Analysis
- max time kernel
149s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
25/06/2024, 20:33
General
- Target 0f6f1b6c22e9e43ed5dbcee8ec19bb17_JaffaCakes118.exe
- Size 447KB
- Sample240625-zbwmca1fkh
- SHA256 101576932708fdf6fa1e7917ca39f34a74582449ff81a298d917366734ace2ef
Malware Config
Extracted
-
njrat
-
Njrat 0.7 Golden By Hassan Amiri
-
HacKed
-
web3.hopto.org:2222
-
Windows Update
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
- njRAT/Bladabindi
Widely used RAT written in .NET.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 2 IoCs
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Drops desktop.ini file(s) 2 IoCs
- Drops file in Windows directory 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: GetForegroundWindowSpam 3 IoCs
- Suspicious use of AdjustPrivilegeToken 25 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f6f1b6c22e9e43ed5dbcee8ec19bb17_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0f6f1b6c22e9e43ed5dbcee8ec19bb17_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Dllhost.exe"C:\Users\Admin\Dllhost.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
Dllhost.exe
memory/792-43-0x00007FFE30630000-0x00007FFE30FD1000-memory.dmp
memory/792-8-0x00007FFE30630000-0x00007FFE30FD1000-memory.dmp
memory/792-5-0x000000001B660000-0x000000001B706000-memory.dmp
memory/792-6-0x00007FFE30630000-0x00007FFE30FD1000-memory.dmp
memory/792-7-0x0000000000E90000-0x0000000000EA2000-memory.dmp
memory/792-9-0x000000001C580000-0x000000001CA4E000-memory.dmp
memory/792-0-0x00007FFE308E5000-0x00007FFE308E6000-memory.dmp
memory/792-10-0x000000001BE20000-0x000000001BEBC000-memory.dmp
memory/792-11-0x00007FFE308E5000-0x00007FFE308E6000-memory.dmp
memory/792-1-0x00007FFE30630000-0x00007FFE30FD1000-memory.dmp
memory/792-2-0x000000001B410000-0x000000001B446000-memory.dmp
memory/792-42-0x00007FFE30630000-0x00007FFE30FD1000-memory.dmp
memory/1940-57-0x00007FFE30630000-0x00007FFE30FD1000-memory.dmp
memory/1940-58-0x0000000000C50000-0x0000000000C62000-memory.dmp
memory/1940-60-0x00007FFE30630000-0x00007FFE30FD1000-memory.dmp
memory/2200-50-0x00007FFE30630000-0x00007FFE30FD1000-memory.dmp
memory/2200-45-0x00007FFE30630000-0x00007FFE30FD1000-memory.dmp
memory/2200-46-0x0000000000A90000-0x0000000000AA2000-memory.dmp
memory/2200-47-0x00007FFE30630000-0x00007FFE30FD1000-memory.dmp
memory/2200-44-0x00007FFE30630000-0x00007FFE30FD1000-memory.dmp
memory/2200-51-0x00007FFE30630000-0x00007FFE30FD1000-memory.dmp
memory/2200-52-0x0000000000AC0000-0x0000000000AC8000-memory.dmp
memory/2200-53-0x00007FFE30630000-0x00007FFE30FD1000-memory.dmp
memory/2200-54-0x00007FFE30630000-0x00007FFE30FD1000-memory.dmp