Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
08-09-2024 13:46
Behavioral task
behavioral1
Sample
d47fbeb49a10c2926021064f8ce49d83_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
d47fbeb49a10c2926021064f8ce49d83_JaffaCakes118.exe
-
Size
43KB
-
MD5
d47fbeb49a10c2926021064f8ce49d83
-
SHA1
317567bd34642481e5f11a6860d3444ce6abab11
-
SHA256
a9b931036bc698b2e4457eb87b95afe69c8739c33c8a62fbf2bfa7040874ec04
-
SHA512
cb452d0c55ab457ad3a8554ebd543afcacf089d62c1c4e1f6bcbb35f6a1b0f190cc1addeab36ec18c81c2b5e9028fd749fa6dff175e0a52d039bab54189b8676
-
SSDEEP
384:UZyfONUst+3gUy6Xf1+W+Ek1tJqzQIij+ZsNO3PlpJKkkjh/TzF7pWnBmgreT0pe:iZwQh6v19i14uXQ/oUC+L
Malware Config
Extracted
njrat
Njrat 0.7 Golden By Hassan Amiri
HacKed
elvincsgo.ddns.net:7777
Windows Update
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d47fbeb49a10c2926021064f8ce49d83_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 680 d47fbeb49a10c2926021064f8ce49d83_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeDebugPrivilege 680 d47fbeb49a10c2926021064f8ce49d83_JaffaCakes118.exe Token: 33 680 d47fbeb49a10c2926021064f8ce49d83_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 680 d47fbeb49a10c2926021064f8ce49d83_JaffaCakes118.exe Token: 33 680 d47fbeb49a10c2926021064f8ce49d83_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 680 d47fbeb49a10c2926021064f8ce49d83_JaffaCakes118.exe Token: 33 680 d47fbeb49a10c2926021064f8ce49d83_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 680 d47fbeb49a10c2926021064f8ce49d83_JaffaCakes118.exe Token: 33 680 d47fbeb49a10c2926021064f8ce49d83_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 680 d47fbeb49a10c2926021064f8ce49d83_JaffaCakes118.exe Token: 33 680 d47fbeb49a10c2926021064f8ce49d83_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 680 d47fbeb49a10c2926021064f8ce49d83_JaffaCakes118.exe Token: 33 680 d47fbeb49a10c2926021064f8ce49d83_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 680 d47fbeb49a10c2926021064f8ce49d83_JaffaCakes118.exe Token: 33 680 d47fbeb49a10c2926021064f8ce49d83_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 680 d47fbeb49a10c2926021064f8ce49d83_JaffaCakes118.exe Token: 33 680 d47fbeb49a10c2926021064f8ce49d83_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 680 d47fbeb49a10c2926021064f8ce49d83_JaffaCakes118.exe Token: 33 680 d47fbeb49a10c2926021064f8ce49d83_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 680 d47fbeb49a10c2926021064f8ce49d83_JaffaCakes118.exe Token: 33 680 d47fbeb49a10c2926021064f8ce49d83_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 680 d47fbeb49a10c2926021064f8ce49d83_JaffaCakes118.exe Token: 33 680 d47fbeb49a10c2926021064f8ce49d83_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 680 d47fbeb49a10c2926021064f8ce49d83_JaffaCakes118.exe Token: 33 680 d47fbeb49a10c2926021064f8ce49d83_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 680 d47fbeb49a10c2926021064f8ce49d83_JaffaCakes118.exe Token: 33 680 d47fbeb49a10c2926021064f8ce49d83_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 680 d47fbeb49a10c2926021064f8ce49d83_JaffaCakes118.exe Token: 33 680 d47fbeb49a10c2926021064f8ce49d83_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 680 d47fbeb49a10c2926021064f8ce49d83_JaffaCakes118.exe Token: 33 680 d47fbeb49a10c2926021064f8ce49d83_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 680 d47fbeb49a10c2926021064f8ce49d83_JaffaCakes118.exe Token: 33 680 d47fbeb49a10c2926021064f8ce49d83_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 680 d47fbeb49a10c2926021064f8ce49d83_JaffaCakes118.exe Token: 33 680 d47fbeb49a10c2926021064f8ce49d83_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 680 d47fbeb49a10c2926021064f8ce49d83_JaffaCakes118.exe Token: 33 680 d47fbeb49a10c2926021064f8ce49d83_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 680 d47fbeb49a10c2926021064f8ce49d83_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d47fbeb49a10c2926021064f8ce49d83_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d47fbeb49a10c2926021064f8ce49d83_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:680