af9cf11ee5ca86dc049a9f6fe7bc51ca1b902075a86bce865f2bfc7fde871617

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 06:04

Target

2f3d372c9684999f31a335e6653ee1c1_JaffaCakes118.exe
Size

15KB
MD5

2f3d372c9684999f31a335e6653ee1c1
SHA1

b1ae63a87cf9ed4945605712bcd36021b9111f2c
SHA256

af9cf11ee5ca86dc049a9f6fe7bc51ca1b902075a86bce865f2bfc7fde871617
SHA512

ac5454e2e12ba268ca507bdfcfa382007d9d3fffe7f732aad79b28553dc23a30bf355cea84482c192870efa41bfdb1aa8b893e63b4465d47fc1ba96440276aaf
SSDEEP

384:RZtFLnYRJbeWBumjJ0UR6607chAmonD7/s3Oh:HtNnYOW7eGD07HRnDzs3Oh

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1964	2f3d372c9684999f31a335e6653ee1c1_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\2f3d372c9684999f31a335e6653ee1c1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2f3d372c9684999f31a335e6653ee1c1_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1964