Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27/04/2024, 06:55
Static task
static1
Behavioral task
behavioral1
Sample
02abaeefe6589e5ccee65d47eba749a7_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
02abaeefe6589e5ccee65d47eba749a7_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
02abaeefe6589e5ccee65d47eba749a7_JaffaCakes118.exe
-
Size
211KB
-
MD5
02abaeefe6589e5ccee65d47eba749a7
-
SHA1
b25cf7475351f1f9b205954d751041329b75d8d9
-
SHA256
c8ddf513dad4e319e738bad058a5ff1432057fab3f34f5402325b9e83909d864
-
SHA512
ebebac6c46754c3f2eb2b67f3cc47bc038ea2e66d88dcbae047d15424d4cd344022a8337a102c0bc22c5e657e217286a6bcdba146649573ba4d02c964f27457c
-
SSDEEP
1536:keZN1s3o5pMCgNlWnkEU2jKIUhycIIWBjSWD7yayIFbJmLvEVJHrwmO:kuvp5KNlc1jKjycIIWtDlfmLvQLw
Malware Config
Extracted
njrat
0.7d
Last
recreciptor.hopto.org:2255
63951ff13995ee572862321383fecced
-
reg_key
63951ff13995ee572862321383fecced
-
splitter
|'|'|
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2340 netsh.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\63951ff13995ee572862321383fecced.exe VIP72.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\63951ff13995ee572862321383fecced.exe VIP72.exe -
Executes dropped EXE 1 IoCs
pid Process 2928 VIP72.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\63951ff13995ee572862321383fecced = "\"C:\\Users\\Admin\\AppData\\Roaming\\VIP72.exe\" .." VIP72.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\63951ff13995ee572862321383fecced = "\"C:\\Users\\Admin\\AppData\\Roaming\\VIP72.exe\" .." VIP72.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeDebugPrivilege 2928 VIP72.exe Token: 33 2928 VIP72.exe Token: SeIncBasePriorityPrivilege 2928 VIP72.exe Token: 33 2928 VIP72.exe Token: SeIncBasePriorityPrivilege 2928 VIP72.exe Token: 33 2928 VIP72.exe Token: SeIncBasePriorityPrivilege 2928 VIP72.exe Token: 33 2928 VIP72.exe Token: SeIncBasePriorityPrivilege 2928 VIP72.exe Token: 33 2928 VIP72.exe Token: SeIncBasePriorityPrivilege 2928 VIP72.exe Token: 33 2928 VIP72.exe Token: SeIncBasePriorityPrivilege 2928 VIP72.exe Token: 33 2928 VIP72.exe Token: SeIncBasePriorityPrivilege 2928 VIP72.exe Token: 33 2928 VIP72.exe Token: SeIncBasePriorityPrivilege 2928 VIP72.exe Token: 33 2928 VIP72.exe Token: SeIncBasePriorityPrivilege 2928 VIP72.exe Token: 33 2928 VIP72.exe Token: SeIncBasePriorityPrivilege 2928 VIP72.exe Token: 33 2928 VIP72.exe Token: SeIncBasePriorityPrivilege 2928 VIP72.exe Token: 33 2928 VIP72.exe Token: SeIncBasePriorityPrivilege 2928 VIP72.exe Token: 33 2928 VIP72.exe Token: SeIncBasePriorityPrivilege 2928 VIP72.exe Token: 33 2928 VIP72.exe Token: SeIncBasePriorityPrivilege 2928 VIP72.exe Token: 33 2928 VIP72.exe Token: SeIncBasePriorityPrivilege 2928 VIP72.exe Token: 33 2928 VIP72.exe Token: SeIncBasePriorityPrivilege 2928 VIP72.exe Token: 33 2928 VIP72.exe Token: SeIncBasePriorityPrivilege 2928 VIP72.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2084 wrote to memory of 2928 2084 02abaeefe6589e5ccee65d47eba749a7_JaffaCakes118.exe 28 PID 2084 wrote to memory of 2928 2084 02abaeefe6589e5ccee65d47eba749a7_JaffaCakes118.exe 28 PID 2084 wrote to memory of 2928 2084 02abaeefe6589e5ccee65d47eba749a7_JaffaCakes118.exe 28 PID 2928 wrote to memory of 2340 2928 VIP72.exe 29 PID 2928 wrote to memory of 2340 2928 VIP72.exe 29 PID 2928 wrote to memory of 2340 2928 VIP72.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\02abaeefe6589e5ccee65d47eba749a7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\02abaeefe6589e5ccee65d47eba749a7_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Roaming\VIP72.exe"C:\Users\Admin\AppData\Roaming\VIP72.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\system32\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\VIP72.exe" "VIP72.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:2340
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
211KB
MD502abaeefe6589e5ccee65d47eba749a7
SHA1b25cf7475351f1f9b205954d751041329b75d8d9
SHA256c8ddf513dad4e319e738bad058a5ff1432057fab3f34f5402325b9e83909d864
SHA512ebebac6c46754c3f2eb2b67f3cc47bc038ea2e66d88dcbae047d15424d4cd344022a8337a102c0bc22c5e657e217286a6bcdba146649573ba4d02c964f27457c