Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 17:16
Behavioral task
behavioral1
Sample
641bf525a313f41f133cd1db2d07da2b_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
641bf525a313f41f133cd1db2d07da2b_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
641bf525a313f41f133cd1db2d07da2b_JaffaCakes118.exe
-
Size
43KB
-
MD5
641bf525a313f41f133cd1db2d07da2b
-
SHA1
2da56f55034be144ba85cc9c83af4f09aa591c9e
-
SHA256
1f399125ae166a61b9715467bad99e63466e9d68860f29442479d4dd179577d6
-
SHA512
4921b7ebc833558546b382d8c904628b25176f4580cbc38f4eb4271722f63486dfea56da5b5645b3c18f8893ef552c87309802ae6ccb17dda181ccad329fb5cb
-
SSDEEP
384:+ZybZIBK0lwZmoy7xir6ikuEhxiDUaXzoIij+ZsNO3PlpJKkkjh/TzF7pWnB/grq:Es0tGol786b4DDuXQ/oc/+L
Malware Config
Extracted
njrat
Njrat 0.7 Golden By Hassan Amiri
HacKed
127.0.0.1:5552
Windows Update
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
-
Drops startup file 2 IoCs
Processes:
pashat.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe pashat.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe pashat.exe -
Executes dropped EXE 3 IoCs
Processes:
pashat.exeServer.exeServer.exepid process 2968 pashat.exe 1988 Server.exe 1504 Server.exe -
Loads dropped DLL 1 IoCs
Processes:
641bf525a313f41f133cd1db2d07da2b_JaffaCakes118.exepid process 2032 641bf525a313f41f133cd1db2d07da2b_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
pashat.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\pashat.exe\" .." pashat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\pashat.exe\" .." pashat.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
641bf525a313f41f133cd1db2d07da2b_JaffaCakes118.exepashat.exepid process 2032 641bf525a313f41f133cd1db2d07da2b_JaffaCakes118.exe 2968 pashat.exe -
Suspicious use of AdjustPrivilegeToken 33 IoCs
Processes:
pashat.exedescription pid process Token: SeDebugPrivilege 2968 pashat.exe Token: 33 2968 pashat.exe Token: SeIncBasePriorityPrivilege 2968 pashat.exe Token: 33 2968 pashat.exe Token: SeIncBasePriorityPrivilege 2968 pashat.exe Token: 33 2968 pashat.exe Token: SeIncBasePriorityPrivilege 2968 pashat.exe Token: 33 2968 pashat.exe Token: SeIncBasePriorityPrivilege 2968 pashat.exe Token: 33 2968 pashat.exe Token: SeIncBasePriorityPrivilege 2968 pashat.exe Token: 33 2968 pashat.exe Token: SeIncBasePriorityPrivilege 2968 pashat.exe Token: 33 2968 pashat.exe Token: SeIncBasePriorityPrivilege 2968 pashat.exe Token: 33 2968 pashat.exe Token: SeIncBasePriorityPrivilege 2968 pashat.exe Token: 33 2968 pashat.exe Token: SeIncBasePriorityPrivilege 2968 pashat.exe Token: 33 2968 pashat.exe Token: SeIncBasePriorityPrivilege 2968 pashat.exe Token: 33 2968 pashat.exe Token: SeIncBasePriorityPrivilege 2968 pashat.exe Token: 33 2968 pashat.exe Token: SeIncBasePriorityPrivilege 2968 pashat.exe Token: 33 2968 pashat.exe Token: SeIncBasePriorityPrivilege 2968 pashat.exe Token: 33 2968 pashat.exe Token: SeIncBasePriorityPrivilege 2968 pashat.exe Token: 33 2968 pashat.exe Token: SeIncBasePriorityPrivilege 2968 pashat.exe Token: 33 2968 pashat.exe Token: SeIncBasePriorityPrivilege 2968 pashat.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
641bf525a313f41f133cd1db2d07da2b_JaffaCakes118.exepashat.exetaskeng.exedescription pid process target process PID 2032 wrote to memory of 2968 2032 641bf525a313f41f133cd1db2d07da2b_JaffaCakes118.exe pashat.exe PID 2032 wrote to memory of 2968 2032 641bf525a313f41f133cd1db2d07da2b_JaffaCakes118.exe pashat.exe PID 2032 wrote to memory of 2968 2032 641bf525a313f41f133cd1db2d07da2b_JaffaCakes118.exe pashat.exe PID 2032 wrote to memory of 2968 2032 641bf525a313f41f133cd1db2d07da2b_JaffaCakes118.exe pashat.exe PID 2968 wrote to memory of 2596 2968 pashat.exe schtasks.exe PID 2968 wrote to memory of 2596 2968 pashat.exe schtasks.exe PID 2968 wrote to memory of 2596 2968 pashat.exe schtasks.exe PID 2968 wrote to memory of 2596 2968 pashat.exe schtasks.exe PID 2776 wrote to memory of 1988 2776 taskeng.exe Server.exe PID 2776 wrote to memory of 1988 2776 taskeng.exe Server.exe PID 2776 wrote to memory of 1988 2776 taskeng.exe Server.exe PID 2776 wrote to memory of 1988 2776 taskeng.exe Server.exe PID 2776 wrote to memory of 1504 2776 taskeng.exe Server.exe PID 2776 wrote to memory of 1504 2776 taskeng.exe Server.exe PID 2776 wrote to memory of 1504 2776 taskeng.exe Server.exe PID 2776 wrote to memory of 1504 2776 taskeng.exe Server.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\641bf525a313f41f133cd1db2d07da2b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\641bf525a313f41f133cd1db2d07da2b_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\pashat.exe"C:\Users\Admin\AppData\Local\Temp\pashat.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {39768732-CE35-4B43-8A05-4ED38C577A9A} S-1-5-21-268080393-3149932598-1824759070-1000:UHRQKJCP\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\pashat.exeFilesize
43KB
MD5641bf525a313f41f133cd1db2d07da2b
SHA12da56f55034be144ba85cc9c83af4f09aa591c9e
SHA2561f399125ae166a61b9715467bad99e63466e9d68860f29442479d4dd179577d6
SHA5124921b7ebc833558546b382d8c904628b25176f4580cbc38f4eb4271722f63486dfea56da5b5645b3c18f8893ef552c87309802ae6ccb17dda181ccad329fb5cb
-
memory/1504-22-0x0000000001270000-0x0000000001282000-memory.dmpFilesize
72KB
-
memory/1988-20-0x00000000003D0000-0x00000000003E2000-memory.dmpFilesize
72KB
-
memory/2032-0-0x0000000074D3E000-0x0000000074D3F000-memory.dmpFilesize
4KB
-
memory/2032-1-0x0000000000F90000-0x0000000000FA2000-memory.dmpFilesize
72KB
-
memory/2032-2-0x0000000074D30000-0x000000007541E000-memory.dmpFilesize
6.9MB
-
memory/2032-13-0x0000000074D30000-0x000000007541E000-memory.dmpFilesize
6.9MB
-
memory/2968-10-0x0000000074D30000-0x000000007541E000-memory.dmpFilesize
6.9MB
-
memory/2968-11-0x0000000000150000-0x0000000000162000-memory.dmpFilesize
72KB
-
memory/2968-12-0x0000000074D30000-0x000000007541E000-memory.dmpFilesize
6.9MB
-
memory/2968-16-0x0000000074D30000-0x000000007541E000-memory.dmpFilesize
6.9MB
-
memory/2968-17-0x0000000074D30000-0x000000007541E000-memory.dmpFilesize
6.9MB