Analysis
-
max time kernel
147s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-06-2024 18:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe
Resource
win7-20240221-en
2 signatures
150 seconds
General
-
Target
034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe
-
Size
150KB
-
MD5
034daff5b443407c84a4bc639d5e19f2
-
SHA1
eea87cc11f2f8ddd422582d84de58171d02153d6
-
SHA256
f780170cbcc07326cda96e3cd8364b2a28251c63888b0e5f1df98d8112994e08
-
SHA512
0d94ad8d4b4e9225efbec70894317ecbc73b65dff13094d9cdbd26140ef888fe7f929562402ccad49ed716c6b6f8ec3123e5dc7046f5b3f62a0ac243014a8da6
-
SSDEEP
384:chVohFaXjzJG3ePklL4Q+LRTS4MFI6/1L6w2DFikpcCRu9L1wwAf4J7FWbuHf5eh:cXOazk3kT8mk1H1hwB
Malware Config
Extracted
Family
njrat
Version
0.7d
Botnet
B HAT
Mutex
f9da7cbb82fc486c908ea82600db03cb
Attributes
-
reg_key
f9da7cbb82fc486c908ea82600db03cb
-
splitter
|'|'|
Signatures
-
Suspicious use of AdjustPrivilegeToken 37 IoCs
Processes:
034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 4860 034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe Token: 33 4860 034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4860 034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe Token: 33 4860 034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4860 034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe Token: 33 4860 034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4860 034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe Token: 33 4860 034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4860 034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe Token: 33 4860 034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4860 034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe Token: 33 4860 034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4860 034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe Token: 33 4860 034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4860 034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe Token: 33 4860 034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4860 034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe Token: 33 4860 034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4860 034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe Token: 33 4860 034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4860 034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe Token: 33 4860 034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4860 034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe Token: 33 4860 034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4860 034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe Token: 33 4860 034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4860 034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe Token: 33 4860 034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4860 034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe Token: 33 4860 034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4860 034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe Token: 33 4860 034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4860 034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe Token: 33 4860 034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4860 034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe Token: 33 4860 034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4860 034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe