Analysis
-
max time kernel
146s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06-09-2024 16:15
Behavioral task
behavioral1
Sample
cff16189d6cd2485a2a4aa7bb07e0190_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
cff16189d6cd2485a2a4aa7bb07e0190_JaffaCakes118.exe
-
Size
43KB
-
MD5
cff16189d6cd2485a2a4aa7bb07e0190
-
SHA1
93363c2f2104f320f4557231a943a438ccad3a94
-
SHA256
107c772ec8729d2a5bab2ff6fd28d559660a948b040b5b22ef2b3055cb082ae5
-
SHA512
6e8d2310bc86a071acaa2d47a3df731a3b49f7dff70be110efb32c4380f63e6523e9f28519244934914e646dc7a6201f5bc5a6d39c0c24533038051c3edff5ed
-
SSDEEP
384:BZy+Hl9n1iDcsyEqt3ptKwQsElGhOEazcIij+ZsNO3PlpJKkkjh/TzF7pWn5mgra:T99nU4pEqt5tKhohuuXQ/o8C+L
Malware Config
Extracted
njrat
Njrat 0.7 Golden By Hassan Amiri
HacKed
127.0.0.1:5552
Windows Update
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cff16189d6cd2485a2a4aa7bb07e0190_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4832 cff16189d6cd2485a2a4aa7bb07e0190_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeDebugPrivilege 4832 cff16189d6cd2485a2a4aa7bb07e0190_JaffaCakes118.exe Token: 33 4832 cff16189d6cd2485a2a4aa7bb07e0190_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4832 cff16189d6cd2485a2a4aa7bb07e0190_JaffaCakes118.exe Token: 33 4832 cff16189d6cd2485a2a4aa7bb07e0190_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4832 cff16189d6cd2485a2a4aa7bb07e0190_JaffaCakes118.exe Token: 33 4832 cff16189d6cd2485a2a4aa7bb07e0190_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4832 cff16189d6cd2485a2a4aa7bb07e0190_JaffaCakes118.exe Token: 33 4832 cff16189d6cd2485a2a4aa7bb07e0190_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4832 cff16189d6cd2485a2a4aa7bb07e0190_JaffaCakes118.exe Token: 33 4832 cff16189d6cd2485a2a4aa7bb07e0190_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4832 cff16189d6cd2485a2a4aa7bb07e0190_JaffaCakes118.exe Token: 33 4832 cff16189d6cd2485a2a4aa7bb07e0190_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4832 cff16189d6cd2485a2a4aa7bb07e0190_JaffaCakes118.exe Token: 33 4832 cff16189d6cd2485a2a4aa7bb07e0190_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4832 cff16189d6cd2485a2a4aa7bb07e0190_JaffaCakes118.exe Token: 33 4832 cff16189d6cd2485a2a4aa7bb07e0190_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4832 cff16189d6cd2485a2a4aa7bb07e0190_JaffaCakes118.exe Token: 33 4832 cff16189d6cd2485a2a4aa7bb07e0190_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4832 cff16189d6cd2485a2a4aa7bb07e0190_JaffaCakes118.exe Token: 33 4832 cff16189d6cd2485a2a4aa7bb07e0190_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4832 cff16189d6cd2485a2a4aa7bb07e0190_JaffaCakes118.exe Token: 33 4832 cff16189d6cd2485a2a4aa7bb07e0190_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4832 cff16189d6cd2485a2a4aa7bb07e0190_JaffaCakes118.exe Token: 33 4832 cff16189d6cd2485a2a4aa7bb07e0190_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4832 cff16189d6cd2485a2a4aa7bb07e0190_JaffaCakes118.exe Token: 33 4832 cff16189d6cd2485a2a4aa7bb07e0190_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4832 cff16189d6cd2485a2a4aa7bb07e0190_JaffaCakes118.exe Token: 33 4832 cff16189d6cd2485a2a4aa7bb07e0190_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4832 cff16189d6cd2485a2a4aa7bb07e0190_JaffaCakes118.exe Token: 33 4832 cff16189d6cd2485a2a4aa7bb07e0190_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4832 cff16189d6cd2485a2a4aa7bb07e0190_JaffaCakes118.exe Token: 33 4832 cff16189d6cd2485a2a4aa7bb07e0190_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4832 cff16189d6cd2485a2a4aa7bb07e0190_JaffaCakes118.exe Token: 33 4832 cff16189d6cd2485a2a4aa7bb07e0190_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4832 cff16189d6cd2485a2a4aa7bb07e0190_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cff16189d6cd2485a2a4aa7bb07e0190_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\cff16189d6cd2485a2a4aa7bb07e0190_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4832
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4344,i,10597648459838880772,16562651767759956329,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:81⤵PID:1204