d1a183de28605c9f9059074e109b08258f9465c569b425bb455f5b45738e5a40

Analysis

max time kernel
132s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 00:40

Target

6ccfa1230c8e15b13169d8539b7610cb_JaffaCakes118.exe
Size

4.3MB
MD5

6ccfa1230c8e15b13169d8539b7610cb
SHA1

e6d1cf527ead353d2521074ea962f25ec11f5335
SHA256

d1a183de28605c9f9059074e109b08258f9465c569b425bb455f5b45738e5a40
SHA512

169ed2b27545b2f924640601d41c43ff98f92389ee4e2c43b62f62913b8ba02eec043db5b51315f93a86ab26e71b587df4fb558138f280ced6460ddee99bd784
SSDEEP

98304:krH6MOgnq1A2k568zGMcDYHeOWvnIwKqE1CJYgmJ/:iHLq1e5C1UmnUqE1CJ/mp

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2420	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2420	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

C:\Users\Admin\AppData\Local\Temp\6ccfa1230c8e15b13169d8539b7610cb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6ccfa1230c8e15b13169d8539b7610cb_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1896

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4a0 0x3d8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2420