Analysis Overview
SHA256
38e488f67f251de64c399ed140e566929cd2e7a1b1b6357b8f4c7dbd35c15402
Threat Level: Known bad
The file d021f824c67eecb44f0cbecd3e34f707_JaffaCakes118 was found to be: Known bad.
Malicious Activity Summary
njRAT/Bladabindi
Drops startup file
Adds Run key to start application
Unsigned PE
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-09-06 17:57
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-09-06 17:57
Reported
2024-09-06 18:00
Platform
win7-20240708-en
Max time kernel
149s
Max time network
147s
Command Line
Signatures
njRAT/Bladabindi
Drops startup file
| Description | Indicator | Process | Target |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe | C:\Users\Admin\AppData\Local\Temp\d021f824c67eecb44f0cbecd3e34f707_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe | C:\Users\Admin\AppData\Local\Temp\d021f824c67eecb44f0cbecd3e34f707_JaffaCakes118.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\d021f824c67eecb44f0cbecd3e34f707_JaffaCakes118.exe\" .." | C:\Users\Admin\AppData\Local\Temp\d021f824c67eecb44f0cbecd3e34f707_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\d021f824c67eecb44f0cbecd3e34f707_JaffaCakes118.exe\" .." | C:\Users\Admin\AppData\Local\Temp\d021f824c67eecb44f0cbecd3e34f707_JaffaCakes118.exe | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\d021f824c67eecb44f0cbecd3e34f707_JaffaCakes118.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Processes
C:\Users\Admin\AppData\Local\Temp\d021f824c67eecb44f0cbecd3e34f707_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d021f824c67eecb44f0cbecd3e34f707_JaffaCakes118.exe"
Network
| Country | Destination | Domain | Proto |
| RU | 46.158.156.37:27018 | tcp | |
| RU | 46.158.156.37:27018 | tcp | |
| RU | 46.158.156.37:27018 | tcp | |
| RU | 46.158.156.37:27018 | tcp | |
| RU | 46.158.156.37:27018 | tcp | |
| RU | 46.158.156.37:27018 | tcp | |
| RU | 46.158.156.37:27018 | tcp |
Files
memory/2972-0-0x000007FEF5813000-0x000007FEF5814000-memory.dmp
memory/2972-1-0x0000000000A40000-0x0000000000A48000-memory.dmp
memory/2972-2-0x00000000003C0000-0x00000000003D2000-memory.dmp
memory/2972-3-0x000007FEF5810000-0x000007FEF61FC000-memory.dmp
memory/2972-5-0x000007FEF5813000-0x000007FEF5814000-memory.dmp
memory/2972-6-0x000007FEF5810000-0x000007FEF61FC000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-09-06 17:57
Reported
2024-09-06 18:00
Platform
win10v2004-20240802-en
Max time kernel
149s
Max time network
149s
Command Line
Signatures
njRAT/Bladabindi
Drops startup file
| Description | Indicator | Process | Target |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe | C:\Users\Admin\AppData\Local\Temp\d021f824c67eecb44f0cbecd3e34f707_JaffaCakes118.exe | N/A |
| File opened for modification | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe | C:\Users\Admin\AppData\Local\Temp\d021f824c67eecb44f0cbecd3e34f707_JaffaCakes118.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\d021f824c67eecb44f0cbecd3e34f707_JaffaCakes118.exe\" .." | C:\Users\Admin\AppData\Local\Temp\d021f824c67eecb44f0cbecd3e34f707_JaffaCakes118.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\d021f824c67eecb44f0cbecd3e34f707_JaffaCakes118.exe\" .." | C:\Users\Admin\AppData\Local\Temp\d021f824c67eecb44f0cbecd3e34f707_JaffaCakes118.exe | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\d021f824c67eecb44f0cbecd3e34f707_JaffaCakes118.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Processes
C:\Users\Admin\AppData\Local\Temp\d021f824c67eecb44f0cbecd3e34f707_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d021f824c67eecb44f0cbecd3e34f707_JaffaCakes118.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 97.17.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.221.184.93.in-addr.arpa | udp |
| RU | 46.158.156.37:27018 | tcp | |
| US | 8.8.8.8:53 | 97.17.167.52.in-addr.arpa | udp |
| RU | 46.158.156.37:27018 | tcp | |
| RU | 46.158.156.37:27018 | tcp | |
| US | 8.8.8.8:53 | 241.150.49.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 17.160.190.20.in-addr.arpa | udp |
| RU | 46.158.156.37:27018 | tcp | |
| RU | 46.158.156.37:27018 | tcp | |
| US | 8.8.8.8:53 | 228.249.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 17.160.190.20.in-addr.arpa | udp |
| RU | 46.158.156.37:27018 | tcp | |
| RU | 46.158.156.37:27018 | tcp |
Files
memory/4292-0-0x00007FFDDFB53000-0x00007FFDDFB55000-memory.dmp
memory/4292-1-0x00000000006C0000-0x00000000006C8000-memory.dmp
memory/4292-2-0x0000000002720000-0x0000000002732000-memory.dmp
memory/4292-3-0x00007FFDDFB50000-0x00007FFDE0611000-memory.dmp
memory/4292-5-0x00007FFDDFB53000-0x00007FFDDFB55000-memory.dmp
memory/4292-6-0x00007FFDDFB50000-0x00007FFDE0611000-memory.dmp