Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
28-05-2024 06:46
Behavioral task
behavioral1
Sample
7c0ef81ef52a99bc26a26aed61c6532d_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
7c0ef81ef52a99bc26a26aed61c6532d_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
7c0ef81ef52a99bc26a26aed61c6532d_JaffaCakes118.exe
-
Size
23KB
-
MD5
7c0ef81ef52a99bc26a26aed61c6532d
-
SHA1
f0e189c7e4c75e0f0961e9f5150b1cebc07a440a
-
SHA256
81000dc1966cb3be3850943e75f6c08b97002c6b2aa1f020e4a74a0716b2de15
-
SHA512
cf5f9909f19e20fca38e67e0d7f20071de63ba31bd6132901f18254678f572fca172b22a01b5b6f517a6af7f30a0b786ddf5a04128e5cb9b6eabf179566dc0a6
-
SSDEEP
384:LY324bcgPiJLQrfARGSRUJsbY6ZgvSMBD3t8mRvR6JZlbw8hqIusZzZEP:0L2s+tRyRpcnul
Malware Config
Extracted
njrat
0.7d
Ratted
10.0.0.46:5552
e8c2fab912734648f8bb500fffb8db77
-
reg_key
e8c2fab912734648f8bb500fffb8db77
-
splitter
|'|'|
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 2604 netsh.exe -
Drops startup file 2 IoCs
Processes:
DongTest.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e8c2fab912734648f8bb500fffb8db77.exe DongTest.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e8c2fab912734648f8bb500fffb8db77.exe DongTest.exe -
Executes dropped EXE 1 IoCs
Processes:
DongTest.exepid process 3000 DongTest.exe -
Loads dropped DLL 1 IoCs
Processes:
7c0ef81ef52a99bc26a26aed61c6532d_JaffaCakes118.exepid process 2432 7c0ef81ef52a99bc26a26aed61c6532d_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
DongTest.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\e8c2fab912734648f8bb500fffb8db77 = "\"C:\\Users\\Admin\\AppData\\Roaming\\DongTest.exe\" .." DongTest.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\e8c2fab912734648f8bb500fffb8db77 = "\"C:\\Users\\Admin\\AppData\\Roaming\\DongTest.exe\" .." DongTest.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes:
DongTest.exedescription pid process Token: SeDebugPrivilege 3000 DongTest.exe Token: 33 3000 DongTest.exe Token: SeIncBasePriorityPrivilege 3000 DongTest.exe Token: 33 3000 DongTest.exe Token: SeIncBasePriorityPrivilege 3000 DongTest.exe Token: 33 3000 DongTest.exe Token: SeIncBasePriorityPrivilege 3000 DongTest.exe Token: 33 3000 DongTest.exe Token: SeIncBasePriorityPrivilege 3000 DongTest.exe Token: 33 3000 DongTest.exe Token: SeIncBasePriorityPrivilege 3000 DongTest.exe Token: 33 3000 DongTest.exe Token: SeIncBasePriorityPrivilege 3000 DongTest.exe Token: 33 3000 DongTest.exe Token: SeIncBasePriorityPrivilege 3000 DongTest.exe Token: 33 3000 DongTest.exe Token: SeIncBasePriorityPrivilege 3000 DongTest.exe Token: 33 3000 DongTest.exe Token: SeIncBasePriorityPrivilege 3000 DongTest.exe Token: 33 3000 DongTest.exe Token: SeIncBasePriorityPrivilege 3000 DongTest.exe Token: 33 3000 DongTest.exe Token: SeIncBasePriorityPrivilege 3000 DongTest.exe Token: 33 3000 DongTest.exe Token: SeIncBasePriorityPrivilege 3000 DongTest.exe Token: 33 3000 DongTest.exe Token: SeIncBasePriorityPrivilege 3000 DongTest.exe Token: 33 3000 DongTest.exe Token: SeIncBasePriorityPrivilege 3000 DongTest.exe Token: 33 3000 DongTest.exe Token: SeIncBasePriorityPrivilege 3000 DongTest.exe Token: 33 3000 DongTest.exe Token: SeIncBasePriorityPrivilege 3000 DongTest.exe Token: 33 3000 DongTest.exe Token: SeIncBasePriorityPrivilege 3000 DongTest.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
7c0ef81ef52a99bc26a26aed61c6532d_JaffaCakes118.exeDongTest.exedescription pid process target process PID 2432 wrote to memory of 3000 2432 7c0ef81ef52a99bc26a26aed61c6532d_JaffaCakes118.exe DongTest.exe PID 2432 wrote to memory of 3000 2432 7c0ef81ef52a99bc26a26aed61c6532d_JaffaCakes118.exe DongTest.exe PID 2432 wrote to memory of 3000 2432 7c0ef81ef52a99bc26a26aed61c6532d_JaffaCakes118.exe DongTest.exe PID 2432 wrote to memory of 3000 2432 7c0ef81ef52a99bc26a26aed61c6532d_JaffaCakes118.exe DongTest.exe PID 3000 wrote to memory of 2604 3000 DongTest.exe netsh.exe PID 3000 wrote to memory of 2604 3000 DongTest.exe netsh.exe PID 3000 wrote to memory of 2604 3000 DongTest.exe netsh.exe PID 3000 wrote to memory of 2604 3000 DongTest.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c0ef81ef52a99bc26a26aed61c6532d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\7c0ef81ef52a99bc26a26aed61c6532d_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Roaming\DongTest.exe"C:\Users\Admin\AppData\Roaming\DongTest.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\DongTest.exe" "DongTest.exe" ENABLE3⤵
- Modifies Windows Firewall
PID:2604
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
23KB
MD57c0ef81ef52a99bc26a26aed61c6532d
SHA1f0e189c7e4c75e0f0961e9f5150b1cebc07a440a
SHA25681000dc1966cb3be3850943e75f6c08b97002c6b2aa1f020e4a74a0716b2de15
SHA512cf5f9909f19e20fca38e67e0d7f20071de63ba31bd6132901f18254678f572fca172b22a01b5b6f517a6af7f30a0b786ddf5a04128e5cb9b6eabf179566dc0a6