2ac91449fd255e02594e29de0f1c66c70fb0ba1af3dd87846ffe3e21503ffb4d

Analysis

max time kernel
144s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2024, 22:25

Target

c351111fe20ea7efd3619ac89322a477_JaffaCakes118.exe
Size

768KB
MD5

c351111fe20ea7efd3619ac89322a477
SHA1

c5ada672e229ccab0c18b670adea396f8720a4b1
SHA256

2ac91449fd255e02594e29de0f1c66c70fb0ba1af3dd87846ffe3e21503ffb4d
SHA512

cd58c23193c4848da616db6e7b9524df58d3ecf537e6546fab349a7422e95b00c5c18962bccf5b75e400ca29e955d51d93a7db53c2062e9cfbaa912705e7f3de
SSDEEP

768:xwmdfKrsR/QUhSsSRoSrKrsR/QUhSsSRxuEDd9FOGt+MvMzfpDRu6Ai+zj7QymhL:x0rm/QUhL0Qrm/QUhL0TDdKE6pDhZCwD

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2604	3552	WerFault.exe	92

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3552	c351111fe20ea7efd3619ac89322a477_JaffaCakes118.exe
Token: SeManageVolumePrivilege	4308	svchost.exe

C:\Users\Admin\AppData\Local\Temp\c351111fe20ea7efd3619ac89322a477_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c351111fe20ea7efd3619ac89322a477_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3552
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 1584
  2⤵
  - Program crash
  PID:2604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3552 -ip 3552
1⤵
PID:4560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3636 --field-trial-handle=2244,i,861925222566734100,5228329984880658054,262144 --variations-seed-version /prefetch:8
1⤵
PID:4960

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:2164

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4308

memory/3552-0-0x0000000000F80000-0x0000000001046000-memory.dmp

Filesize
792KB

Download
memory/3552-1-0x00000000752D0000-0x0000000075A80000-memory.dmp

Filesize
7.7MB

Download
memory/3552-2-0x00000000059A0000-0x0000000005A16000-memory.dmp

Filesize
472KB

Download
memory/3552-3-0x0000000005BB0000-0x0000000005BC0000-memory.dmp

Filesize
64KB

Download
memory/3552-4-0x00000000752D0000-0x0000000075A80000-memory.dmp

Filesize
7.7MB

Download
memory/4308-5-0x0000020455D80000-0x0000020455D90000-memory.dmp

Filesize
64KB

Download
memory/4308-21-0x0000020455E80000-0x0000020455E90000-memory.dmp

Filesize
64KB

Download
memory/4308-37-0x000002045E1F0000-0x000002045E1F1000-memory.dmp

Filesize
4KB

Download
memory/4308-39-0x000002045E220000-0x000002045E221000-memory.dmp

Filesize
4KB

Download
memory/4308-41-0x000002045E330000-0x000002045E331000-memory.dmp

Filesize
4KB

Download
memory/4308-40-0x000002045E220000-0x000002045E221000-memory.dmp

Filesize
4KB

Download