16f997196440967c29729825b5595e088de23ee1c682640b86b1254f09e8ba4a

Analysis

max time kernel
125s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27/09/2024, 20:19

Target

fad8f7d1c0dacc4ef4fd015b905a63a1_JaffaCakes118.exe
Size

345KB
MD5

fad8f7d1c0dacc4ef4fd015b905a63a1
SHA1

0dff5931d557aacc6e823b688ba2116c7a4fe306
SHA256

16f997196440967c29729825b5595e088de23ee1c682640b86b1254f09e8ba4a
SHA512

4ac9ac9cf4b338b247cbde45cd84747c46b0db4b52ed688c334eba1d8f0fec846154c798969a9b037d92ab4efeb3a0b220790a06c694c37c5fafa37af047782f
SSDEEP

6144:HNZd31PuSc5Y52Dt3VHhI1CztOz+PTdi2ltjv//E87YzTBIxEwYTDV:HTd31PuIqt3gCEzoR7YzTKkV

Score

1^/10

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2548	fad8f7d1c0dacc4ef4fd015b905a63a1_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fad8f7d1c0dacc4ef4fd015b905a63a1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fad8f7d1c0dacc4ef4fd015b905a63a1_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1320,i,1330210614411927383,9239043499051775691,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:8
1⤵
PID:4148