3899ab7fb9ab4899fcbe7d56b6b8d3a6eb891125d6f4b74147fb9d65c8963.exe
"C:\Users\Admin\AppData\Local\Temp\2aa3899ab7fb9ab4899fcbe7d56b6b8d3a6eb891125d6f4b74147fb9d65c8963.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4704