njrat | 39a199651fa957d0c27de4bcac5e683684b86b8587d7627e9f3150909bc8b26d

Analysis

max time kernel
149s
max time network
134s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 07:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ead1418caeff94606570fe757994c2ea_JaffaCakes118.exe
Size

7.3MB
MD5

ead1418caeff94606570fe757994c2ea
SHA1

7ed3e5b7b31e3cdf7637fc1802b5c6ad53207fb0
SHA256

39a199651fa957d0c27de4bcac5e683684b86b8587d7627e9f3150909bc8b26d
SHA512

6568930729ec37d0ba5b08448ac6d1be64a64ef37358445693765c5ba9cb2e60642c3bc026054edfd677352a9ac739cf4e5fa1d7c2602183fee496342cb3f55f
SSDEEP

98304:ijTmsKgEUDzvEU6CNwhFjTBrHJWGs2NyqeoNE/7SRYYGZ8OC0sLPchA9RpE65QR:CEGTEUdNwhdTVHJack+G8v0qEq9sJR

Score

10^/10

njrat andrey discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

Andrey

njratmemz.hopto.org:6522

Mutex

305d8120504ba062042a9b759eb63121

Attributes

reg_key
305d8120504ba062042a9b759eb63121
splitter
Y262SUCZ4UJJ

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
552	netsh.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\305d8120504ba062042a9b759eb63121.exe	WindowsServices.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\305d8120504ba062042a9b759eb63121.exe	WindowsServices.exe

Executes dropped EXE 3 IoCs

pid	Process
2012	ExLoader.exe
2860	LMAOOOO.exe
2852	WindowsServices.exe

Loads dropped DLL 4 IoCs

pid	Process
2168	ead1418caeff94606570fe757994c2ea_JaffaCakes118.exe
2168	ead1418caeff94606570fe757994c2ea_JaffaCakes118.exe
2168	ead1418caeff94606570fe757994c2ea_JaffaCakes118.exe
2860	LMAOOOO.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\305d8120504ba062042a9b759eb63121 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WindowsServices.exe\" .."	WindowsServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\305d8120504ba062042a9b759eb63121 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WindowsServices.exe\" .."	WindowsServices.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsServices.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ead1418caeff94606570fe757994c2ea_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ExLoader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LMAOOOO.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 62 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "22"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea2200000000020000000000106600000001000020000000ea304696fb0e0e58c76e50da907bf85feade27c858d6725cc719117eb07c24c9000000000e800000000200002000000093e14d17724b1bc1c2ae98a01bb45902cd48d89477964c2b07d16333071a75d7400100002be778b27ad0ca184c881d7b659df4cf34fec8008a9b4c2c82e0ff927095b163383ae0eacd243876990bc4f6760c3e367ed79aea8717740e405dc9cdd2483433b87f94ce12b28fdd879b8ff55737f505847e06331fe98fde79e7bbb9ecdcbd86e4b9b6ffc835b0e8ab78ebb7b99e62570b5065dff67d60cdd8635cf018168517e0ed79800f37749c31a34a437026a34708c7d42492d0c87716a4b98da3ea7557e502b4dcb5a23758cf71713a698fa10ede40db0d8cfada2c64c702838db6cda503bcc73cefd5d69d50cd1925616f24c9f3c94b8fbb8252519f8ef1847e8f0427777f9a69056442f49c0ef0aeb05c1d5db4ca1cad5a38e6b62a3282f95748952e0617c4a18464902ecbccffc77c02c01e2511d0a6091806fe0576640bd2a8e25a8353cc69350f16e3b9399e62e58fbf83636bf4ceaf7b7c84bc0348f690662caf40000000204be9c0d1823ad9e969b02acb83a5142466b3aabc2fbd04bdb43625051b936104aff5f4838a0954538b4adbb2ebe09475eaa39d3990a6d2d0f9aa45ca2999f3	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.java.com\ = "122"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "276"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.java.com\ = "42"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.java.com\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "22"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CD8C33B1-7655-11EF-A6BD-E67A421F41DB} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "122"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "276"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.java.com\ = "276"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "42"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.java.com\ = "224"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "229"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432891504"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "122"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "224"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "229"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.java.com\ = "22"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.java.com\ = "229"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea22000000000200000000001066000000010000200000003ce647f1fd51e57808bf208d2045512ed99fa43d9b4e5eeb4e49614f91801b64000000000e8000000002000020000000a413b1c02f56c792e027002651d4c2e068a48a85fd8b246b2cdf45a9751c062d200000002a9328028eda6c796fadc435129cc648931389bccb4399a48500b6c4d71925fa40000000db275eda1b8b98671498bd6d95a5b61815a22950b39fd060b7d392d57531a0c7f349eb48f290fa63c37089c5fe4e99108387ecc64d76a1802a470db9c5dd8450	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\Total = "42"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 600d77a4620adb01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "224"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.java.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeDebugPrivilege	2852	WindowsServices.exe
Token: 33	2852	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	2852	WindowsServices.exe
Token: 33	2852	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	2852	WindowsServices.exe
Token: 33	2852	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	2852	WindowsServices.exe
Token: 33	2852	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	2852	WindowsServices.exe
Token: 33	2852	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	2852	WindowsServices.exe
Token: 33	2852	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	2852	WindowsServices.exe
Token: 33	2852	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	2852	WindowsServices.exe
Token: 33	2852	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	2852	WindowsServices.exe
Token: 33	2852	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	2852	WindowsServices.exe
Token: 33	2852	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	2852	WindowsServices.exe
Token: 33	2852	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	2852	WindowsServices.exe
Token: 33	2852	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	2852	WindowsServices.exe
Token: 33	2852	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	2852	WindowsServices.exe
Token: 33	2852	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	2852	WindowsServices.exe
Token: 33	2852	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	2852	WindowsServices.exe
Token: 33	2852	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	2852	WindowsServices.exe
Token: 33	2852	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	2852	WindowsServices.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2220	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2220	iexplore.exe
2220	iexplore.exe
2792	IEXPLORE.EXE
2792	IEXPLORE.EXE
2792	IEXPLORE.EXE
2792	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2012	2168	ead1418caeff94606570fe757994c2ea_JaffaCakes118.exe	30
PID 2168 wrote to memory of 2012	2168	ead1418caeff94606570fe757994c2ea_JaffaCakes118.exe	30
PID 2168 wrote to memory of 2012	2168	ead1418caeff94606570fe757994c2ea_JaffaCakes118.exe	30
PID 2168 wrote to memory of 2012	2168	ead1418caeff94606570fe757994c2ea_JaffaCakes118.exe	30
PID 2168 wrote to memory of 2860	2168	ead1418caeff94606570fe757994c2ea_JaffaCakes118.exe	31
PID 2168 wrote to memory of 2860	2168	ead1418caeff94606570fe757994c2ea_JaffaCakes118.exe	31
PID 2168 wrote to memory of 2860	2168	ead1418caeff94606570fe757994c2ea_JaffaCakes118.exe	31
PID 2168 wrote to memory of 2860	2168	ead1418caeff94606570fe757994c2ea_JaffaCakes118.exe	31
PID 2012 wrote to memory of 2220	2012	ExLoader.exe	32
PID 2012 wrote to memory of 2220	2012	ExLoader.exe	32
PID 2012 wrote to memory of 2220	2012	ExLoader.exe	32
PID 2012 wrote to memory of 2220	2012	ExLoader.exe	32
PID 2220 wrote to memory of 2792	2220	iexplore.exe	33
PID 2220 wrote to memory of 2792	2220	iexplore.exe	33
PID 2220 wrote to memory of 2792	2220	iexplore.exe	33
PID 2220 wrote to memory of 2792	2220	iexplore.exe	33
PID 2860 wrote to memory of 2852	2860	LMAOOOO.exe	34
PID 2860 wrote to memory of 2852	2860	LMAOOOO.exe	34
PID 2860 wrote to memory of 2852	2860	LMAOOOO.exe	34
PID 2860 wrote to memory of 2852	2860	LMAOOOO.exe	34
PID 2852 wrote to memory of 552	2852	WindowsServices.exe	36
PID 2852 wrote to memory of 552	2852	WindowsServices.exe	36
PID 2852 wrote to memory of 552	2852	WindowsServices.exe	36
PID 2852 wrote to memory of 552	2852	WindowsServices.exe	36

C:\Users\Admin\AppData\Local\Temp\ead1418caeff94606570fe757994c2ea_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ead1418caeff94606570fe757994c2ea_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Users\Admin\AppData\Local\Temp\ExLoader.exe
  "C:\Users\Admin\AppData\Local\Temp\ExLoader.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://java.com/download
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2220
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2220 CREDAT:275457 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2792
- C:\Users\Admin\AppData\Local\Temp\LMAOOOO.exe
  "C:\Users\Admin\AppData\Local\Temp\LMAOOOO.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2860
- - C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe
    "C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2852
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe" "WindowsServices.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3de374d505ed48c5cdaa52765388d730

SHA1
9716a431e52e40e634cdc20729f0d1876f0ad7fe

SHA256
156c64c4d185471b620260ea7c2de80f9281151f7fea9fc746487c9cad1cd8ac

SHA512
a4da3264d319d6bb87f31255fd70642d09a1d90e279bd8200746f6259ffc07f284a229b30cea80fd24919df4a3f949a88204af61ae00aabba62285e07de6e18e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
869689cbea5fa90dfc61de8d868da841

SHA1
6be5e98e994f799ebff924ddf80fea7cdc400f56

SHA256
6bcbaf83d2713c426b63dfc6070e2ceeada9fbe849a94e7772272ecaa833ae6e

SHA512
95a932846ef7355433087dd0380eb75991ff82665b06f7e60d84340bb9c1bd6c84dc7e215cd16c7f9c91270607e48a1d2ba05ed3b3b82650e6cc25a164755287

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d2aa7917307643912198afaa92e661b

SHA1
fa9a0936feb3c2dbf3e69b64d2e5666e7c506517

SHA256
95b9938a7386d95be6b04b818afb771c1b1180b09dc14bf13ea2da33274bee70

SHA512
86cdbe08155c3af7e800458e4c75c15964e75deb1b181ba28bf831568deb5fec15b2a9ca89acee982d8decda83388e6c64c3ec4995291ca6f8fe1466078720e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa856ac51868e00d6e61dea2db3d1080

SHA1
85f277d98d9887864655c48d9b8fef1f60d3bc24

SHA256
020b12898745838b36f27fdc13c447acf580cc2c3b06e816389e0bf4fccde8eb

SHA512
e500c906de90739d12c2c89ccb5ad1ce9e7571668c8c1aa606f911719447e05f556a102d167c997fa19c839a46bf1355889918867d86911d8b33d103b6e2f95f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d68e53e58f45e0f6000f70ed1da5b676

SHA1
8db3192d7348121a6beddb89e82bdb9a2d427fdf

SHA256
bfd2f1a67fc6ba3e1fbfb10f0d25e9763258a283c20b78dbb84ba4025ed73f37

SHA512
41f2b16ac2bc27bfa2950b83ade5ece9d94bf9381bff601b52ed513d4f03ae0bfd709b7c86c6d4099a1fbffdf4d60d1c4070c58d522308eacc6fcf4b80a8dc74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9eb7a255f9e9e2a6ae98613d08f3ca01

SHA1
6c72f6a1ff6c8df23d59c87f8c1ee4dba2c790b4

SHA256
5598378f8a1c784d1ca41449ee095ce2d304949ab5343ed8de048c37bff2dd52

SHA512
749747571f3d5788de7b2237494b536ff6a128a0a5c56cdc0d3dc34b6d9b33830cf4b156c69d0ea71c6b68fd40ab2e17d0913373634f0ccee1c1cd8ca4429d1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6c867e29a4309b7b50a7e604ee52d47

SHA1
529862f5a741fa7ad1a7bca690a9bec78cd5aa40

SHA256
9152b4877529f3e2ea34bd5e502c0b1bb420bc62f3b9a1ea03a5ef71e02625a5

SHA512
fb6814042cb45c60615590b0ab4af9a293f0632b069452f7828882b601f9f1a3dbd0d0af3bfbcb2ff117653c3084657f5266d8783780de916e8e49abe5af7810

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1a2e6928cdefaf1f2812741d603ae1a

SHA1
138a283febc80d6ff4f177c9d93fccb878a1d23c

SHA256
d2812f49eea2686934bcd895e1c0db7456c2db83b24668b8be28a1530e4f6690

SHA512
1f26f5e351e9d61525a444f041b1994123d50be5a2a09f6c33c747283dac4290885768bac8fc31e571b4ecd75ea5d504b6038be313451a970d118871e31e61ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d258de7bc897910ee91f5b51d4a71467

SHA1
2e94b189a84e7b94a07de1c2ea7cbfc0baf76062

SHA256
421554f4097dd79de2f6c08b75e104ad06575b377e06fc97aae1ecb66e76fcfa

SHA512
53c64776019220f3c6388a69105e7397c82ad437fae5a9692966239db023d132240b3dcd23f7a30a556541d90706af8a22d264ab0d88ad13d967ae3badc0e098

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
66a7bcf238a664890f14faf30fa2e7d3

SHA1
9809b30681a47718f6bffb55c17928a5ea9716db

SHA256
b863c7ca31b91463ccfda63fd57fdaf09f95c24b08d9c9bc4ac17dad0cb4305a

SHA512
359c1cc0c9884b950502888e38c58c5cf59ca25823409d5ba5c1a203bc1d8582e475736a2dfcd83469e50e14c2644180f7c6c388d3b13aaffd37b5a7b7cfb985

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d718591a5b228c17deadb0d11db48517

SHA1
7a07480d65dbf836bedfbfc96793bcac8aaae7e4

SHA256
c0e1812d7b251dc49384ac9841987acffcbe6320a639e39b6004c1769ffd2862

SHA512
a8bbd88631534de1fdf99964cc1b1a54080647803d884d80adb66f954d27d1cffc1aeffd2242e60607d067b42cd87ba01db54c4fced58b014321d032418e1fc9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ccae45a2d5a338d90df8474d8d916844

SHA1
679b92f20fc28f4601e6ba530f33cb4b39b1b75a

SHA256
3d57139f8631f514b6cf2251ff1c176b7bc2f6daacf53442e4bbf3a096e3a30f

SHA512
e593de12fc127b7a89f99e9e7a96a5d543739f8062a3468386cad308d60252daa1e283cac85f0b632e26736e7142311c6eed8b4bdc14ca256c932b9e018d69b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f4e51102e1ac16e131b19f813aa2ea07

SHA1
8a8748e7b1167f254c6e6280c9ee6b4f48cc297f

SHA256
7bad7aa5c9fd51446a9e2461e86d3c9462268a572fd0ebb2ae09f128827c69da

SHA512
e9d33e22ceb2eb50286fb5c8fbf54e2a35b7c299d162aa2e97ed6dfd69c9fe9616ff0140da61168e702a2b7ce6739d66e1d2d73d205f2dea8ab5ddf9bdc44681

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
911a22a98c738d5b363d041fa884cf2a

SHA1
0754444d029bba8ec79c14f42883000c7a0b249a

SHA256
857aceb08c9655b6dcc15ab173d2630211c2a28ce6c45aaad6e9f3cfd03dcdb0

SHA512
46c36208333159900c2b09b94469449e7d4901491b7af253ba6d7fe0658f81ff520584efdb29263c0fa53a0276b53e925fe70ed0da23892483a3ad06511e14bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
474c2244daff59b8b1c4d66aacfa1b73

SHA1
f079af23f6ce788f75bce2edc82705b8eb5bb3c6

SHA256
c92419d59b727b99ead9b75efde07c5d20c234700da5d47fabc89a6302c98cb0

SHA512
562ee4034cad2b072f195a8889625cc50bf550df3695761a21779f3d21c976b16c2163d63ba59741484108943fc8e9da61c0f4c2a2f2e903c88f665d2337ea62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
32d2efb923cec8c81049b07d0786aeb7

SHA1
daf595471563ca5af272faa4f10a8af7d7da727a

SHA256
a480fdf68e509da3bacdf778698dc3031847f9555c23f5c1209542bd9c548921

SHA512
012512c8aa8eca764ac95558fb429199cadd8b20854a465e9ed8e7e6529d25181e24425f24ff668073cc1d40240eea6b20f830de8e25dad45d4859739b4c7499

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd9ab6175b45fb6599fc469cf6a3b1fb

SHA1
afa90cb132575e76f86fd182d266ccadca855501

SHA256
d87d78b6b1730d8b25fb0388f9a4f78e5a47b71360bfa8d254bdc5290700f554

SHA512
fe8075adfb940a81cb54425b867aa197a3d775f0d401c4755b38971305ceacd467d0186107a05b8604f09e8bc39e88f2faba2e68ad127e0eb6544a9ba5883ad9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c765d43629cc7916651a8611a330a815

SHA1
8ff32f1eb0558dcc33c08c4e8ec2e3935cd44d2b

SHA256
a81c84c9b8915483e21f31be00f17e379f9957428a0a853e039069014ac00ad0

SHA512
838430b6b57ba72ab1f9179ebc073f2522d30af2137ce56ce108c921db96c8fa8cf2e6013b4b4405c6046afb9559d5f20d4bf7fc2d847a173da32406ae6b2b8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3dee4d61f5f412ee48cece43ffaeec48

SHA1
7611beddf684414e2d8095694f6a18bb296104b2

SHA256
cae6114d2f3c19c38e7e909e74ea3b3b7cb60d832deddcacdf980734740791d9

SHA512
59c7c01ce2a8f2d39d1f1bf63d0a00f62214c808d4a6ad44144524cd177da0eed8dbaf276a24cc5ba7637aab418bc8daeec55f7406036224f91ed2248507b00a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e9258db40d09df1c85c5417f22f24c4

SHA1
84dbe137cfc35c0b8554b088dc79e0de23ff105e

SHA256
ee22dba65c7267d349a109dbce12abbedd8227f7c1514458f39535ae2f0340fe

SHA512
fc428110a9632a18d33f51b5985d9ab98e9c7e2c32cb33613804cc9d78a574db614d40d23b9b5b8fe278862f91ea7d5869eef2b010ab5a270b8df11651597fe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9628c9a63e4c915f271cbb2eafeabbff

SHA1
a698f4ec47180758648f9cbca3280f3f8002ebba

SHA256
cc946704113212d474f37c3a3dc52b2d12c7aa7bb00d52bb7db1b80b49c5c606

SHA512
fa3df40e4ca1c13f98ca4e453ebf1d4f609c5daa7f31dd8be9d7e30f59f5440b2ca59516539ec53afe6cb007c79623a43bbb1759f70b6fdba79e5493979b485c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f6ba1890093585b92b292c02098ea30

SHA1
c9e6dcacb93303c63937d5989aeab8b800a3ad70

SHA256
ad858206c96b133abc2fb1ec71941b498b1c8fc5f7a9420d69e5d968d7713740

SHA512
476632cc86c23f6a2f76a88e1459ac029242312037fac426f5476230a9c42517c5eae1ab4f7275f57e138efcac1123f110644e87388b95833bd890baa6142403

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\8F6AKK4Z\www.java[1].xml

Filesize
398B

MD5
e4977f9f18df4656ac848f1bc436c66a

SHA1
eec9e7ed40d5243d2c6dec0e5034315b506c7dc1

SHA256
abcedb29976056e7e094cdd86bec38ac24e30cef3221a4a17c6ece81defca623

SHA512
56d18a827be3acc712d9aa3fd569c6cf0388990194f7dc817c318a66dab5200a5d310b119e4a8717527ffe5f096f080c7ba960ce926ca3203810c9e2be162c9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\8F6AKK4Z\www.java[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\yiu0yt6\imagestore.dat

Filesize
1KB

MD5
c164d0a7be53d7707cf8b7e58e6064a4

SHA1
e5ef6a7071c91589d935d9c911cc0f3be8b02a26

SHA256
58643cef4165ef354431a601db93b03932db9f138405d57553b038700596e267

SHA512
c7787c87d05cafd61fc98ed3c8692c937abc515e56449d5ca58f6062e446cd552258baf7c3e679e57ce7e4d293336621ca59e7709119ce66c16e2665566ae475

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DJB1KT77\favicon[1].ico

Filesize
1KB

MD5
8e39f067cc4f41898ef342843171d58a

SHA1
ab19e81ce8ccb35b81bf2600d85c659e78e5c880

SHA256
872bad18b566b0833d6b496477daab46763cf8bdec342d34ac310c3ac045cefd

SHA512
47cd7f4ce8fcf0fc56b6ffe50450c8c5f71e3c379ecfcfd488d904d85ed90b4a8dafa335d0e9ca92e85b02b7111c9d75205d12073253eed681868e2a46c64890

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC1AB.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\LMAOOOO.exe

Filesize
78KB

MD5
c12b313774cec4c152481b3d1c88b8d7

SHA1
ef28b3ec99171456c92e30c6ed5c918db0414dc2

SHA256
a702cef112c7299ad60b3211ab707b114022e33086908eee999eeb315a5cfbd8

SHA512
ebc876e00c1e23b4ffa23196c49d93993f33c2399963c3d815affa977d27ae123931413f689e40b43e5912fdb83df87526b23373bdf429d400b1ec86a240ddaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC1AE.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
\Users\Admin\AppData\Local\Temp\ExLoader.exe

Filesize
7.1MB

MD5
bad6c58357030e51773e5f82cb0016e9

SHA1
9ac18d7f31d765dca2e7c91a48f8de6c8def8873

SHA256
c70b9c8787b60daa2615bb21d8596594eb6225323fa06b9e3e2cb18a3dbadec5

SHA512
3aadd55a6b460e646e8ee6ce54e403299bbe2536fa002e28845b57c979b4684e51091ed6349b1318865d1beec6d3e63a1301ebf1bb21e7f8c74ddc620743370e

Download Submit
memory/2012-17-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2168-14-0x0000000000400000-0x0000000000B52000-memory.dmp

Filesize
7.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads