Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
- submitted
03/05/2024, 17:49
General
- Target 1113c3fefdb898a291a838300249abc7_JaffaCakes118.exe
- Size 110KB
- Sample240503-wd133acb2x
- SHA256 0645c1fbf754107c5bd8169c125823a120cabbb285b024e43991736fbc357b9d
Malware Config
Extracted
-
njrat
-
0.6.4
-
WTFF
-
ftpx.myq-see.com:910
-
ba4c12bee3027d94da5c81db2d196bfd
-
reg_key
ba4c12bee3027d94da5c81db2d196bfd
-
splitter
|'|'|
Signatures
- njRAT/Bladabindi
Widely used RAT written in .NET.
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Modifies system certificate store 2 TTPs 6 IoCs
- Suspicious behavior: EnumeratesProcesses 48 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1113c3fefdb898a291a838300249abc7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1113c3fefdb898a291a838300249abc7_JaffaCakes118.exe"1⤵
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /create /TN "Updataas\AAMyname task" /XML "C:\Users\Admin\AppData\Local\Temp\x"2⤵
- Creates scheduled task(s)
-
-
C:\Windows\SYSTEM32\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\1113c3fefdb898a291a838300249abc7_JaffaCakes118.exe" "1113c3fefdb898a291a838300249abc7_JaffaCakes118.exe" ENABLE2⤵
- Modifies Windows Firewall
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
x
memory/1056-10-0x000000001C540000-0x000000001CA0E000-memory.dmp
memory/1056-9-0x000000001BFC0000-0x000000001C066000-memory.dmp
memory/1056-0-0x00007FFDAF065000-0x00007FFDAF066000-memory.dmp
memory/1056-11-0x000000001CB10000-0x000000001CBAC000-memory.dmp
memory/1056-13-0x000000001B820000-0x000000001B82E000-memory.dmp
memory/1056-1-0x00007FFDAEDB0000-0x00007FFDAF751000-memory.dmp
memory/1056-15-0x000000001B320000-0x000000001B328000-memory.dmp
memory/1056-16-0x00007FFDAEDB0000-0x00007FFDAF751000-memory.dmp
memory/1056-17-0x00007FFDAF065000-0x00007FFDAF066000-memory.dmp
memory/1056-18-0x00007FFDAEDB0000-0x00007FFDAF751000-memory.dmp
memory/1056-19-0x00007FFDAEDB0000-0x00007FFDAF751000-memory.dmp
memory/1056-20-0x00007FFDAEDB0000-0x00007FFDAF751000-memory.dmp