Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07-05-2024 07:42
Behavioral task
behavioral1
Sample
1febff56b1d084aa07180b1023f74fcf_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1febff56b1d084aa07180b1023f74fcf_JaffaCakes118.exe
Resource
win10v2004-20240419-en
General
-
Target
1febff56b1d084aa07180b1023f74fcf_JaffaCakes118.exe
-
Size
340KB
-
MD5
1febff56b1d084aa07180b1023f74fcf
-
SHA1
b41264792c40e579aee3f322b56ecb02ca25731c
-
SHA256
b189c98026693dc35e6da2e8b54057891aba4f698330af3e40b4b9322e6fb9e8
-
SHA512
7cc5d819265e3ad4cfa882d596d52011ccbee6389fae9551c583633b2721d57e5c57bb7a243a611aa6bf4d7b04dd9778991ac1aedb28c3e0e3b957f8a870c088
-
SSDEEP
6144:QGRQziaMSeIzmO3eFs21iMk2UE0uon7BLL/nA:QGRQzRwUmO3f21beE0uQ5L
Malware Config
Extracted
njrat
0.6.4
تم الاختراق من قبل دكتور الغربية #
Dr187.ddns.net:999
59e66e4fd01ed7a53bb65713760bdb7d
-
reg_key
59e66e4fd01ed7a53bb65713760bdb7d
-
splitter
|'|'|
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 2576 netsh.exe -
Drops startup file 2 IoCs
Processes:
Google Root.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\59e66e4fd01ed7a53bb65713760bdb7d.exe Google Root.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\59e66e4fd01ed7a53bb65713760bdb7d.exe Google Root.exe -
Executes dropped EXE 1 IoCs
Processes:
Google Root.exepid process 2332 Google Root.exe -
Loads dropped DLL 1 IoCs
Processes:
1febff56b1d084aa07180b1023f74fcf_JaffaCakes118.exepid process 2988 1febff56b1d084aa07180b1023f74fcf_JaffaCakes118.exe -
Obfuscated with Agile.Net obfuscator 3 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral1/memory/2988-1-0x00000000002A0000-0x00000000002FA000-memory.dmp agile_net \Users\Admin\AppData\Local\Temp\Google Root.exe agile_net behavioral1/memory/2332-12-0x00000000010C0000-0x000000000111A000-memory.dmp agile_net -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Google Root.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\59e66e4fd01ed7a53bb65713760bdb7d = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Google Root.exe\" .." Google Root.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\59e66e4fd01ed7a53bb65713760bdb7d = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Google Root.exe\" .." Google Root.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 17 IoCs
Processes:
Google Root.exepid process 2332 Google Root.exe 2332 Google Root.exe 2332 Google Root.exe 2332 Google Root.exe 2332 Google Root.exe 2332 Google Root.exe 2332 Google Root.exe 2332 Google Root.exe 2332 Google Root.exe 2332 Google Root.exe 2332 Google Root.exe 2332 Google Root.exe 2332 Google Root.exe 2332 Google Root.exe 2332 Google Root.exe 2332 Google Root.exe 2332 Google Root.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Google Root.exedescription pid process Token: SeDebugPrivilege 2332 Google Root.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
1febff56b1d084aa07180b1023f74fcf_JaffaCakes118.exeGoogle Root.exedescription pid process target process PID 2988 wrote to memory of 2332 2988 1febff56b1d084aa07180b1023f74fcf_JaffaCakes118.exe Google Root.exe PID 2988 wrote to memory of 2332 2988 1febff56b1d084aa07180b1023f74fcf_JaffaCakes118.exe Google Root.exe PID 2988 wrote to memory of 2332 2988 1febff56b1d084aa07180b1023f74fcf_JaffaCakes118.exe Google Root.exe PID 2988 wrote to memory of 2332 2988 1febff56b1d084aa07180b1023f74fcf_JaffaCakes118.exe Google Root.exe PID 2332 wrote to memory of 2576 2332 Google Root.exe netsh.exe PID 2332 wrote to memory of 2576 2332 Google Root.exe netsh.exe PID 2332 wrote to memory of 2576 2332 Google Root.exe netsh.exe PID 2332 wrote to memory of 2576 2332 Google Root.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1febff56b1d084aa07180b1023f74fcf_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1febff56b1d084aa07180b1023f74fcf_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Google Root.exe"C:\Users\Admin\AppData\Local\Temp\Google Root.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Google Root.exe" "Google Root.exe" ENABLE3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\Google Root.exeFilesize
340KB
MD51febff56b1d084aa07180b1023f74fcf
SHA1b41264792c40e579aee3f322b56ecb02ca25731c
SHA256b189c98026693dc35e6da2e8b54057891aba4f698330af3e40b4b9322e6fb9e8
SHA5127cc5d819265e3ad4cfa882d596d52011ccbee6389fae9551c583633b2721d57e5c57bb7a243a611aa6bf4d7b04dd9778991ac1aedb28c3e0e3b957f8a870c088
-
memory/2332-13-0x0000000074B30000-0x000000007521E000-memory.dmpFilesize
6.9MB
-
memory/2332-12-0x00000000010C0000-0x000000000111A000-memory.dmpFilesize
360KB
-
memory/2332-14-0x0000000074B30000-0x000000007521E000-memory.dmpFilesize
6.9MB
-
memory/2332-16-0x0000000074B30000-0x000000007521E000-memory.dmpFilesize
6.9MB
-
memory/2332-17-0x0000000074B30000-0x000000007521E000-memory.dmpFilesize
6.9MB
-
memory/2988-0-0x0000000074B3E000-0x0000000074B3F000-memory.dmpFilesize
4KB
-
memory/2988-1-0x00000000002A0000-0x00000000002FA000-memory.dmpFilesize
360KB
-
memory/2988-2-0x0000000000290000-0x000000000029E000-memory.dmpFilesize
56KB
-
memory/2988-4-0x0000000074B30000-0x000000007521E000-memory.dmpFilesize
6.9MB
-
memory/2988-11-0x0000000074B30000-0x000000007521E000-memory.dmpFilesize
6.9MB