Analysis
-
max time kernel
148s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09-10-2024 02:35
Static task
static1
Behavioral task
behavioral1
Sample
294bb415cf869002e3d282457cee2e2b_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
294bb415cf869002e3d282457cee2e2b_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
294bb415cf869002e3d282457cee2e2b_JaffaCakes118.exe
-
Size
568KB
-
MD5
294bb415cf869002e3d282457cee2e2b
-
SHA1
a7c5b5871a5fd7e232af903fbd4a08c525a227fd
-
SHA256
65606c3b5d0e650ce671562b90c14199c67e28aaf8dd9779da5dbd85d946b355
-
SHA512
23094c90e55143ff7bd549297eb4924c117cb65e3bcd1cd5a1ecad01fe00c234f3138eaa32671213c992c81468e70ccd67d529ddaa4f4dc29c2b1eefc1830f9d
-
SSDEEP
6144:Mg+b9gCxNsTmg4yCOKV6Evwoe+wiMT6wIx1f:Mg293Ey6Evwoe+wiMS1
Malware Config
Extracted
njrat
0.7d
HacKed
127.0.0.1:5552
7b1cba4c2fd49c8ec47f2b8a10ea378a
-
reg_key
7b1cba4c2fd49c8ec47f2b8a10ea378a
-
splitter
|'|'|
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2052 netsh.exe -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeDebugPrivilege 4508 294bb415cf869002e3d282457cee2e2b_JaffaCakes118.exe Token: 33 4508 294bb415cf869002e3d282457cee2e2b_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4508 294bb415cf869002e3d282457cee2e2b_JaffaCakes118.exe Token: 33 4508 294bb415cf869002e3d282457cee2e2b_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4508 294bb415cf869002e3d282457cee2e2b_JaffaCakes118.exe Token: 33 4508 294bb415cf869002e3d282457cee2e2b_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4508 294bb415cf869002e3d282457cee2e2b_JaffaCakes118.exe Token: 33 4508 294bb415cf869002e3d282457cee2e2b_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4508 294bb415cf869002e3d282457cee2e2b_JaffaCakes118.exe Token: 33 4508 294bb415cf869002e3d282457cee2e2b_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4508 294bb415cf869002e3d282457cee2e2b_JaffaCakes118.exe Token: 33 4508 294bb415cf869002e3d282457cee2e2b_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4508 294bb415cf869002e3d282457cee2e2b_JaffaCakes118.exe Token: 33 4508 294bb415cf869002e3d282457cee2e2b_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4508 294bb415cf869002e3d282457cee2e2b_JaffaCakes118.exe Token: 33 4508 294bb415cf869002e3d282457cee2e2b_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4508 294bb415cf869002e3d282457cee2e2b_JaffaCakes118.exe Token: 33 4508 294bb415cf869002e3d282457cee2e2b_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4508 294bb415cf869002e3d282457cee2e2b_JaffaCakes118.exe Token: 33 4508 294bb415cf869002e3d282457cee2e2b_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4508 294bb415cf869002e3d282457cee2e2b_JaffaCakes118.exe Token: 33 4508 294bb415cf869002e3d282457cee2e2b_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4508 294bb415cf869002e3d282457cee2e2b_JaffaCakes118.exe Token: 33 4508 294bb415cf869002e3d282457cee2e2b_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4508 294bb415cf869002e3d282457cee2e2b_JaffaCakes118.exe Token: 33 4508 294bb415cf869002e3d282457cee2e2b_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4508 294bb415cf869002e3d282457cee2e2b_JaffaCakes118.exe Token: 33 4508 294bb415cf869002e3d282457cee2e2b_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4508 294bb415cf869002e3d282457cee2e2b_JaffaCakes118.exe Token: 33 4508 294bb415cf869002e3d282457cee2e2b_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4508 294bb415cf869002e3d282457cee2e2b_JaffaCakes118.exe Token: 33 4508 294bb415cf869002e3d282457cee2e2b_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4508 294bb415cf869002e3d282457cee2e2b_JaffaCakes118.exe Token: 33 4508 294bb415cf869002e3d282457cee2e2b_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4508 294bb415cf869002e3d282457cee2e2b_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4508 wrote to memory of 2052 4508 294bb415cf869002e3d282457cee2e2b_JaffaCakes118.exe 85 PID 4508 wrote to memory of 2052 4508 294bb415cf869002e3d282457cee2e2b_JaffaCakes118.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\294bb415cf869002e3d282457cee2e2b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\294bb415cf869002e3d282457cee2e2b_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Windows\SYSTEM32\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\294bb415cf869002e3d282457cee2e2b_JaffaCakes118.exe" "294bb415cf869002e3d282457cee2e2b_JaffaCakes118.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2052
-