00e346564e934f0b20101afc27b05e8bc5fb5776170e94f896fcfe268e74367e

Analysis

max time kernel
120s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 07:01

Target

f53c96f0ce4d8459da93bacefb9620ca_JaffaCakes118.exe
Size

9KB
MD5

f53c96f0ce4d8459da93bacefb9620ca
SHA1

9f7e3ddcb58b004a025d5d917e54746181654109
SHA256

00e346564e934f0b20101afc27b05e8bc5fb5776170e94f896fcfe268e74367e
SHA512

ac68cf52a5e3e677f569cba51ad7d438f35fc4abeee8fd853b523ad45601491c6b580be142ca32894ae62802a2f5c087059d5c6e719ddb98bc125710483bfef8
SSDEEP

192:vjBksu/zHNQfpeMZZ3X93Vnjdwqzv3EcMsuGfJ:4HkpeMJFnhwqz5fuGf

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2196	f53c96f0ce4d8459da93bacefb9620ca_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f53c96f0ce4d8459da93bacefb9620ca_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f53c96f0ce4d8459da93bacefb9620ca_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2196

memory/2196-0-0x0000000000980000-0x0000000000988000-memory.dmp

Filesize
32KB

Download
memory/2196-1-0x0000000002A00000-0x0000000002A12000-memory.dmp

Filesize
72KB

Download
memory/2196-2-0x00007FFA7A880000-0x00007FFA7B341000-memory.dmp

Filesize
10.8MB

Download
memory/2196-3-0x000000001B450000-0x000000001B48C000-memory.dmp

Filesize
240KB

Download
memory/2196-4-0x000000001B860000-0x000000001B870000-memory.dmp

Filesize
64KB

Download
memory/2196-5-0x00007FFA7A880000-0x00007FFA7B341000-memory.dmp

Filesize
10.8MB

Download
memory/2196-6-0x00007FFA7A880000-0x00007FFA7B341000-memory.dmp

Filesize
10.8MB

Download