c86cb52a7f1c5dfd4a52ec9eae315b4ef460d10af9586948da684fcbfc57cced

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 01:56

Target

47bbf03bba7ec87e97724fa3a4695512_JaffaCakes118.exe
Size

72KB
MD5

47bbf03bba7ec87e97724fa3a4695512
SHA1

1ae39e4d3cf7675196cf651da2ffacefb8399bf8
SHA256

c86cb52a7f1c5dfd4a52ec9eae315b4ef460d10af9586948da684fcbfc57cced
SHA512

b1a37fe53c67916e6a3533949938f636b3e4a604b192a492b3604a247e4244f9bc27550bc6060cf1cb2655feba8ca51d74be6ab2aefbd440b5da580f4463544b
SSDEEP

1536:6VOmCcLFaqvuKDf9RjctMEIp9jXZc9a8oRBIAskHEr/W4zhD0:1mIgZctFkJXZSRrkHEr/WmhD0

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	5036	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5036	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\47bbf03bba7ec87e97724fa3a4695512_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\47bbf03bba7ec87e97724fa3a4695512_JaffaCakes118.exe"
1⤵
PID:4104

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x244 0x2f4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5036