Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27/04/2024, 05:33
Static task
static1
Behavioral task
behavioral1
Sample
0289ca0e6a5378bb01d2fdb5c84aaf07_JaffaCakes118.exe
Resource
win7-20240220-en
General
-
Target
0289ca0e6a5378bb01d2fdb5c84aaf07_JaffaCakes118.exe
-
Size
472KB
-
MD5
0289ca0e6a5378bb01d2fdb5c84aaf07
-
SHA1
5f76ce7e0ffe97d949988974fb96f36b8d39cfd6
-
SHA256
b20b02e40ef6e17882c380a681278f21ccb3699847cb7f618b78f6be6ba63609
-
SHA512
974d923a74b145a9014e384e8f43812c170b40459055c974a420bc77b7f956c6469c9e01e66ec1ea0c3033c32eaf062c886195c39acbd87edb34dae7e40240e7
-
SSDEEP
6144:F5/ajfCT5B2VXdy1HsZVzJBTZYyk7i8IIlVR4dBicSka4GctucxFyaqjztgmM9g+:fmJBG/m05z7LeQia51fn698up
Malware Config
Extracted
njrat
0.7d
adobe
hakim32.ddns.net:2000
178.237.176.97:1604
70a2da185a5371de029662fd48a04b9b
-
reg_key
70a2da185a5371de029662fd48a04b9b
-
splitter
|'|'|
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation RegAsm.exe -
Executes dropped EXE 1 IoCs
pid Process 2932 server.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1800 set thread context of 3272 1800 0289ca0e6a5378bb01d2fdb5c84aaf07_JaffaCakes118.exe 92 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1800 0289ca0e6a5378bb01d2fdb5c84aaf07_JaffaCakes118.exe 1800 0289ca0e6a5378bb01d2fdb5c84aaf07_JaffaCakes118.exe 1800 0289ca0e6a5378bb01d2fdb5c84aaf07_JaffaCakes118.exe 1800 0289ca0e6a5378bb01d2fdb5c84aaf07_JaffaCakes118.exe 1800 0289ca0e6a5378bb01d2fdb5c84aaf07_JaffaCakes118.exe 1800 0289ca0e6a5378bb01d2fdb5c84aaf07_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1800 0289ca0e6a5378bb01d2fdb5c84aaf07_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1800 wrote to memory of 4020 1800 0289ca0e6a5378bb01d2fdb5c84aaf07_JaffaCakes118.exe 90 PID 1800 wrote to memory of 4020 1800 0289ca0e6a5378bb01d2fdb5c84aaf07_JaffaCakes118.exe 90 PID 1800 wrote to memory of 4020 1800 0289ca0e6a5378bb01d2fdb5c84aaf07_JaffaCakes118.exe 90 PID 1800 wrote to memory of 3156 1800 0289ca0e6a5378bb01d2fdb5c84aaf07_JaffaCakes118.exe 91 PID 1800 wrote to memory of 3156 1800 0289ca0e6a5378bb01d2fdb5c84aaf07_JaffaCakes118.exe 91 PID 1800 wrote to memory of 3156 1800 0289ca0e6a5378bb01d2fdb5c84aaf07_JaffaCakes118.exe 91 PID 1800 wrote to memory of 3272 1800 0289ca0e6a5378bb01d2fdb5c84aaf07_JaffaCakes118.exe 92 PID 1800 wrote to memory of 3272 1800 0289ca0e6a5378bb01d2fdb5c84aaf07_JaffaCakes118.exe 92 PID 1800 wrote to memory of 3272 1800 0289ca0e6a5378bb01d2fdb5c84aaf07_JaffaCakes118.exe 92 PID 1800 wrote to memory of 3272 1800 0289ca0e6a5378bb01d2fdb5c84aaf07_JaffaCakes118.exe 92 PID 1800 wrote to memory of 3272 1800 0289ca0e6a5378bb01d2fdb5c84aaf07_JaffaCakes118.exe 92 PID 1800 wrote to memory of 3272 1800 0289ca0e6a5378bb01d2fdb5c84aaf07_JaffaCakes118.exe 92 PID 1800 wrote to memory of 3272 1800 0289ca0e6a5378bb01d2fdb5c84aaf07_JaffaCakes118.exe 92 PID 3272 wrote to memory of 2932 3272 RegAsm.exe 93 PID 3272 wrote to memory of 2932 3272 RegAsm.exe 93 PID 3272 wrote to memory of 2932 3272 RegAsm.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\0289ca0e6a5378bb01d2fdb5c84aaf07_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0289ca0e6a5378bb01d2fdb5c84aaf07_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵PID:4020
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵PID:3156
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Users\Admin\AppData\Roaming\server.exe"C:\Users\Admin\AppData\Roaming\server.exe"3⤵
- Executes dropped EXE
PID:2932
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4112 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:81⤵PID:740
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
52KB
MD5a64daca3cfbcd039df3ec29d3eddd001
SHA1eee8b2573f71e8d5c3ee7e53af3e6772e090d0f3
SHA256403752009f29381d5e4036b8be94589c89188f9ce8ef5f86959eaaada019ed36
SHA512b6fe2d0ae3fcd4442579ecf10d498d61e0f042813c8fc4be8019da77d849cfcf0b168507139a1b5697227c272de9091788f8e03cf1ce13d5b5077568cfa6a479