141521832b15b1f612ce0e631f60f9a9767b16238a48d96ba971fbc96100ee34

Analysis

max time kernel
41s
max time network
46s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 01:47

Target

2a8faca4ca0ff43cc3ff07db10f9d003_JaffaCakes118.exe
Size

26KB
MD5

2a8faca4ca0ff43cc3ff07db10f9d003
SHA1

17e343aee62319a0e52b67ffb636c99bc9f3a5e1
SHA256

141521832b15b1f612ce0e631f60f9a9767b16238a48d96ba971fbc96100ee34
SHA512

939647f51776eca67041a8d54d5f36e2e76eac9c1eb17f57bf3a9a50da8bb0a382079e230828145b5877c267291db80471c165ddd31fb4ae8ef50f72af0e29ff
SSDEEP

768:2aZKoM5IDwZ9xp4xR0fRSHsSXcwenxseyMZ4pKY:DZKoM2DwAxR05SMgGxseH4Z

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	920	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	920	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\2a8faca4ca0ff43cc3ff07db10f9d003_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2a8faca4ca0ff43cc3ff07db10f9d003_JaffaCakes118.exe"
1⤵
PID:1320

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x498 0x43c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:920