6ce7d8117c492d6418ed866f5992afe38034d0653972153836e1f9cc3befcecf

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-09-2024 02:39

Target

ffca349e6cb0be4b045f28446a7c23b1_JaffaCakes118.exe
Size

25KB
MD5

ffca349e6cb0be4b045f28446a7c23b1
SHA1

ea32acca2ed6efda17a6e4ad0c3e8e63abe84a74
SHA256

6ce7d8117c492d6418ed866f5992afe38034d0653972153836e1f9cc3befcecf
SHA512

139ec7f70df59c7c4dc79b7e51b2f347be14a1a8aa4b44ad9dd717bea10f022ef0d3881cca543ed7d7421e27c6bbea9ba4d1d8a0caf55c5006c9f3881c0f84bc
SSDEEP

384:TzJk8llMl39GbYJnvaTuMOxiV+vogVSyLzVWnSpnwJiP:nigS9jnSV+iyPAnSpnwQ

Score

1^/10

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2656	ffca349e6cb0be4b045f28446a7c23b1_JaffaCakes118.exe
Token: SeRestorePrivilege	2656	ffca349e6cb0be4b045f28446a7c23b1_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ffca349e6cb0be4b045f28446a7c23b1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ffca349e6cb0be4b045f28446a7c23b1_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2656