152afffe59b832bf62335d9d1fd668b64bcd24986d1787e9f25e72fee6af002d

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
21/04/2024, 16:35

Target

ffb6b917b0ab99aaa122f05ff99b67b2_JaffaCakes118.exe
Size

345KB
MD5

ffb6b917b0ab99aaa122f05ff99b67b2
SHA1

888bc11e038f7523a98337389143f93e02118114
SHA256

152afffe59b832bf62335d9d1fd668b64bcd24986d1787e9f25e72fee6af002d
SHA512

a95d507293685db5d4e505eb26cd5e43e8c159cfb9ce0fc51019be7a2c04178f463c6f04b426344e39ce676a2c525d4a910ef736d5462f2beb57ff9e71d30d3d
SSDEEP

6144:JNZd31PuSc5Y52Dt3VHhI1CztOz+PTdi2ltjv//E87YzTBIxEwlT6:JTd31PuIqt3gCEzoR7YzTKA

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2060	ffb6b917b0ab99aaa122f05ff99b67b2_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ffb6b917b0ab99aaa122f05ff99b67b2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ffb6b917b0ab99aaa122f05ff99b67b2_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2060