Malware Analysis Report

2024-10-19 08:10

Sample ID 240622-wphqvsxfre
Target 034daff5b443407c84a4bc639d5e19f2_JaffaCakes118
SHA256 f780170cbcc07326cda96e3cd8364b2a28251c63888b0e5f1df98d8112994e08
Tags
njrat b hat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f780170cbcc07326cda96e3cd8364b2a28251c63888b0e5f1df98d8112994e08

Threat Level: Known bad

The file 034daff5b443407c84a4bc639d5e19f2_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

njrat b hat trojan

njRAT/Bladabindi

Unsigned PE

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2024-06-22 18:05

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-22 18:05

Reported

2024-06-22 18:08

Platform

win7-20240221-en

Max time kernel

148s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe"

Signatures

njRAT/Bladabindi

trojan njrat

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe"

Network

Country Destination Domain Proto
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp

Files

memory/1676-0-0x000007FEF587E000-0x000007FEF587F000-memory.dmp

memory/1676-1-0x00000000003D0000-0x00000000003DC000-memory.dmp

memory/1676-2-0x000007FEF55C0000-0x000007FEF5F5D000-memory.dmp

memory/1676-3-0x000007FEF55C0000-0x000007FEF5F5D000-memory.dmp

memory/1676-4-0x000007FEF587E000-0x000007FEF587F000-memory.dmp

memory/1676-5-0x000007FEF55C0000-0x000007FEF5F5D000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-22 18:05

Reported

2024-06-22 18:08

Platform

win10v2004-20240508-en

Max time kernel

147s

Max time network

51s

Command Line

"C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe"

Signatures

njRAT/Bladabindi

trojan njrat

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\034daff5b443407c84a4bc639d5e19f2_JaffaCakes118.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp
N/A 127.0.0.1:1177 tcp

Files

memory/4860-0-0x00007FF917E75000-0x00007FF917E76000-memory.dmp

memory/4860-1-0x000000001BB30000-0x000000001BBD6000-memory.dmp

memory/4860-2-0x00007FF917BC0000-0x00007FF918561000-memory.dmp

memory/4860-3-0x000000001BC00000-0x000000001BC0C000-memory.dmp

memory/4860-4-0x00007FF917BC0000-0x00007FF918561000-memory.dmp

memory/4860-5-0x000000001C870000-0x000000001CD3E000-memory.dmp

memory/4860-6-0x000000001BE20000-0x000000001BEBC000-memory.dmp

memory/4860-7-0x000000001BBE0000-0x000000001BBE8000-memory.dmp

memory/4860-8-0x00007FF917E75000-0x00007FF917E76000-memory.dmp

memory/4860-9-0x00007FF917BC0000-0x00007FF918561000-memory.dmp