23715fd798623d2b40bcd81e462bf391737daae2f5dec30409ade8cdc7cba4fb

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 15:38

Target

4a4d3b0550bed4ad33bee7ad6795e536_JaffaCakes118.exe
Size

86KB
MD5

4a4d3b0550bed4ad33bee7ad6795e536
SHA1

fd61d9e5801125227811147b6ec57c349cd6584c
SHA256

23715fd798623d2b40bcd81e462bf391737daae2f5dec30409ade8cdc7cba4fb
SHA512

f39b79801e289489cda01ed0d11471393fb313c7cd1da81702cc4bf48aa70637ed915b20f16b49af3da9f137e2998df6f40878da161dcda413c9eefc9ed60e8c
SSDEEP

1536:IutIK1iOmsWVSl8q0Q5Te2liSsAHXZkPN4UUlPtg/Ml3G7w6qPX5eJxGNJ+1:HgxdQT0QU2YwXu6blV4Ml76qfYJxG61

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4392	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4392	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\4a4d3b0550bed4ad33bee7ad6795e536_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4a4d3b0550bed4ad33bee7ad6795e536_JaffaCakes118.exe"
1⤵
PID:4748

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x500 0x514
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4392