Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
08-09-2024 15:53
Static task
static1
Behavioral task
behavioral1
Sample
d4b8a82a729cdf72567046b7555a0922_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d4b8a82a729cdf72567046b7555a0922_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d4b8a82a729cdf72567046b7555a0922_JaffaCakes118.exe
-
Size
184KB
-
MD5
d4b8a82a729cdf72567046b7555a0922
-
SHA1
3f64f0fe9528075fd128d9a4d4591f15d095e268
-
SHA256
66a12501efa03a9f5963f7b5bef2a4062e0e534ecc1a496cdc00cf60470d2e16
-
SHA512
22304948535d84940b3f2aaf9ad6553865c3328c3ba897cc1c36928ec813127e41395a44dc5f2db3799bdeb7ae2491eeb6ffba8eff18d065860570839e19fb10
-
SSDEEP
3072:BrSXkyxAljyuORbYlpy6bTH32GhNvtTw3LXdKkFq:xSkuAljyutpyCX2GhN1mLP
Malware Config
Extracted
njrat
v2.0
HacKed
anunankis1.duckdns.org:1515
Windows
-
reg_key
Windows
-
splitter
|-F-|
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation d4b8a82a729cdf72567046b7555a0922_JaffaCakes118.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk d4b8a82a729cdf72567046b7555a0922_JaffaCakes118.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk Audio Realtek Driver.exe -
Executes dropped EXE 2 IoCs
pid Process 4244 Audio Realtek Driver.exe 880 Audio Realtek Driver.exe -
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Audio Realtek Driver.exe" d4b8a82a729cdf72567046b7555a0922_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows2 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL" Audio Realtek Driver.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows2 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL" Audio Realtek Driver.exe Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL" Audio Realtek Driver.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL" Audio Realtek Driver.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3600 set thread context of 1280 3600 d4b8a82a729cdf72567046b7555a0922_JaffaCakes118.exe 85 PID 4244 set thread context of 880 4244 Audio Realtek Driver.exe 91 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Audio Realtek Driver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Audio Realtek Driver.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d4b8a82a729cdf72567046b7555a0922_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d4b8a82a729cdf72567046b7555a0922_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeDebugPrivilege 880 Audio Realtek Driver.exe Token: 33 880 Audio Realtek Driver.exe Token: SeIncBasePriorityPrivilege 880 Audio Realtek Driver.exe Token: 33 880 Audio Realtek Driver.exe Token: SeIncBasePriorityPrivilege 880 Audio Realtek Driver.exe Token: 33 880 Audio Realtek Driver.exe Token: SeIncBasePriorityPrivilege 880 Audio Realtek Driver.exe Token: 33 880 Audio Realtek Driver.exe Token: SeIncBasePriorityPrivilege 880 Audio Realtek Driver.exe Token: 33 880 Audio Realtek Driver.exe Token: SeIncBasePriorityPrivilege 880 Audio Realtek Driver.exe Token: 33 880 Audio Realtek Driver.exe Token: SeIncBasePriorityPrivilege 880 Audio Realtek Driver.exe Token: 33 880 Audio Realtek Driver.exe Token: SeIncBasePriorityPrivilege 880 Audio Realtek Driver.exe Token: 33 880 Audio Realtek Driver.exe Token: SeIncBasePriorityPrivilege 880 Audio Realtek Driver.exe Token: 33 880 Audio Realtek Driver.exe Token: SeIncBasePriorityPrivilege 880 Audio Realtek Driver.exe Token: 33 880 Audio Realtek Driver.exe Token: SeIncBasePriorityPrivilege 880 Audio Realtek Driver.exe Token: 33 880 Audio Realtek Driver.exe Token: SeIncBasePriorityPrivilege 880 Audio Realtek Driver.exe Token: 33 880 Audio Realtek Driver.exe Token: SeIncBasePriorityPrivilege 880 Audio Realtek Driver.exe Token: 33 880 Audio Realtek Driver.exe Token: SeIncBasePriorityPrivilege 880 Audio Realtek Driver.exe Token: 33 880 Audio Realtek Driver.exe Token: SeIncBasePriorityPrivilege 880 Audio Realtek Driver.exe Token: 33 880 Audio Realtek Driver.exe Token: SeIncBasePriorityPrivilege 880 Audio Realtek Driver.exe Token: 33 880 Audio Realtek Driver.exe Token: SeIncBasePriorityPrivilege 880 Audio Realtek Driver.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 3600 wrote to memory of 1280 3600 d4b8a82a729cdf72567046b7555a0922_JaffaCakes118.exe 85 PID 3600 wrote to memory of 1280 3600 d4b8a82a729cdf72567046b7555a0922_JaffaCakes118.exe 85 PID 3600 wrote to memory of 1280 3600 d4b8a82a729cdf72567046b7555a0922_JaffaCakes118.exe 85 PID 3600 wrote to memory of 1280 3600 d4b8a82a729cdf72567046b7555a0922_JaffaCakes118.exe 85 PID 3600 wrote to memory of 1280 3600 d4b8a82a729cdf72567046b7555a0922_JaffaCakes118.exe 85 PID 3600 wrote to memory of 1280 3600 d4b8a82a729cdf72567046b7555a0922_JaffaCakes118.exe 85 PID 3600 wrote to memory of 1280 3600 d4b8a82a729cdf72567046b7555a0922_JaffaCakes118.exe 85 PID 3600 wrote to memory of 1280 3600 d4b8a82a729cdf72567046b7555a0922_JaffaCakes118.exe 85 PID 1280 wrote to memory of 4244 1280 d4b8a82a729cdf72567046b7555a0922_JaffaCakes118.exe 88 PID 1280 wrote to memory of 4244 1280 d4b8a82a729cdf72567046b7555a0922_JaffaCakes118.exe 88 PID 1280 wrote to memory of 4244 1280 d4b8a82a729cdf72567046b7555a0922_JaffaCakes118.exe 88 PID 1280 wrote to memory of 2060 1280 d4b8a82a729cdf72567046b7555a0922_JaffaCakes118.exe 89 PID 1280 wrote to memory of 2060 1280 d4b8a82a729cdf72567046b7555a0922_JaffaCakes118.exe 89 PID 1280 wrote to memory of 2060 1280 d4b8a82a729cdf72567046b7555a0922_JaffaCakes118.exe 89 PID 4244 wrote to memory of 880 4244 Audio Realtek Driver.exe 91 PID 4244 wrote to memory of 880 4244 Audio Realtek Driver.exe 91 PID 4244 wrote to memory of 880 4244 Audio Realtek Driver.exe 91 PID 4244 wrote to memory of 880 4244 Audio Realtek Driver.exe 91 PID 4244 wrote to memory of 880 4244 Audio Realtek Driver.exe 91 PID 4244 wrote to memory of 880 4244 Audio Realtek Driver.exe 91 PID 4244 wrote to memory of 880 4244 Audio Realtek Driver.exe 91 PID 4244 wrote to memory of 880 4244 Audio Realtek Driver.exe 91 PID 880 wrote to memory of 4976 880 Audio Realtek Driver.exe 97 PID 880 wrote to memory of 4976 880 Audio Realtek Driver.exe 97 PID 880 wrote to memory of 4976 880 Audio Realtek Driver.exe 97 PID 880 wrote to memory of 1416 880 Audio Realtek Driver.exe 98 PID 880 wrote to memory of 1416 880 Audio Realtek Driver.exe 98 PID 880 wrote to memory of 1416 880 Audio Realtek Driver.exe 98 -
Views/modifies file attributes 1 TTPs 3 IoCs
pid Process 2060 attrib.exe 4976 attrib.exe 1416 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4b8a82a729cdf72567046b7555a0922_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d4b8a82a729cdf72567046b7555a0922_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\d4b8a82a729cdf72567046b7555a0922_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d4b8a82a729cdf72567046b7555a0922_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\Audio Realtek Driver.exe"C:\Users\Admin\AppData\Local\Temp\Audio Realtek Driver.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\Audio Realtek Driver.exe"C:\Users\Admin\AppData\Local\Temp\Audio Realtek Driver.exe"4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Windows\SysWOW64\attrib.exeattrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe"5⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:4976
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +r +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.exe"5⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:1416
-
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +r +s "C:\Users\Admin\AppData\Local\Temp\Audio Realtek Driver.exe"3⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:2060
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\d4b8a82a729cdf72567046b7555a0922_JaffaCakes118.exe.log
Filesize226B
MD5916851e072fbabc4796d8916c5131092
SHA1d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA2567e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA51207ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521
-
Filesize
184KB
MD5d4b8a82a729cdf72567046b7555a0922
SHA13f64f0fe9528075fd128d9a4d4591f15d095e268
SHA25666a12501efa03a9f5963f7b5bef2a4062e0e534ecc1a496cdc00cf60470d2e16
SHA51222304948535d84940b3f2aaf9ad6553865c3328c3ba897cc1c36928ec813127e41395a44dc5f2db3799bdeb7ae2491eeb6ffba8eff18d065860570839e19fb10
-
Filesize
1KB
MD5a17b27701b4d3b5b39d174f9f3c17841
SHA14d98b658d09730704e6eb03ebd0b51a8d811c5ef
SHA2567bd2938ce6d76d4948188221641210ea9aa9110ea3318cdadab3c87d8f7d16d1
SHA512a6888617bb82d5d4c343975f46087b2b639aa26b546ceba4f2009be3f55ba1fe3b122d76b08c24c3df9b605251b2dbc6d50e2de602d1e346b035fe1eb301fc63
-
Filesize
1KB
MD52641fd48c1124a998eaa69132458026a
SHA1494e0e3624a2c4020d575d1786c97dcebd5fafa4
SHA256f5bf3bd1b542b36da83bec822bbfabb6ccb0176e47ec869719b18d0cbfc65dbb
SHA512fc4411e7b12ef8ffa2edc6b751352b13a64ababb19830d773cf6bdac05b3e23de15d88ac80c842c4da2ca4194a953b4d342a14dc2f8a357cb3b243a55c3d15c4