njrat | 328526c5b6415cc824329a61f93c3ee906d5909dc84e4c3bdd8b292711ff4ce0

General

Target
b5c78480b9df2586f8c5f193502913a7_JaffaCakes118.exe
Size 169KB
Sample240616-3me1hstepc
SHA256 328526c5b6415cc824329a61f93c3ee906d5909dc84e4c3bdd8b292711ff4ce0
MD5 b5c78480b9df2586f8c5f193502913a7
SHA1 ee511a078a6ebfec6ee415c6eafaa2da8b30f98c
SHA512 b854473c085474fbda984a4eb3f5beb98effef2ce5e30686db6c97a4023610445cccda9026a6429267bec52b1bdb7367db20811248df3c8d7471bced50a7c9e5
SSDEEP 3072:D6wHvfOoeFxZZVS2Vzr3uio6ARTzxqFAnG20kW6se8H0VJJdCXYE84eA90:D6w1eFZVRV33udxq+G9jyVJLQXeA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

njrat evasion persistence trojan

Malware Config

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2816	netsh.exe

Executes dropped EXE 1 IoCs

pid	Process
1484	Scvhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update = "cmd /c type C:\\Users\\Admin\\AppData\\Local\\Temp\\Update.txt \| cmd"	reg.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4400	b5c78480b9df2586f8c5f193502913a7_JaffaCakes118.exe
4400	b5c78480b9df2586f8c5f193502913a7_JaffaCakes118.exe
1484	Scvhost.exe
1484	Scvhost.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeDebugPrivilege	4400	b5c78480b9df2586f8c5f193502913a7_JaffaCakes118.exe
Token: SeDebugPrivilege	1484	Scvhost.exe
Token: 33	1484	Scvhost.exe
Token: SeIncBasePriorityPrivilege	1484	Scvhost.exe
Token: 33	1484	Scvhost.exe
Token: SeIncBasePriorityPrivilege	1484	Scvhost.exe
Token: 33	1484	Scvhost.exe
Token: SeIncBasePriorityPrivilege	1484	Scvhost.exe
Token: 33	1484	Scvhost.exe
Token: SeIncBasePriorityPrivilege	1484	Scvhost.exe
Token: 33	1484	Scvhost.exe
Token: SeIncBasePriorityPrivilege	1484	Scvhost.exe
Token: 33	1484	Scvhost.exe
Token: SeIncBasePriorityPrivilege	1484	Scvhost.exe
Token: 33	1484	Scvhost.exe
Token: SeIncBasePriorityPrivilege	1484	Scvhost.exe
Token: 33	1484	Scvhost.exe
Token: SeIncBasePriorityPrivilege	1484	Scvhost.exe
Token: 33	1484	Scvhost.exe
Token: SeIncBasePriorityPrivilege	1484	Scvhost.exe
Token: 33	1484	Scvhost.exe
Token: SeIncBasePriorityPrivilege	1484	Scvhost.exe
Token: 33	1484	Scvhost.exe
Token: SeIncBasePriorityPrivilege	1484	Scvhost.exe
Token: 33	1484	Scvhost.exe
Token: SeIncBasePriorityPrivilege	1484	Scvhost.exe
Token: 33	1484	Scvhost.exe
Token: SeIncBasePriorityPrivilege	1484	Scvhost.exe
Token: 33	1484	Scvhost.exe
Token: SeIncBasePriorityPrivilege	1484	Scvhost.exe
Token: 33	1484	Scvhost.exe
Token: SeIncBasePriorityPrivilege	1484	Scvhost.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 1800	4400	b5c78480b9df2586f8c5f193502913a7_JaffaCakes118.exe	91
PID 4400 wrote to memory of 1800	4400	b5c78480b9df2586f8c5f193502913a7_JaffaCakes118.exe	91
PID 4400 wrote to memory of 1800	4400	b5c78480b9df2586f8c5f193502913a7_JaffaCakes118.exe	91
PID 1800 wrote to memory of 1484	1800	cmd.exe	93
PID 1800 wrote to memory of 1484	1800	cmd.exe	93
PID 1800 wrote to memory of 1484	1800	cmd.exe	93
PID 1484 wrote to memory of 3964	1484	Scvhost.exe	94
PID 1484 wrote to memory of 3964	1484	Scvhost.exe	94
PID 1484 wrote to memory of 3964	1484	Scvhost.exe	94
PID 3964 wrote to memory of 2116	3964	cmd.exe	96
PID 3964 wrote to memory of 2116	3964	cmd.exe	96
PID 3964 wrote to memory of 2116	3964	cmd.exe	96
PID 1484 wrote to memory of 2816	1484	Scvhost.exe	97
PID 1484 wrote to memory of 2816	1484	Scvhost.exe	97
PID 1484 wrote to memory of 2816	1484	Scvhost.exe	97

C:\Users\Admin\AppData\Local\Temp\b5c78480b9df2586f8c5f193502913a7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b5c78480b9df2586f8c5f193502913a7_JaffaCakes118.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1800
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Fonts\Scvhost.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Fonts\Scvhost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1484
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3964
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Update" /d "cmd /c type "C:\Users\Admin\AppData\Local\Temp\Update.txt" | cmd"
        5⤵
        Adds Run key to start application
        
        PID:2116
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Fonts\Scvhost.exe" "Scvhost.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      PID:2816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4092 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8
1⤵
PID:4284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Scvhost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Fonts\Scvhost.exe
Size 169KB
SHA256 328526c5b6415cc824329a61f93c3ee906d5909dc84e4c3bdd8b292711ff4ce0
MD5 b5c78480b9df2586f8c5f193502913a7
SHA1 ee511a078a6ebfec6ee415c6eafaa2da8b30f98c
SHA512 b854473c085474fbda984a4eb3f5beb98effef2ce5e30686db6c97a4023610445cccda9026a6429267bec52b1bdb7367db20811248df3c8d7471bced50a7c9e5
SSDEEP 3072:D6wHvfOoeFxZZVS2Vzr3uio6ARTzxqFAnG20kW6se8H0VJJdCXYE84eA90:D6w1eFZVRV33udxq+G9jyVJLQXeA
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1484-8-0x0000000074700000-0x0000000074CB1000-memory.dmp

Download

memory/1484-9-0x0000000074700000-0x0000000074CB1000-memory.dmp

Download

memory/1484-10-0x0000000074700000-0x0000000074CB1000-memory.dmp

Download

memory/1484-13-0x0000000074700000-0x0000000074CB1000-memory.dmp

Download

memory/1484-14-0x0000000074700000-0x0000000074CB1000-memory.dmp

Download

memory/4400-0-0x0000000074702000-0x0000000074703000-memory.dmp

Download

memory/4400-1-0x0000000074700000-0x0000000074CB1000-memory.dmp

Download

memory/4400-2-0x0000000074700000-0x0000000074CB1000-memory.dmp

Download

memory/4400-11-0x0000000074700000-0x0000000074CB1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads