Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/04/2024, 02:19

General

  • Target

    0428ff225e18a0e79774b8f1b0c30b80_JaffaCakes118.exe

  • Size

    270KB

  • MD5

    0428ff225e18a0e79774b8f1b0c30b80

  • SHA1

    806413191e59a704f26287aa5b0136d64dd2f30b

  • SHA256

    54f0b6b1c309caccd02bab4a0013277e9f1ffde051fd2e45a59d784d1f425563

  • SHA512

    66e69515691834cb8e143e65addfbd5e1368a173da697614adb8c4b15f046aadabb15e93c0809708a0a82f7f59781ca74169756cd7012199e5c753ef502b2b86

  • SSDEEP

    3072:WxNvADAOY5ZMb7kj92vW1gowzSRtqBP0u+BqNfzUubhpgeUATDPYiPzXGw2:WvveAb7MUgW1aBPUBqzb0ATDPbPD2

Score
10/10

Malware Config

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Delays execution with timeout.exe 1 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0428ff225e18a0e79774b8f1b0c30b80_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0428ff225e18a0e79774b8f1b0c30b80_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:912
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe"
      2⤵
      • NTFS ADS
      • Suspicious use of WriteProcessMemory
      PID:3780
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\chorme\chormee.exe.lnk" /f
        3⤵
          PID:2436
      • C:\Users\Admin\AppData\Roaming\tmp.exe
        "C:\Users\Admin\AppData\Roaming\tmp.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:408
        • C:\Windows\SysWOW64\netsh.exe
          netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\tmp.exe" "tmp.exe" ENABLE
          3⤵
          • Modifies Windows Firewall
          PID:2276
      • C:\Users\Admin\AppData\Local\Temp\svhost.exe
        "C:\Users\Admin\AppData\Local\Temp\svhost.exe"
        2⤵
        • Executes dropped EXE
        PID:3876
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\chorme\chormee.exe.bat
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2108
        • C:\Windows\SysWOW64\timeout.exe
          timeout /t 300
          3⤵
          • Delays execution with timeout.exe
          PID:3560

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\chorme\chormee.exe.bat

      Filesize

      194B

      MD5

      609f21988eae322f33f775df1cee0481

      SHA1

      30b3f2bdab680ffd92ac2cd248a6af3cdfcddd01

      SHA256

      4891ae96168de7eb45ea4d17bdbd31ea8b29124163e3d982f4f6f120ff07e487

      SHA512

      061d3896c955966feae7c4f698d7e313439586c9c300a763769f1f9fa58068a68766824a970df9f3f56ee1bab32685109eed4e928b15be8445d93602be2efadb

    • C:\Users\Admin\AppData\Local\Temp\chorme\chormee.exe.jpg

      Filesize

      270KB

      MD5

      0428ff225e18a0e79774b8f1b0c30b80

      SHA1

      806413191e59a704f26287aa5b0136d64dd2f30b

      SHA256

      54f0b6b1c309caccd02bab4a0013277e9f1ffde051fd2e45a59d784d1f425563

      SHA512

      66e69515691834cb8e143e65addfbd5e1368a173da697614adb8c4b15f046aadabb15e93c0809708a0a82f7f59781ca74169756cd7012199e5c753ef502b2b86

    • C:\Users\Admin\AppData\Local\Temp\svhost.exe

      Filesize

      89KB

      MD5

      84c42d0f2c1ae761bef884638bc1eacd

      SHA1

      4353881e7f4e9c7610f4e0489183b55bb58bb574

      SHA256

      331487446653875bf1e628b797a5283e40056654f7ff328eafbe39b0304480d3

      SHA512

      43c307a38faa3a4b311597034cf75035a4434a1024d2a54e867e6a94b53b677898d71a858438d119000e872a7a6e92c5b31d277a8c207a94375ed4fd3c7beb87

    • C:\Users\Admin\AppData\Roaming\tmp.exe

      Filesize

      23KB

      MD5

      2177a5b2d4432d38ff059f9feb9b560f

      SHA1

      e7c62227fa5fc416cd6d0bb4fec2dc34057130f9

      SHA256

      76e3aa841279c976da1f37a675960dd7fcf119ef65bbe36764af1e4437c05bbf

      SHA512

      5c6adffad74eaa7d7ba418d1b7e2ee64d57036c0b25227746799e65e3f76817393f3416e382e13c3e179c9a9015530e5d0a791c42e83e8618398ee42d03fbfe3

    • memory/408-24-0x0000000074F20000-0x00000000754D1000-memory.dmp

      Filesize

      5.7MB

    • memory/408-25-0x00000000010A0000-0x00000000010B0000-memory.dmp

      Filesize

      64KB

    • memory/408-26-0x0000000074F20000-0x00000000754D1000-memory.dmp

      Filesize

      5.7MB

    • memory/408-34-0x0000000074F20000-0x00000000754D1000-memory.dmp

      Filesize

      5.7MB

    • memory/408-35-0x0000000074F20000-0x00000000754D1000-memory.dmp

      Filesize

      5.7MB

    • memory/912-2-0x0000000000BF0000-0x0000000000C00000-memory.dmp

      Filesize

      64KB

    • memory/912-0-0x0000000074F20000-0x00000000754D1000-memory.dmp

      Filesize

      5.7MB

    • memory/912-1-0x0000000074F20000-0x00000000754D1000-memory.dmp

      Filesize

      5.7MB

    • memory/912-33-0x0000000074F20000-0x00000000754D1000-memory.dmp

      Filesize

      5.7MB

    • memory/3876-27-0x0000000074F20000-0x00000000754D1000-memory.dmp

      Filesize

      5.7MB

    • memory/3876-32-0x0000000074F20000-0x00000000754D1000-memory.dmp

      Filesize

      5.7MB