Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    17-04-2024 03:27

General

  • Target

    f4ef4c394d0ca5d493b584b0d6f7a08d_JaffaCakes118.exe

  • Size

    120KB

  • MD5

    f4ef4c394d0ca5d493b584b0d6f7a08d

  • SHA1

    3ec040c1ac1a4c72430e70505746d69c1379c7f4

  • SHA256

    f82488b7580088ef97f7eb9112a860ebd7c67489b40e23971e37acdfc6bbf0a3

  • SHA512

    a44460b7edbc0761a12457fc27627dc7bc28820fd8b48412e12e1d13aabac1f146cba147d61afbe43c0a39cfc90367aa49667ee6717cda5b57757353d7a7cd06

  • SSDEEP

    1536:9qNkaWgQKUFftuITp1+8+CthPXstugIaFVIFEKFR59vEcqrmqwfzy9KJsz:o/WXPD+8TXM9F+EO595qrb9y

Malware Config

Extracted

Family

njrat

Version

v2.0

Botnet

HacKed

C2

107.152.99.41:54893

Mutex

Windows

Attributes
  • reg_key

    Windows

  • splitter

    |-F-|

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Drops startup file 6 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f4ef4c394d0ca5d493b584b0d6f7a08d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f4ef4c394d0ca5d493b584b0d6f7a08d_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1048
    • C:\Users\Admin\AppData\Local\Temp\tmp3D10.tmphjgcdkzzlzn.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp3D10.tmphjgcdkzzlzn.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2964
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe"
        3⤵
        • Drops startup file
        • Views/modifies file attributes
        PID:2540
      • C:\Windows\SysWOW64\attrib.exe
        attrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.exe"
        3⤵
        • Views/modifies file attributes
        PID:2588
    • C:\Users\Admin\AppData\Local\Temp\tmp3DDC.tmpxiehdojqwgdwfoy.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp3DDC.tmpxiehdojqwgdwfoy.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2960
      • C:\Windows\system32\netsh.exe
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\tmp3DDC.tmpxiehdojqwgdwfoy.exe" "tmp3DDC.tmpxiehdojqwgdwfoy.exe" ENABLE
        3⤵
        • Modifies Windows Firewall
        PID:2440

Network

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

1
T1112

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp3D10.tmphjgcdkzzlzn.exe
    Filesize

    27KB

    MD5

    c02d456f4a45039d08027055d44eafed

    SHA1

    a29630fd9e2b16b5dedf690a3fe6b972149f7782

    SHA256

    9f33ffec778fb87cece32d085b9dd91091fc5b5dc0d5babf4cf14db18b557ebf

    SHA512

    c36bfe2145274d526aeb81e11840636564b569289d60ccdc1efdaf1dd09d5d00fd277d62bd218ad8686bf923b934039e643237dced3893996a63e1b050ce4a74

  • C:\Users\Admin\AppData\Local\Temp\tmp3DDC.tmpxiehdojqwgdwfoy.exe
    Filesize

    71KB

    MD5

    53824bb4380d5ba3b4024322f157d467

    SHA1

    e2b5fa8dcd0eb30ba0d16f7917aad9da2c6efb68

    SHA256

    f0656c1cfecf896870c8852213507b50341d939a09abb0c7ea3b0b6121b749a2

    SHA512

    a0f2be05bf7f45553735583265531a6731ba49166d7b864d50ebbcca2bbcfd993cca4f2e47ce9011718c2629f3a073862d312ce34c1c3d452ccfb1e7f4023097

  • memory/1048-15-0x000007FEF5EB0000-0x000007FEF684D000-memory.dmp
    Filesize

    9.6MB

  • memory/1048-2-0x0000000002060000-0x00000000020E0000-memory.dmp
    Filesize

    512KB

  • memory/1048-1-0x000007FEF5EB0000-0x000007FEF684D000-memory.dmp
    Filesize

    9.6MB

  • memory/2960-25-0x0000000000A60000-0x0000000000AE0000-memory.dmp
    Filesize

    512KB

  • memory/2960-16-0x000007FEF5EB0000-0x000007FEF684D000-memory.dmp
    Filesize

    9.6MB

  • memory/2960-14-0x0000000000A60000-0x0000000000AE0000-memory.dmp
    Filesize

    512KB

  • memory/2960-20-0x0000000000640000-0x000000000064E000-memory.dmp
    Filesize

    56KB

  • memory/2960-13-0x000007FEF5EB0000-0x000007FEF684D000-memory.dmp
    Filesize

    9.6MB

  • memory/2960-31-0x000007FEF5EB0000-0x000007FEF684D000-memory.dmp
    Filesize

    9.6MB

  • memory/2960-32-0x0000000000A60000-0x0000000000AE0000-memory.dmp
    Filesize

    512KB

  • memory/2964-19-0x0000000000CC0000-0x0000000000D00000-memory.dmp
    Filesize

    256KB

  • memory/2964-18-0x0000000074DE0000-0x000000007538B000-memory.dmp
    Filesize

    5.7MB

  • memory/2964-17-0x0000000074DE0000-0x000000007538B000-memory.dmp
    Filesize

    5.7MB

  • memory/2964-33-0x0000000074DE0000-0x000000007538B000-memory.dmp
    Filesize

    5.7MB

  • memory/2964-34-0x0000000074DE0000-0x000000007538B000-memory.dmp
    Filesize

    5.7MB

  • memory/2964-35-0x0000000000CC0000-0x0000000000D00000-memory.dmp
    Filesize

    256KB