Analysis
-
max time kernel
149s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 17:16
Behavioral task
behavioral1
Sample
641bf525a313f41f133cd1db2d07da2b_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
641bf525a313f41f133cd1db2d07da2b_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
641bf525a313f41f133cd1db2d07da2b_JaffaCakes118.exe
-
Size
43KB
-
MD5
641bf525a313f41f133cd1db2d07da2b
-
SHA1
2da56f55034be144ba85cc9c83af4f09aa591c9e
-
SHA256
1f399125ae166a61b9715467bad99e63466e9d68860f29442479d4dd179577d6
-
SHA512
4921b7ebc833558546b382d8c904628b25176f4580cbc38f4eb4271722f63486dfea56da5b5645b3c18f8893ef552c87309802ae6ccb17dda181ccad329fb5cb
-
SSDEEP
384:+ZybZIBK0lwZmoy7xir6ikuEhxiDUaXzoIij+ZsNO3PlpJKkkjh/TzF7pWnB/grq:Es0tGol786b4DDuXQ/oc/+L
Malware Config
Extracted
njrat
Njrat 0.7 Golden By Hassan Amiri
HacKed
127.0.0.1:5552
Windows Update
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
641bf525a313f41f133cd1db2d07da2b_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation 641bf525a313f41f133cd1db2d07da2b_JaffaCakes118.exe -
Drops startup file 2 IoCs
Processes:
pashat.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe pashat.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe pashat.exe -
Executes dropped EXE 4 IoCs
Processes:
pashat.exeServer.exeServer.exeServer.exepid process 1888 pashat.exe 3320 Server.exe 3696 Server.exe 1064 Server.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
pashat.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\pashat.exe\" .." pashat.exe Set value (str) \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\pashat.exe\" .." pashat.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
641bf525a313f41f133cd1db2d07da2b_JaffaCakes118.exepashat.exepid process 2588 641bf525a313f41f133cd1db2d07da2b_JaffaCakes118.exe 1888 pashat.exe -
Suspicious use of AdjustPrivilegeToken 33 IoCs
Processes:
pashat.exedescription pid process Token: SeDebugPrivilege 1888 pashat.exe Token: 33 1888 pashat.exe Token: SeIncBasePriorityPrivilege 1888 pashat.exe Token: 33 1888 pashat.exe Token: SeIncBasePriorityPrivilege 1888 pashat.exe Token: 33 1888 pashat.exe Token: SeIncBasePriorityPrivilege 1888 pashat.exe Token: 33 1888 pashat.exe Token: SeIncBasePriorityPrivilege 1888 pashat.exe Token: 33 1888 pashat.exe Token: SeIncBasePriorityPrivilege 1888 pashat.exe Token: 33 1888 pashat.exe Token: SeIncBasePriorityPrivilege 1888 pashat.exe Token: 33 1888 pashat.exe Token: SeIncBasePriorityPrivilege 1888 pashat.exe Token: 33 1888 pashat.exe Token: SeIncBasePriorityPrivilege 1888 pashat.exe Token: 33 1888 pashat.exe Token: SeIncBasePriorityPrivilege 1888 pashat.exe Token: 33 1888 pashat.exe Token: SeIncBasePriorityPrivilege 1888 pashat.exe Token: 33 1888 pashat.exe Token: SeIncBasePriorityPrivilege 1888 pashat.exe Token: 33 1888 pashat.exe Token: SeIncBasePriorityPrivilege 1888 pashat.exe Token: 33 1888 pashat.exe Token: SeIncBasePriorityPrivilege 1888 pashat.exe Token: 33 1888 pashat.exe Token: SeIncBasePriorityPrivilege 1888 pashat.exe Token: 33 1888 pashat.exe Token: SeIncBasePriorityPrivilege 1888 pashat.exe Token: 33 1888 pashat.exe Token: SeIncBasePriorityPrivilege 1888 pashat.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
641bf525a313f41f133cd1db2d07da2b_JaffaCakes118.exepashat.exedescription pid process target process PID 2588 wrote to memory of 1888 2588 641bf525a313f41f133cd1db2d07da2b_JaffaCakes118.exe pashat.exe PID 2588 wrote to memory of 1888 2588 641bf525a313f41f133cd1db2d07da2b_JaffaCakes118.exe pashat.exe PID 2588 wrote to memory of 1888 2588 641bf525a313f41f133cd1db2d07da2b_JaffaCakes118.exe pashat.exe PID 1888 wrote to memory of 3836 1888 pashat.exe schtasks.exe PID 1888 wrote to memory of 3836 1888 pashat.exe schtasks.exe PID 1888 wrote to memory of 3836 1888 pashat.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\641bf525a313f41f133cd1db2d07da2b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\641bf525a313f41f133cd1db2d07da2b_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\pashat.exe"C:\Users\Admin\AppData\Local\Temp\pashat.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Server.exe.logFilesize
507B
MD525d1b50e7c0d451f3d850eb54d27ca05
SHA1a238807715c70a335f54e80d4855644b21a9e870
SHA256650faa13e983c9046c9030f63a5fa1c33900432ec7cb3762e015da2e7c5b34a5
SHA5124223a26b2fabefdf1c01443ccc7bd887464d27f02694379895a040c66db472d541218d501f1c01e1bd31012d079a31baf24e20882c32cf652a09a74e3bf385f5
-
C:\Users\Admin\AppData\Local\Temp\pashat.exeFilesize
43KB
MD5641bf525a313f41f133cd1db2d07da2b
SHA12da56f55034be144ba85cc9c83af4f09aa591c9e
SHA2561f399125ae166a61b9715467bad99e63466e9d68860f29442479d4dd179577d6
SHA5124921b7ebc833558546b382d8c904628b25176f4580cbc38f4eb4271722f63486dfea56da5b5645b3c18f8893ef552c87309802ae6ccb17dda181ccad329fb5cb
-
memory/1888-15-0x0000000074640000-0x0000000074DF0000-memory.dmpFilesize
7.7MB
-
memory/1888-28-0x0000000074640000-0x0000000074DF0000-memory.dmpFilesize
7.7MB
-
memory/1888-27-0x0000000074640000-0x0000000074DF0000-memory.dmpFilesize
7.7MB
-
memory/1888-26-0x0000000004B20000-0x0000000004B2A000-memory.dmpFilesize
40KB
-
memory/1888-17-0x0000000074640000-0x0000000074DF0000-memory.dmpFilesize
7.7MB
-
memory/2588-4-0x0000000005260000-0x00000000052F2000-memory.dmpFilesize
584KB
-
memory/2588-16-0x0000000074640000-0x0000000074DF0000-memory.dmpFilesize
7.7MB
-
memory/2588-5-0x0000000074640000-0x0000000074DF0000-memory.dmpFilesize
7.7MB
-
memory/2588-0-0x000000007464E000-0x000000007464F000-memory.dmpFilesize
4KB
-
memory/2588-3-0x0000000005810000-0x0000000005DB4000-memory.dmpFilesize
5.6MB
-
memory/2588-2-0x0000000004EF0000-0x0000000004F8C000-memory.dmpFilesize
624KB
-
memory/2588-1-0x00000000004C0000-0x00000000004D2000-memory.dmpFilesize
72KB
-
memory/3320-22-0x0000000074640000-0x0000000074DF0000-memory.dmpFilesize
7.7MB
-
memory/3320-23-0x0000000074640000-0x0000000074DF0000-memory.dmpFilesize
7.7MB
-
memory/3320-25-0x0000000074640000-0x0000000074DF0000-memory.dmpFilesize
7.7MB