4d6acd55bdee22203875788e127e108ef586b61113c4cbea857593de218d59c5

Analysis

max time kernel
140s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 06:45

Target

5ade05753a784e5494a852502b1a3016_JaffaCakes118.exe
Size

72KB
MD5

5ade05753a784e5494a852502b1a3016
SHA1

e9373028808e6243982f1831f2b010686d619101
SHA256

4d6acd55bdee22203875788e127e108ef586b61113c4cbea857593de218d59c5
SHA512

dbb38722a624f6beeff3d0d2ad016e510262b45f477f67c94fe84c5c34ac62739e9a2553ce3ffa991d7a8ef252efb29a84678916132809c7ef9d3a130dd05d77
SSDEEP

768:/qieBvsCXKt1uTxCJJuVfEplURTKtiBvsCU:/qieBsCXKPBJVURTKIBsCU

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	920	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	920	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 3 IoCs

C:\Users\Admin\AppData\Local\Temp\5ade05753a784e5494a852502b1a3016_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\5ade05753a784e5494a852502b1a3016_JaffaCakes118.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2832

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3cc 0x2fc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:920