65d7f19ed306ff75b754f519f69e3e0fd7ecb2ed821b1a5457deb77d5b2d5801

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/04/2024, 12:26

Target

e28a5cdfa78b61656a5060d9ede19a90_JaffaCakes118.exe
Size

1.0MB
MD5

e28a5cdfa78b61656a5060d9ede19a90
SHA1

1fa48b2b1d4210d5c382316476cffc5f13b053dd
SHA256

65d7f19ed306ff75b754f519f69e3e0fd7ecb2ed821b1a5457deb77d5b2d5801
SHA512

537f6e4aa221aac619e43c0fecd47ca3704252f3e69cc433663cf46921fa9e81dcc5a95d6779f7bde92445ad7aa59bfc8816bbbc890b985541cc0702a685bb56
SSDEEP

24576:/lrrNZDPcqmzU+SrZRY6pl+x6rZV0dcHHo:xPV3K6Cx6l0cno

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4064	e28a5cdfa78b61656a5060d9ede19a90_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2132	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2132	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\e28a5cdfa78b61656a5060d9ede19a90_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e28a5cdfa78b61656a5060d9ede19a90_JaffaCakes118.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:4064

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x47c 0x2d8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2132

memory/4064-0-0x0000000002350000-0x0000000002351000-memory.dmp

Filesize
4KB

Download
memory/4064-1-0x0000000000400000-0x00000000004AB000-memory.dmp

Filesize
684KB

Download
memory/4064-2-0x0000000000400000-0x00000000004AB000-memory.dmp

Filesize
684KB

Download