4a90928c20cc51b6f76ff9f198d134593e8d648c5182c9aa2d9444b7209e294f

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
28/06/2024, 13:10

Target

1a3e08d0b97edab244d52ea2917eb7bb_JaffaCakes118.exe
Size

293KB
MD5

1a3e08d0b97edab244d52ea2917eb7bb
SHA1

f6e0c0fd6e65a58a4053691a0526239602f7eb7e
SHA256

4a90928c20cc51b6f76ff9f198d134593e8d648c5182c9aa2d9444b7209e294f
SHA512

f1b8f4bd64e648c262a72684b2bd049aa1d30aad958bdcb3b9164379ec7450954d96f0ad787737ecc623c1f91162c0b8143eb8341faacfc2c6c6f050d7a34354
SSDEEP

3072:IKBT+z896tUNB1PxlcZE4sW81M/M+ZNK3er8D+BNLiiplEmj7o6+pSQeqe8vROqq:IKBsy1GYMnZ/r8aBtjPoOnDVp4G

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	1992	1a3e08d0b97edab244d52ea2917eb7bb_JaffaCakes118.exe
Token: SeBackupPrivilege	1992	1a3e08d0b97edab244d52ea2917eb7bb_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\1a3e08d0b97edab244d52ea2917eb7bb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1a3e08d0b97edab244d52ea2917eb7bb_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1992