njrat | 3d027d9488ecc9b42321a91d0ab62f558b415418ade114024d158def747041d5

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
23-09-2024 15:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f29a2274931e575fad1687f2e13be0cc_JaffaCakes118.exe
Size

93KB
MD5

f29a2274931e575fad1687f2e13be0cc
SHA1

48e19b444fedb0313590e2f976c4c74f612d5222
SHA256

3d027d9488ecc9b42321a91d0ab62f558b415418ade114024d158def747041d5
SHA512

2c34f0f4c0582b5f272ed0803e5e9982bbfc7a8cb1587ec36e9b4af453540ffd8d1a1286e3fc2a70a90270e0f890bbcc08251d3fe12dff09b4f8e90c0208c17e
SSDEEP

1536:Gw4Ec0HCYnz7a5MzU/jEwzGi1dDgDpgS:GwZHCYnzQMzUEi1dem

Score

10^/10

njrat hacked discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

Hacked

hakim32.ddns.net:2000

127.0.0.1:5552

Mutex

933b50ceb66c61e2d1f00d0728b5a5f8

Attributes

reg_key
933b50ceb66c61e2d1f00d0728b5a5f8
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Disables Task Manager via registry modification
evasion

Modifies Windows Firewall 2 TTPs 3 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2188	netsh.exe
2612	netsh.exe
2664	netsh.exe

Drops startup file 6 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe	server.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\933b50ceb66c61e2d1f00d0728b5a5f8Windows Update.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\933b50ceb66c61e2d1f00d0728b5a5f8Windows Update.exe	server.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe	server.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\.exe	server.exe

Executes dropped EXE 1 IoCs

pid	Process
2540	server.exe

Loads dropped DLL 2 IoCs

pid	Process
2292	f29a2274931e575fad1687f2e13be0cc_JaffaCakes118.exe
2292	f29a2274931e575fad1687f2e13be0cc_JaffaCakes118.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\autorun.inf	server.exe
File created	F:\autorun.inf	server.exe
File opened for modification	F:\autorun.inf	server.exe
File created	C:\autorun.inf	server.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\.exe	server.exe
File opened for modification	C:\Windows\SysWOW64\.exe	server.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\.exe	server.exe
File opened for modification	C:\Program Files (x86)\.exe	server.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f29a2274931e575fad1687f2e13be0cc_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	server.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe
2540	server.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2540	server.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeDebugPrivilege	2540	server.exe
Token: 33	2540	server.exe
Token: SeIncBasePriorityPrivilege	2540	server.exe
Token: 33	2540	server.exe
Token: SeIncBasePriorityPrivilege	2540	server.exe
Token: 33	2540	server.exe
Token: SeIncBasePriorityPrivilege	2540	server.exe
Token: 33	2540	server.exe
Token: SeIncBasePriorityPrivilege	2540	server.exe
Token: 33	2540	server.exe
Token: SeIncBasePriorityPrivilege	2540	server.exe
Token: 33	2540	server.exe
Token: SeIncBasePriorityPrivilege	2540	server.exe
Token: 33	2540	server.exe
Token: SeIncBasePriorityPrivilege	2540	server.exe
Token: 33	2540	server.exe
Token: SeIncBasePriorityPrivilege	2540	server.exe
Token: 33	2540	server.exe
Token: SeIncBasePriorityPrivilege	2540	server.exe
Token: 33	2540	server.exe
Token: SeIncBasePriorityPrivilege	2540	server.exe
Token: 33	2540	server.exe
Token: SeIncBasePriorityPrivilege	2540	server.exe
Token: 33	2540	server.exe
Token: SeIncBasePriorityPrivilege	2540	server.exe
Token: 33	2540	server.exe
Token: SeIncBasePriorityPrivilege	2540	server.exe
Token: 33	2540	server.exe
Token: SeIncBasePriorityPrivilege	2540	server.exe
Token: 33	2540	server.exe
Token: SeIncBasePriorityPrivilege	2540	server.exe
Token: 33	2540	server.exe
Token: SeIncBasePriorityPrivilege	2540	server.exe
Token: 33	2540	server.exe
Token: SeIncBasePriorityPrivilege	2540	server.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2540	2292	f29a2274931e575fad1687f2e13be0cc_JaffaCakes118.exe	30
PID 2292 wrote to memory of 2540	2292	f29a2274931e575fad1687f2e13be0cc_JaffaCakes118.exe	30
PID 2292 wrote to memory of 2540	2292	f29a2274931e575fad1687f2e13be0cc_JaffaCakes118.exe	30
PID 2292 wrote to memory of 2540	2292	f29a2274931e575fad1687f2e13be0cc_JaffaCakes118.exe	30
PID 2540 wrote to memory of 2188	2540	server.exe	32
PID 2540 wrote to memory of 2188	2540	server.exe	32
PID 2540 wrote to memory of 2188	2540	server.exe	32
PID 2540 wrote to memory of 2188	2540	server.exe	32
PID 2540 wrote to memory of 2612	2540	server.exe	34
PID 2540 wrote to memory of 2612	2540	server.exe	34
PID 2540 wrote to memory of 2612	2540	server.exe	34
PID 2540 wrote to memory of 2612	2540	server.exe	34
PID 2540 wrote to memory of 2664	2540	server.exe	35
PID 2540 wrote to memory of 2664	2540	server.exe	35
PID 2540 wrote to memory of 2664	2540	server.exe	35
PID 2540 wrote to memory of 2664	2540	server.exe	35

C:\Users\Admin\AppData\Local\Temp\f29a2274931e575fad1687f2e13be0cc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f29a2274931e575fad1687f2e13be0cc_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2292
- C:\ProgramData\server.exe
  "C:\ProgramData\server.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Drops autorun.inf file
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\ProgramData\server.exe" "server.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2188
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall delete allowedprogram "C:\ProgramData\server.exe"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2612
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\ProgramData\server.exe" "server.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\app

Filesize
5B

MD5
c2844bc9e1bd64168a727b0680ae4d90

SHA1
7bb263540de557f5a4e09c6c78b7dbb314a0df9a

SHA256
9c9701ab918368b615fc6a0dbeb5efa286a232d751982ae70b48ad6914bf01e5

SHA512
360953bb20d91539022fcb1becf4638970c4452816797a8dca65e3ae4a542302e6e89f0828087caaa63a0750aa78605f8034da7c8663fa4fc677c8f3e53655ed

Download Submit
\ProgramData\server.exe

Filesize
93KB

MD5
f29a2274931e575fad1687f2e13be0cc

SHA1
48e19b444fedb0313590e2f976c4c74f612d5222

SHA256
3d027d9488ecc9b42321a91d0ab62f558b415418ade114024d158def747041d5

SHA512
2c34f0f4c0582b5f272ed0803e5e9982bbfc7a8cb1587ec36e9b4af453540ffd8d1a1286e3fc2a70a90270e0f890bbcc08251d3fe12dff09b4f8e90c0208c17e

Download Submit
memory/2292-0-0x0000000074671000-0x0000000074672000-memory.dmp

Filesize
4KB

Download
memory/2292-1-0x0000000074670000-0x0000000074C1B000-memory.dmp

Filesize
5.7MB

Download
memory/2292-2-0x0000000074670000-0x0000000074C1B000-memory.dmp

Filesize
5.7MB

Download
memory/2292-15-0x0000000074670000-0x0000000074C1B000-memory.dmp

Filesize
5.7MB

Download
memory/2540-16-0x0000000074670000-0x0000000074C1B000-memory.dmp

Filesize
5.7MB

Download
memory/2540-14-0x0000000074670000-0x0000000074C1B000-memory.dmp

Filesize
5.7MB

Download
memory/2540-51-0x0000000074670000-0x0000000074C1B000-memory.dmp

Filesize
5.7MB

Download
memory/2540-53-0x0000000074670000-0x0000000074C1B000-memory.dmp

Filesize
5.7MB

Download
memory/2540-52-0x0000000074670000-0x0000000074C1B000-memory.dmp

Filesize
5.7MB

Download