2377caffc588b4d6cdf4da10d8bb436891675ab652abad77306b7292af781def

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 15:41

Target

63d3379d120c8d07efd112ac470d74f2_JaffaCakes118.exe
Size

289KB
MD5

63d3379d120c8d07efd112ac470d74f2
SHA1

3c5afd9f2c8ec48d6d32bee03c0e5a49728e5782
SHA256

2377caffc588b4d6cdf4da10d8bb436891675ab652abad77306b7292af781def
SHA512

38a6697db4352bc989577e4d18d6e80d7f23a7f26001f50f3a3132c35c17cd6d8fd151e25907114dd035194be33a12e3dfefae6d5e270c2dfd005fd7c2ab026d
SSDEEP

6144:fObSxo5BBDnFYTU5YouaKjwWGwtvYTB+LzGWS:2+xo5BBDCTU5YouaKjwWGwtvYTQeR

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

63d3379d120c8d07efd112ac470d74f2_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 2524 63d3379d120c8d07efd112ac470d74f2_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2524	63d3379d120c8d07efd112ac470d74f2_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\63d3379d120c8d07efd112ac470d74f2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\63d3379d120c8d07efd112ac470d74f2_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2524