06b1c6433b1c6a6d56cf7e09c06c862550d868fc8e21c8e1832065f4a64fae3b

Analysis

max time kernel
139s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 16:34

Target

63fb5bd380bb02f45c15a8ac99ffc824_JaffaCakes118.exe
Size

345KB
MD5

63fb5bd380bb02f45c15a8ac99ffc824
SHA1

89ce48ae697537aa5033833fa4d420ef10e60e86
SHA256

06b1c6433b1c6a6d56cf7e09c06c862550d868fc8e21c8e1832065f4a64fae3b
SHA512

aab18f56d210ed68fee940e8fc42d437a95a26bf572a6f8f17208fa0e899a8a77a2cba68d0821c685ee78c0d143a13cdacdd6fc9aaab9e466579f119c6e37682
SSDEEP

6144:KNZd31PuSc5Y52Dt3VHhI1CztOz+PTdi2ltjv//E87YzTBIxEwzTVn:KTd31PuIqt3gCEzoR7YzTKV

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

63fb5bd380bb02f45c15a8ac99ffc824_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 2740 63fb5bd380bb02f45c15a8ac99ffc824_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2740	63fb5bd380bb02f45c15a8ac99ffc824_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\63fb5bd380bb02f45c15a8ac99ffc824_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\63fb5bd380bb02f45c15a8ac99ffc824_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2740

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3452,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:8
1⤵
PID:3852