Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    19-12-2024 16:23

General

  • Target

    ffcb6225c7e88893052511133926e4b9_JaffaCakes118.exe

  • Size

    405KB

  • MD5

    ffcb6225c7e88893052511133926e4b9

  • SHA1

    ad1046228ed2d6797382440ea4ed689b0d466f1d

  • SHA256

    cf5a0b717ea5d16d8d20760a6c29561f762988f3ff5a54d6a423c0379c57ee1f

  • SHA512

    75999b2d228c4488ea0d7f988ea6aed25320b06591b60ba001075a2ee3cf36f93b7b386bb6b7890ff70b1874fd53baf2856e522a2be885aeb54031898133703a

  • SSDEEP

    6144:9pnwJiXFD2Ehc5JAOcBXnyOpnwRiXFD2Ehc5JA:bwJi1D23G1vwRi1D23

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

2018

C2

ccdollar.linkpc.net:1177

Mutex

08d47111f624fd2d703f71f2ccc5487d

Attributes
  • reg_key

    08d47111f624fd2d703f71f2ccc5487d

  • splitter

    |'|'|

Signatures

  • Njrat family
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ffcb6225c7e88893052511133926e4b9_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\ffcb6225c7e88893052511133926e4b9_JaffaCakes118.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:2904
    • C:\Windows\SynTPHelper.exe
      "C:\Windows\SynTPHelper.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2184
      • C:\Windows\system32\netsh.exe
        netsh firewall add allowedprogram "C:\Windows\SynTPHelper.exe" "SynTPHelper.exe" ENABLE
        3⤵
        • Modifies Windows Firewall
        • Event Triggered Execution: Netsh Helper DLL
        PID:1576

Network

  • flag-us
    DNS
    ccdollar.linkpc.net
    SynTPHelper.exe
    Remote address:
    8.8.8.8:53
    Request
    ccdollar.linkpc.net
    IN A
    Response
    ccdollar.linkpc.net
    IN A
    52.23.204.241
  • flag-us
    DNS
    ccdollar.linkpc.net
    SynTPHelper.exe
    Remote address:
    8.8.8.8:53
    Request
    ccdollar.linkpc.net
    IN A
  • 52.23.204.241:1177
    ccdollar.linkpc.net
    SynTPHelper.exe
    152 B
    3
  • 52.23.204.241:1177
    ccdollar.linkpc.net
    SynTPHelper.exe
    152 B
    3
  • 52.23.204.241:1177
    ccdollar.linkpc.net
    SynTPHelper.exe
    152 B
    3
  • 52.23.204.241:1177
    ccdollar.linkpc.net
    SynTPHelper.exe
    104 B
    2
  • 8.8.8.8:53
    ccdollar.linkpc.net
    dns
    SynTPHelper.exe
    130 B
    81 B
    2
    1

    DNS Request

    ccdollar.linkpc.net

    DNS Request

    ccdollar.linkpc.net

    DNS Response

    52.23.204.241

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SynTPHelper.exe

    Filesize

    405KB

    MD5

    ffcb6225c7e88893052511133926e4b9

    SHA1

    ad1046228ed2d6797382440ea4ed689b0d466f1d

    SHA256

    cf5a0b717ea5d16d8d20760a6c29561f762988f3ff5a54d6a423c0379c57ee1f

    SHA512

    75999b2d228c4488ea0d7f988ea6aed25320b06591b60ba001075a2ee3cf36f93b7b386bb6b7890ff70b1874fd53baf2856e522a2be885aeb54031898133703a

  • memory/2184-9-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

    Filesize

    9.6MB

  • memory/2184-11-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

    Filesize

    9.6MB

  • memory/2184-12-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

    Filesize

    9.6MB

  • memory/2904-0-0x000007FEF620E000-0x000007FEF620F000-memory.dmp

    Filesize

    4KB

  • memory/2904-1-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

    Filesize

    9.6MB

  • memory/2904-2-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

    Filesize

    9.6MB

  • memory/2904-3-0x00000000005D0000-0x00000000005DC000-memory.dmp

    Filesize

    48KB

  • memory/2904-10-0x000007FEF5F50000-0x000007FEF68ED000-memory.dmp

    Filesize

    9.6MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.