0fd61089cc17505bf663bbb8a20fa98a56f97f539999a5315b4a7a6658fcc8c3

Analysis

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
29/03/2024, 09:16

Target

1e4862324fac05cc32698247458b8700_JaffaCakes118.exe
Size

483KB
MD5

1e4862324fac05cc32698247458b8700
SHA1

0ed03f39c58dd651b63276d2ffa327d4dc165e81
SHA256

0fd61089cc17505bf663bbb8a20fa98a56f97f539999a5315b4a7a6658fcc8c3
SHA512

bbb6f4c0a0838f1cfe7f860ec9055fb70fa14737774d860aca1eab2b68211c598c67d349b735777de20c7b1fc9aac1dea7db4293165725d5b2dddf134be24a3b
SSDEEP

12288:eZcmSzuEyL3pXUT8ShbUpwyw4ZvFUJICo/251kwefHKzvSS6LN:eZcmSSEyj6TvhbUpwyw4ZvFrp/iefKv

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	3712	svchost.exe

C:\Users\Admin\AppData\Local\Temp\1e4862324fac05cc32698247458b8700_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1e4862324fac05cc32698247458b8700_JaffaCakes118.exe"
1⤵
PID:2884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=2252,i,11231798169170618717,17890004712654885282,262144 --variations-seed-version /prefetch:8
1⤵
PID:3872

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:8

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3712

memory/2884-0-0x0000000140000000-0x0000000140134000-memory.dmp

Filesize
1.2MB

Download
memory/2884-1-0x0000000140000000-0x0000000140134000-memory.dmp

Filesize
1.2MB

Download
memory/3712-2-0x000001E6F7B40000-0x000001E6F7B50000-memory.dmp

Filesize
64KB

Download
memory/3712-18-0x000001E6F7C40000-0x000001E6F7C50000-memory.dmp

Filesize
64KB

Download
memory/3712-34-0x000001E6801F0000-0x000001E6801F1000-memory.dmp

Filesize
4KB

Download
memory/3712-36-0x000001E680220000-0x000001E680221000-memory.dmp

Filesize
4KB

Download
memory/3712-37-0x000001E680220000-0x000001E680221000-memory.dmp

Filesize
4KB

Download
memory/3712-38-0x000001E680330000-0x000001E680331000-memory.dmp

Filesize
4KB

Download