Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
27-09-2024 23:56
General
-
Target
fb224fbe1aa6b663191cf1d730537fd6_JaffaCakes118.exe
-
Size
25KB
-
MD5
fb224fbe1aa6b663191cf1d730537fd6
-
SHA1
6a82fb803bbe3b20fb289b94f63c1cc2a6b97dee
-
SHA256
034fb6099b396601161d3076a4c80247cf30c46e3add3b2de6dea577209b4112
-
SHA512
383f6a9dc75b052354ac0ba59da6ad52daef796acaf2953d8cb5912e3bfa174729386e5172401a7676ad7c9bb934dff832ebbe0a8f15b39e0e9fa9e4bc40d505
-
SSDEEP
768:5vkGDkx0b/5+So7h4d7JRo4a/pPhsuE+fj:yf0b/5+Si4bWpFhsv+fj
Malware Config
Extracted
njrat
Njrat 0.7 Golden By Hassan Amiri
server
31.173.24.54:5552
Windows Update
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Drops startup file 2 IoCs
-
Executes dropped EXE 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 33 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb224fbe1aa6b663191cf1d730537fd6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fb224fbe1aa6b663191cf1d730537fd6_JaffaCakes118.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Server.exeC:\Users\Admin\AppData\Local\Temp/Server.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408B
MD54a02286231546d5a837701befc9aeafa
SHA1ca28fba9e5d36d4093ca5a5c0d9cc6fa88756710
SHA256c55d933eb6b3c6317d6c0ef97e400222493bafa7cf2007e8b2fd0653288a560f
SHA5125f27784009926af504353da5442acc75cb6509d942c3b7931f386408f5e0d6e4b0fec421f902b04af65ec3116850bb0e82e968d458b0632bb5f451bc5f4a7f93
-
Filesize
25KB
MD5fb224fbe1aa6b663191cf1d730537fd6
SHA16a82fb803bbe3b20fb289b94f63c1cc2a6b97dee
SHA256034fb6099b396601161d3076a4c80247cf30c46e3add3b2de6dea577209b4112
SHA512383f6a9dc75b052354ac0ba59da6ad52daef796acaf2953d8cb5912e3bfa174729386e5172401a7676ad7c9bb934dff832ebbe0a8f15b39e0e9fa9e4bc40d505
-
Filesize
9.6MB
-
Filesize
72KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
72KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
624KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
32KB
-
Filesize
9.6MB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
9.6MB
-
Filesize
664KB
-
Filesize
72KB
-
Filesize
9.6MB
-
Filesize
4.8MB