Analysis
-
max time kernel
149s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
25-09-2024 15:43
Static task
static1
Behavioral task
behavioral1
Sample
f655650ed251a7a651dd2f81d1bf9737_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
f655650ed251a7a651dd2f81d1bf9737_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
f655650ed251a7a651dd2f81d1bf9737_JaffaCakes118.exe
-
Size
93KB
-
MD5
f655650ed251a7a651dd2f81d1bf9737
-
SHA1
5886e7d5587d910c8ab5925ebfffe0503c82e9a6
-
SHA256
1607f1ef2be3b4e291530c0e1f10558e3745d8553fcf7476a2b0c7930c6fab96
-
SHA512
f47ea2e216b17e9b4f12512fc17a5d74b2eacc653a40f01e6986ceb59dfd098db43784b093aca6d52db7b231570c57629eb8d2e812fe5f5a979353b5ef317203
-
SSDEEP
1536:eS3xh6Yl0fHbvhwI7Uc0NTeKsYgBSoIJ0K8p9f+yq:e6vlQbCIOpMM5qp9fBq
Malware Config
Extracted
njrat
0.7d
49277 reupload 03/07/2015
openvpnn.ddns.net:606
1714db86e735c1ffae8c449f489875c7
-
reg_key
1714db86e735c1ffae8c449f489875c7
-
splitter
|'|'|
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2180 netsh.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\host.lnk f655650ed251a7a651dd2f81d1bf9737_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
Suspicious use of AdjustPrivilegeToken 37 IoCs
description pid Process Token: SeDebugPrivilege 2464 f655650ed251a7a651dd2f81d1bf9737_JaffaCakes118.exe Token: 33 2464 f655650ed251a7a651dd2f81d1bf9737_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2464 f655650ed251a7a651dd2f81d1bf9737_JaffaCakes118.exe Token: 33 2464 f655650ed251a7a651dd2f81d1bf9737_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2464 f655650ed251a7a651dd2f81d1bf9737_JaffaCakes118.exe Token: 33 2464 f655650ed251a7a651dd2f81d1bf9737_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2464 f655650ed251a7a651dd2f81d1bf9737_JaffaCakes118.exe Token: 33 2464 f655650ed251a7a651dd2f81d1bf9737_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2464 f655650ed251a7a651dd2f81d1bf9737_JaffaCakes118.exe Token: 33 2464 f655650ed251a7a651dd2f81d1bf9737_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2464 f655650ed251a7a651dd2f81d1bf9737_JaffaCakes118.exe Token: 33 2464 f655650ed251a7a651dd2f81d1bf9737_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2464 f655650ed251a7a651dd2f81d1bf9737_JaffaCakes118.exe Token: 33 2464 f655650ed251a7a651dd2f81d1bf9737_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2464 f655650ed251a7a651dd2f81d1bf9737_JaffaCakes118.exe Token: 33 2464 f655650ed251a7a651dd2f81d1bf9737_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2464 f655650ed251a7a651dd2f81d1bf9737_JaffaCakes118.exe Token: 33 2464 f655650ed251a7a651dd2f81d1bf9737_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2464 f655650ed251a7a651dd2f81d1bf9737_JaffaCakes118.exe Token: 33 2464 f655650ed251a7a651dd2f81d1bf9737_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2464 f655650ed251a7a651dd2f81d1bf9737_JaffaCakes118.exe Token: 33 2464 f655650ed251a7a651dd2f81d1bf9737_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2464 f655650ed251a7a651dd2f81d1bf9737_JaffaCakes118.exe Token: 33 2464 f655650ed251a7a651dd2f81d1bf9737_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2464 f655650ed251a7a651dd2f81d1bf9737_JaffaCakes118.exe Token: 33 2464 f655650ed251a7a651dd2f81d1bf9737_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2464 f655650ed251a7a651dd2f81d1bf9737_JaffaCakes118.exe Token: 33 2464 f655650ed251a7a651dd2f81d1bf9737_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2464 f655650ed251a7a651dd2f81d1bf9737_JaffaCakes118.exe Token: 33 2464 f655650ed251a7a651dd2f81d1bf9737_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2464 f655650ed251a7a651dd2f81d1bf9737_JaffaCakes118.exe Token: 33 2464 f655650ed251a7a651dd2f81d1bf9737_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2464 f655650ed251a7a651dd2f81d1bf9737_JaffaCakes118.exe Token: 33 2464 f655650ed251a7a651dd2f81d1bf9737_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2464 f655650ed251a7a651dd2f81d1bf9737_JaffaCakes118.exe Token: 33 2464 f655650ed251a7a651dd2f81d1bf9737_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2464 f655650ed251a7a651dd2f81d1bf9737_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2464 wrote to memory of 2180 2464 f655650ed251a7a651dd2f81d1bf9737_JaffaCakes118.exe 30 PID 2464 wrote to memory of 2180 2464 f655650ed251a7a651dd2f81d1bf9737_JaffaCakes118.exe 30 PID 2464 wrote to memory of 2180 2464 f655650ed251a7a651dd2f81d1bf9737_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\f655650ed251a7a651dd2f81d1bf9737_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f655650ed251a7a651dd2f81d1bf9737_JaffaCakes118.exe"1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Windows\system32\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\f655650ed251a7a651dd2f81d1bf9737_JaffaCakes118.exe" "f655650ed251a7a651dd2f81d1bf9737_JaffaCakes118.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2180
-