Malware Analysis Report

2025-03-15 06:24

Sample ID 240928-mdr1qazhln
Target fc16abc8960acdf5ca9604c10cdf7c91_JaffaCakes118
SHA256 9cf3407c64cfbe45f1ae86ea6f80785b0992403325fa067da6dd52ae56a35ae9
Tags
njrat hacked discovery evasion persistence privilege_escalation trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

9cf3407c64cfbe45f1ae86ea6f80785b0992403325fa067da6dd52ae56a35ae9

Threat Level: Known bad

The file fc16abc8960acdf5ca9604c10cdf7c91_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

njrat hacked discovery evasion persistence privilege_escalation trojan

njRAT/Bladabindi

Modifies Windows Firewall

Checks computer location settings

Executes dropped EXE

Drops startup file

Loads dropped DLL

Adds Run key to start application

Drops autorun.inf file

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Unsigned PE

Event Triggered Execution: Netsh Helper DLL

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-28 10:21

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-28 10:21

Reported

2024-09-28 10:23

Platform

win10v2004-20240802-en

Max time kernel

150s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\fc16abc8960acdf5ca9604c10cdf7c91_JaffaCakes118.exe"

Signatures

njRAT/Bladabindi

trojan njrat

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation C:\VW.sfx.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\RarSFX0\VW.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\fc16abc8960acdf5ca9604c10cdf7c91_JaffaCakes118.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\382c90059fa8d9f2234ed90a1265fc51.exe C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\382c90059fa8d9f2234ed90a1265fc51.exe C:\Users\Admin\AppData\Local\Temp\VW.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\VW.sfx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\382c90059fa8d9f2234ed90a1265fc51 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\VW.exe\" .." C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\382c90059fa8d9f2234ed90a1265fc51 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\VW.exe\" .." C:\Users\Admin\AppData\Local\Temp\VW.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File created C:\autorun.inf C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
File opened for modification C:\autorun.inf C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
File created D:\autorun.inf C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
File created F:\autorun.inf C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
File opened for modification F:\autorun.inf C:\Users\Admin\AppData\Local\Temp\VW.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\VW.sfx.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\RarSFX0\VW.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\fc16abc8960acdf5ca9604c10cdf7c91_JaffaCakes118.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4004 wrote to memory of 3948 N/A C:\Users\Admin\AppData\Local\Temp\fc16abc8960acdf5ca9604c10cdf7c91_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4004 wrote to memory of 3948 N/A C:\Users\Admin\AppData\Local\Temp\fc16abc8960acdf5ca9604c10cdf7c91_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4004 wrote to memory of 3948 N/A C:\Users\Admin\AppData\Local\Temp\fc16abc8960acdf5ca9604c10cdf7c91_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 3948 wrote to memory of 1464 N/A C:\Windows\SysWOW64\cmd.exe C:\VW.sfx.exe
PID 3948 wrote to memory of 1464 N/A C:\Windows\SysWOW64\cmd.exe C:\VW.sfx.exe
PID 3948 wrote to memory of 1464 N/A C:\Windows\SysWOW64\cmd.exe C:\VW.sfx.exe
PID 1464 wrote to memory of 4868 N/A C:\VW.sfx.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\VW.exe
PID 1464 wrote to memory of 4868 N/A C:\VW.sfx.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\VW.exe
PID 1464 wrote to memory of 4868 N/A C:\VW.sfx.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\VW.exe
PID 4868 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\VW.exe C:\Users\Admin\AppData\Local\Temp\VW.exe
PID 4868 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\VW.exe C:\Users\Admin\AppData\Local\Temp\VW.exe
PID 4868 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\VW.exe C:\Users\Admin\AppData\Local\Temp\VW.exe
PID 2240 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Local\Temp\VW.exe C:\Windows\SysWOW64\netsh.exe
PID 2240 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Local\Temp\VW.exe C:\Windows\SysWOW64\netsh.exe
PID 2240 wrote to memory of 2244 N/A C:\Users\Admin\AppData\Local\Temp\VW.exe C:\Windows\SysWOW64\netsh.exe

Processes

C:\Users\Admin\AppData\Local\Temp\fc16abc8960acdf5ca9604c10cdf7c91_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\fc16abc8960acdf5ca9604c10cdf7c91_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\start.bat" "

C:\VW.sfx.exe

VW.sfx -pjhhb598nb82895nb82 -dc:\

C:\Users\Admin\AppData\Local\Temp\RarSFX0\VW.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\VW.exe"

C:\Users\Admin\AppData\Local\Temp\VW.exe

"C:\Users\Admin\AppData\Local\Temp\VW.exe"

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\VW.exe" "VW.exe" ENABLE

Network

Country Destination Domain Proto
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 68.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
N/A 192.168.56.1:4444 tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 98.117.19.2.in-addr.arpa udp
N/A 192.168.56.1:4444 tcp
N/A 192.168.56.1:4444 tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
N/A 192.168.56.1:4444 tcp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
N/A 192.168.56.1:4444 tcp
N/A 192.168.56.1:4444 tcp
US 8.8.8.8:53 udp

Files

C:\start.bat

MD5 09c93762f86690510744531e979dc330
SHA1 37e9d10b8d5096e8994e4853b54c2fe7fc6647a3
SHA256 ed52958b529c7f46395a0b9206498633b4839324c3c50f19f8cccafe6f8dc173
SHA512 79f55b3aef9da7837bb26dbed8caf20b509b9258eac467857afffb8d05a4b6a278ba05f561536c8f455743c311c7084effea13f658299053f69c78cb4d95f12e

C:\VW.sfx.exe

MD5 12909d42e703b952d41e0e016cfcf6e2
SHA1 a550f1959f714b4f046a2b20f48f16f8ebdb268c
SHA256 968d73678958b36377c551a3fbd0f776779bed7e8a46bac6db6f0f3ea29892aa
SHA512 2c8f69b00e0be4552765dc81c13f305bfb207a5d1dc24eb49d8f47405f10fa735498d2afffb90504262a5af45297a54e4d65474d8e9ac5063a3112d765c59cff

C:\Users\Admin\AppData\Local\Temp\RarSFX0\VW.exe

MD5 3b81fd6e629a81c01c5ea5327f678fcf
SHA1 ac9f4b316a960dc686d4519d771edb1043513e6b
SHA256 dd555393a0fb91532214bb9806410eb0e6dece39337b1e04d36d94b3cf2337ca
SHA512 67fbe06eb5bdde24a11b128c37ae36da79fadd4c3e7650e725208efeb5e29d97ddfd3037eae6df9e30d79ff8e97f21fc1d798c0911f80e40b87323e0a5dfa230

memory/4868-19-0x0000000001300000-0x0000000001310000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\VW.exe.log

MD5 da4fafeffe21b7cb3a8c170ca7911976
SHA1 50ef77e2451ab60f93f4db88325b897d215be5ad
SHA256 7341a4a13e81cbb5b7f39ec47bb45f84836b08b8d8e3ea231d2c7dad982094f7
SHA512 0bc24b69460f31a0ebc0628b99908d818ee85feb7e4b663271d9375b30cced0cd55a0bbf8edff1281a4c886ddf4476ffc989c283069cdcb1235ffcb265580fc6

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-28 10:21

Reported

2024-09-28 10:23

Platform

win7-20240708-en

Max time kernel

150s

Max time network

139s

Command Line

"C:\Users\Admin\AppData\Local\Temp\fc16abc8960acdf5ca9604c10cdf7c91_JaffaCakes118.exe"

Signatures

njRAT/Bladabindi

trojan njrat

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\382c90059fa8d9f2234ed90a1265fc51.exe C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\382c90059fa8d9f2234ed90a1265fc51.exe C:\Users\Admin\AppData\Local\Temp\VW.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\VW.sfx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\VW.sfx.exe N/A
N/A N/A C:\VW.sfx.exe N/A
N/A N/A C:\VW.sfx.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\VW.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\382c90059fa8d9f2234ed90a1265fc51 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\VW.exe\" .." C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\382c90059fa8d9f2234ed90a1265fc51 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\VW.exe\" .." C:\Users\Admin\AppData\Local\Temp\VW.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File created C:\autorun.inf C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
File opened for modification C:\autorun.inf C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
File created D:\autorun.inf C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
File created F:\autorun.inf C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
File opened for modification F:\autorun.inf C:\Users\Admin\AppData\Local\Temp\VW.exe N/A

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh C:\Windows\SysWOW64\netsh.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\netsh.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\fc16abc8960acdf5ca9604c10cdf7c91_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\VW.sfx.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\RarSFX0\VW.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\VW.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2180 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\fc16abc8960acdf5ca9604c10cdf7c91_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2180 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\fc16abc8960acdf5ca9604c10cdf7c91_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2180 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\fc16abc8960acdf5ca9604c10cdf7c91_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2180 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\fc16abc8960acdf5ca9604c10cdf7c91_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2404 wrote to memory of 2304 N/A C:\Windows\SysWOW64\cmd.exe C:\VW.sfx.exe
PID 2404 wrote to memory of 2304 N/A C:\Windows\SysWOW64\cmd.exe C:\VW.sfx.exe
PID 2404 wrote to memory of 2304 N/A C:\Windows\SysWOW64\cmd.exe C:\VW.sfx.exe
PID 2404 wrote to memory of 2304 N/A C:\Windows\SysWOW64\cmd.exe C:\VW.sfx.exe
PID 2304 wrote to memory of 2764 N/A C:\VW.sfx.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\VW.exe
PID 2304 wrote to memory of 2764 N/A C:\VW.sfx.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\VW.exe
PID 2304 wrote to memory of 2764 N/A C:\VW.sfx.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\VW.exe
PID 2304 wrote to memory of 2764 N/A C:\VW.sfx.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\VW.exe
PID 2764 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\VW.exe C:\Users\Admin\AppData\Local\Temp\VW.exe
PID 2764 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\VW.exe C:\Users\Admin\AppData\Local\Temp\VW.exe
PID 2764 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\VW.exe C:\Users\Admin\AppData\Local\Temp\VW.exe
PID 2764 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\VW.exe C:\Users\Admin\AppData\Local\Temp\VW.exe
PID 2648 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\VW.exe C:\Windows\SysWOW64\netsh.exe
PID 2648 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\VW.exe C:\Windows\SysWOW64\netsh.exe
PID 2648 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\VW.exe C:\Windows\SysWOW64\netsh.exe
PID 2648 wrote to memory of 2612 N/A C:\Users\Admin\AppData\Local\Temp\VW.exe C:\Windows\SysWOW64\netsh.exe

Processes

C:\Users\Admin\AppData\Local\Temp\fc16abc8960acdf5ca9604c10cdf7c91_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\fc16abc8960acdf5ca9604c10cdf7c91_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\start.bat" "

C:\VW.sfx.exe

VW.sfx -pjhhb598nb82895nb82 -dc:\

C:\Users\Admin\AppData\Local\Temp\RarSFX0\VW.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\VW.exe"

C:\Users\Admin\AppData\Local\Temp\VW.exe

"C:\Users\Admin\AppData\Local\Temp\VW.exe"

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\VW.exe" "VW.exe" ENABLE

Network

Country Destination Domain Proto
N/A 192.168.56.1:4444 tcp
N/A 192.168.56.1:4444 tcp
N/A 192.168.56.1:4444 tcp
N/A 192.168.56.1:4444 tcp
N/A 192.168.56.1:4444 tcp
N/A 192.168.56.1:4444 tcp

Files

C:\start.bat

MD5 09c93762f86690510744531e979dc330
SHA1 37e9d10b8d5096e8994e4853b54c2fe7fc6647a3
SHA256 ed52958b529c7f46395a0b9206498633b4839324c3c50f19f8cccafe6f8dc173
SHA512 79f55b3aef9da7837bb26dbed8caf20b509b9258eac467857afffb8d05a4b6a278ba05f561536c8f455743c311c7084effea13f658299053f69c78cb4d95f12e

C:\VW.sfx.exe

MD5 12909d42e703b952d41e0e016cfcf6e2
SHA1 a550f1959f714b4f046a2b20f48f16f8ebdb268c
SHA256 968d73678958b36377c551a3fbd0f776779bed7e8a46bac6db6f0f3ea29892aa
SHA512 2c8f69b00e0be4552765dc81c13f305bfb207a5d1dc24eb49d8f47405f10fa735498d2afffb90504262a5af45297a54e4d65474d8e9ac5063a3112d765c59cff

\Users\Admin\AppData\Local\Temp\RarSFX0\VW.exe

MD5 3b81fd6e629a81c01c5ea5327f678fcf
SHA1 ac9f4b316a960dc686d4519d771edb1043513e6b
SHA256 dd555393a0fb91532214bb9806410eb0e6dece39337b1e04d36d94b3cf2337ca
SHA512 67fbe06eb5bdde24a11b128c37ae36da79fadd4c3e7650e725208efeb5e29d97ddfd3037eae6df9e30d79ff8e97f21fc1d798c0911f80e40b87323e0a5dfa230