Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    23-06-2024 12:53

General

  • Target

    061a8d9824446f45d5112cbdd803f173_JaffaCakes118.exe

  • Size

    8.7MB

  • MD5

    061a8d9824446f45d5112cbdd803f173

  • SHA1

    f9ba93c1f7fa8adc7b7565f222d937ec56b97f75

  • SHA256

    da61cd60682f6d7b95972d59830d9ac6d39690d1de4047f4768b0bfc572b78fa

  • SHA512

    a69702e0dbe35accccba436af507557af5caeff0dba4040e56a22f109977c15147c83bc49b30dde9c94b92d11170659d260ae7d389f6aa871383267d2b2a0524

  • SSDEEP

    196608:SNBr/hpKFNfXtF0lbCR7QrWwrueSpEarKOa1oe8fv:SNxCFVXD0o/wrZiEaVa1ol

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

pwtknew1

C2

pwtk02.ddns.net:5552

Mutex

25181c9f909bd4441f2b53785cd683a2

Attributes
  • reg_key

    25181c9f909bd4441f2b53785cd683a2

  • splitter

    |'|'|

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 11 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 35 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 49 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\061a8d9824446f45d5112cbdd803f173_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\061a8d9824446f45d5112cbdd803f173_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2068
    • C:\Users\Admin\AppData\Roaming\pwtk.exe
      "C:\Users\Admin\AppData\Roaming\pwtk.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1796
      • C:\Users\Admin\AppData\Roaming\pwtk.exe
        "{path}"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:3044
        • C:\Users\Admin\AppData\Local\Temp\javaupdate.exe
          "C:\Users\Admin\AppData\Local\Temp\javaupdate.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:2004
          • C:\Users\Admin\AppData\Local\Temp\javaupdate.exe
            "{path}"
            5⤵
            • Drops startup file
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2480
            • C:\Windows\SysWOW64\netsh.exe
              netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\javaupdate.exe" "javaupdate.exe" ENABLE
              6⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              PID:2828
    • C:\Users\Admin\AppData\Roaming\huecheats.exe
      "C:\Users\Admin\AppData\Roaming\huecheats.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2748
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 2748 -s 280
        3⤵
        • Loads dropped DLL
        PID:2260

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Roaming\huecheats.exe

    Filesize

    9.7MB

    MD5

    03670a3264a00379a2e6497c0cc84660

    SHA1

    f8be2b1dbf5f22777e6bfff45e250bccd90f6eb8

    SHA256

    77cd28421b67137b653eb7722bb5879690530027aea63ba94746cda16524a906

    SHA512

    54fcb14598c542af6697ed1741caa319dfb34d2b4ba1c666b651795101789a83b39ef71d501860867129e8132212b64c186dd1697c3d0bca61d41702a9b3aed9

  • \Users\Admin\AppData\Roaming\pwtk.exe

    Filesize

    40KB

    MD5

    0cf4d99ef9305450bc818fc7ce941e91

    SHA1

    13d217d800e9003f458f340d72305e7672996ec7

    SHA256

    172bf347e03f7acb22546dd068ac7e9a49e7882bdc30f4e170e28c9ba4119883

    SHA512

    43a755aa165518024326b41cf5c1bbdc1b3ebd2fb2012fcaac5ecb162b14de901b128590c13fed58c8c5e74153a9191f97f73d535ab73f9d8c49a57d5a42249c

  • memory/1796-23-0x0000000000380000-0x0000000000390000-memory.dmp

    Filesize

    64KB

  • memory/1796-25-0x0000000000390000-0x000000000039C000-memory.dmp

    Filesize

    48KB

  • memory/2004-93-0x0000000000B20000-0x0000000000B30000-memory.dmp

    Filesize

    64KB

  • memory/2480-103-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2748-69-0x000007FEFD500000-0x000007FEFD502000-memory.dmp

    Filesize

    8KB

  • memory/2748-57-0x0000000077570000-0x0000000077572000-memory.dmp

    Filesize

    8KB

  • memory/2748-79-0x0000000077590000-0x0000000077592000-memory.dmp

    Filesize

    8KB

  • memory/2748-77-0x0000000077590000-0x0000000077592000-memory.dmp

    Filesize

    8KB

  • memory/2748-75-0x0000000077590000-0x0000000077592000-memory.dmp

    Filesize

    8KB

  • memory/2748-74-0x0000000077580000-0x0000000077582000-memory.dmp

    Filesize

    8KB

  • memory/2748-40-0x0000000077540000-0x0000000077542000-memory.dmp

    Filesize

    8KB

  • memory/2748-42-0x0000000077540000-0x0000000077542000-memory.dmp

    Filesize

    8KB

  • memory/2748-44-0x0000000077540000-0x0000000077542000-memory.dmp

    Filesize

    8KB

  • memory/2748-45-0x0000000077550000-0x0000000077552000-memory.dmp

    Filesize

    8KB

  • memory/2748-47-0x0000000077550000-0x0000000077552000-memory.dmp

    Filesize

    8KB

  • memory/2748-49-0x0000000077550000-0x0000000077552000-memory.dmp

    Filesize

    8KB

  • memory/2748-64-0x000007FEFD4F0000-0x000007FEFD4F2000-memory.dmp

    Filesize

    8KB

  • memory/2748-62-0x000007FEFD4F0000-0x000007FEFD4F2000-memory.dmp

    Filesize

    8KB

  • memory/2748-59-0x0000000077570000-0x0000000077572000-memory.dmp

    Filesize

    8KB

  • memory/2748-72-0x0000000077580000-0x0000000077582000-memory.dmp

    Filesize

    8KB

  • memory/2748-55-0x0000000077570000-0x0000000077572000-memory.dmp

    Filesize

    8KB

  • memory/2748-54-0x0000000077560000-0x0000000077562000-memory.dmp

    Filesize

    8KB

  • memory/2748-67-0x000007FEFD500000-0x000007FEFD502000-memory.dmp

    Filesize

    8KB

  • memory/2748-52-0x0000000077560000-0x0000000077562000-memory.dmp

    Filesize

    8KB

  • memory/2748-50-0x0000000077560000-0x0000000077562000-memory.dmp

    Filesize

    8KB

  • memory/2748-70-0x0000000077580000-0x0000000077582000-memory.dmp

    Filesize

    8KB

  • memory/3044-38-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/3044-35-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/3044-27-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/3044-29-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/3044-31-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/3044-33-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/3044-39-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

  • memory/3044-36-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB