Analysis
-
max time kernel
150s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
21-09-2024 00:53
Behavioral task
behavioral1
Sample
ee9c59ed661de901b23475e7b6af8c5c_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
18 signatures
150 seconds
General
-
Target
ee9c59ed661de901b23475e7b6af8c5c_JaffaCakes118.exe
-
Size
252KB
-
MD5
ee9c59ed661de901b23475e7b6af8c5c
-
SHA1
34a9f7397cbac20c422067683b1bb87659d4c3c6
-
SHA256
25e5c94e59845bf8f4096d2eee10ab131e31096b957e1034c1fc0fd1164c1927
-
SHA512
d3d2d301f6a81005a7134ba756bf91765b311f992cb882cc94501c2ecd494a80666ce6f4a6a07bfa16ea5b15d523fa2c7917906b3a4c7deff38ddfd55ae753a6
-
SSDEEP
3072:bYs03EcckEmNoSsmfYgaKSRye29MXHPJ+TBVPRvdlDrwpxaZb8ywfxs54xoWav4M:s0Ss75S9cJ+503g8/0QO
Malware Config
Extracted
Family
njrat
Version
0.6.4
Botnet
تم الاختراق من قبل دكتور الغربية #
C2
Dr187.ddns.net:999
Mutex
59e66e4fd01ed7a53bb65713760bdb7d
Attributes
-
reg_key
59e66e4fd01ed7a53bb65713760bdb7d
-
splitter
|'|'|
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 3996 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation ee9c59ed661de901b23475e7b6af8c5c_JaffaCakes118.exe -
Drops startup file 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\59e66e4fd01ed7a53bb65713760bdb7d.exe Google Root.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\59e66e4fd01ed7a53bb65713760bdb7d.exe Google Root.exe File opened for modification \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\59e66e4fd01ed7a53bb65713760bdb7d.exe taskmgr.exe -
Executes dropped EXE 2 IoCs
pid Process 1488 Google Root.exe 5084 Google Root.exe -
Obfuscated with Agile.Net obfuscator 2 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule behavioral1/memory/4480-1-0x0000000000280000-0x00000000002C4000-memory.dmp agile_net behavioral1/files/0x00080000000234a8-8.dat agile_net -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\59e66e4fd01ed7a53bb65713760bdb7d = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Google Root.exe\" .." Google Root.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\59e66e4fd01ed7a53bb65713760bdb7d = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Google Root.exe\" .." Google Root.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Internet Explorer\TypedURLs taskmgr.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 1488 Google Root.exe 1488 Google Root.exe 1488 Google Root.exe 1488 Google Root.exe 1488 Google Root.exe 1488 Google Root.exe 1488 Google Root.exe 1488 Google Root.exe 1488 Google Root.exe 1488 Google Root.exe 1488 Google Root.exe 1488 Google Root.exe 1488 Google Root.exe 4544 taskmgr.exe 1488 Google Root.exe 1488 Google Root.exe 1488 Google Root.exe 1488 Google Root.exe 1488 Google Root.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 1488 Google Root.exe 1488 Google Root.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 1488 Google Root.exe 1488 Google Root.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 1488 Google Root.exe 1488 Google Root.exe 4544 taskmgr.exe 4544 taskmgr.exe 1488 Google Root.exe 1488 Google Root.exe 1488 Google Root.exe 1488 Google Root.exe 1488 Google Root.exe 1488 Google Root.exe 1488 Google Root.exe 1488 Google Root.exe 1488 Google Root.exe 1488 Google Root.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4544 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4544 taskmgr.exe Token: SeSystemProfilePrivilege 4544 taskmgr.exe Token: SeCreateGlobalPrivilege 4544 taskmgr.exe Token: SeDebugPrivilege 1488 Google Root.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 3692 Netplwiz.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe 4544 taskmgr.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4480 wrote to memory of 1488 4480 ee9c59ed661de901b23475e7b6af8c5c_JaffaCakes118.exe 82 PID 4480 wrote to memory of 1488 4480 ee9c59ed661de901b23475e7b6af8c5c_JaffaCakes118.exe 82 PID 1488 wrote to memory of 3996 1488 Google Root.exe 83 PID 1488 wrote to memory of 3996 1488 Google Root.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee9c59ed661de901b23475e7b6af8c5c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ee9c59ed661de901b23475e7b6af8c5c_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\Google Root.exe"C:\Users\Admin\AppData\Local\Temp\Google Root.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\SYSTEM32\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Google Root.exe" "Google Root.exe" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:3996
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops startup file
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4544
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\ee9c59ed661de901b23475e7b6af8c5c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ee9c59ed661de901b23475e7b6af8c5c_JaffaCakes118.exe"1⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\Google Root.exe"C:\Users\Admin\AppData\Local\Temp\Google Root.exe"1⤵
- Executes dropped EXE
PID:5084
-
C:\Windows\System32\Netplwiz.exe"C:\Windows\System32\Netplwiz.exe"1⤵
- Suspicious use of FindShellTrayWindow
PID:3692
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ee9c59ed661de901b23475e7b6af8c5c_JaffaCakes118.exe.log
Filesize1KB
MD5a8a147915e3a996fdbe10b3a3f1e1bb2
SHA1abc564c1be468d57e700913e7b6cf8f62d421263
SHA2568b96a8557deea66696837af011843d6a82451ba57c8f9b5a2726a70818d6fc7e
SHA51217b42f17ef60a9f625703172763f692e5ed2ca93564a97853dfa72bb0ac6305ef3267aea0b205938e3aa8eac10156d9d4f322b30d0329d92d647bcec6372731c
-
Filesize
252KB
MD5ee9c59ed661de901b23475e7b6af8c5c
SHA134a9f7397cbac20c422067683b1bb87659d4c3c6
SHA25625e5c94e59845bf8f4096d2eee10ab131e31096b957e1034c1fc0fd1164c1927
SHA512d3d2d301f6a81005a7134ba756bf91765b311f992cb882cc94501c2ecd494a80666ce6f4a6a07bfa16ea5b15d523fa2c7917906b3a4c7deff38ddfd55ae753a6
-
Filesize
103B
MD5324e6086bf13b16f14cd6226cca20e02
SHA19a20b8c3e381f3b5f4c84dc8f69a63fe7f2e03ef
SHA2562c905c10eb385eb711403b1ec1b9a55250ed5f65dc048078a3a8b35f34bb9dd6
SHA51247543b903d7fb2eee173ba2ac7c834c8baa0d8e94dde75526f6ddcd33b79326c191a3d0365802f49f4e0ea8d092187e89a9f516a215ef31639dc067d8fb2d9d1