Analysis
-
max time kernel
150s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2024 16:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe
Resource
win7-20240729-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe
-
Size
389KB
-
MD5
9c9394e5057101a3f4bbc2a643f23c0a
-
SHA1
f082e9ac2d0854ee09bae455999b08bd917b16a0
-
SHA256
c130ea959e49d716170b04de5e49c97d4bee1e54905a33f22fda80afcef1dd73
-
SHA512
5bc10b3fafc08ae316b9d7b510aea36b51238d33e729b4a3c1b428c6a1343f83f392012f081492086b76b903d5fb6f3eeb2a794ed20d1a72340936812dd9a785
-
SSDEEP
3072:kZ1y+XDKMV0TuSgJMtgtvom7iF44ERt+TLxGW2jKbgX2qBJqhlosmAJeliLIchWJ:kXzfJMtgtvom7e/LsWfbiBUIRAJelUc
Malware Config
Extracted
Family
njrat
Version
0.7d
Botnet
HacKed
C2
hakim32.ddns.net:2000
127.0.0.1:7777
Mutex
8ca5518ce78f280e51a1470fffc92c12
Attributes
-
reg_key
8ca5518ce78f280e51a1470fffc92c12
-
splitter
|'|'|
Signatures
-
Njrat family
-
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid Process 2644 netsh.exe -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
Processes:
netsh.exedescription ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exepid Process 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exepid Process 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 37 IoCs
Processes:
9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exedescription pid Process Token: SeDebugPrivilege 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe Token: 33 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe Token: 33 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe Token: 33 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe Token: 33 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe Token: 33 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe Token: 33 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe Token: 33 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe Token: 33 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe Token: 33 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe Token: 33 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe Token: 33 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe Token: 33 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe Token: 33 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe Token: 33 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe Token: 33 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe Token: 33 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe Token: 33 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe Token: 33 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exedescription pid Process procid_target PID 1368 wrote to memory of 2644 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 82 PID 1368 wrote to memory of 2644 1368 9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Windows\SYSTEM32\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe" "9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2644
-