Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 16:23
Static task
static1
Behavioral task
behavioral1
Sample
ffcb6225c7e88893052511133926e4b9_JaffaCakes118.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
ffcb6225c7e88893052511133926e4b9_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
ffcb6225c7e88893052511133926e4b9_JaffaCakes118.exe
-
Size
405KB
-
MD5
ffcb6225c7e88893052511133926e4b9
-
SHA1
ad1046228ed2d6797382440ea4ed689b0d466f1d
-
SHA256
cf5a0b717ea5d16d8d20760a6c29561f762988f3ff5a54d6a423c0379c57ee1f
-
SHA512
75999b2d228c4488ea0d7f988ea6aed25320b06591b60ba001075a2ee3cf36f93b7b386bb6b7890ff70b1874fd53baf2856e522a2be885aeb54031898133703a
-
SSDEEP
6144:9pnwJiXFD2Ehc5JAOcBXnyOpnwRiXFD2Ehc5JA:bwJi1D23G1vwRi1D23
Malware Config
Extracted
njrat
0.7d
2018
ccdollar.linkpc.net:1177
08d47111f624fd2d703f71f2ccc5487d
-
reg_key
08d47111f624fd2d703f71f2ccc5487d
-
splitter
|'|'|
Signatures
-
Njrat family
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 1576 netsh.exe -
Executes dropped EXE 1 IoCs
pid Process 2184 SynTPHelper.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\08d47111f624fd2d703f71f2ccc5487d = "\"C:\\Windows\\SynTPHelper.exe\" .." SynTPHelper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\08d47111f624fd2d703f71f2ccc5487d = "\"C:\\Windows\\SynTPHelper.exe\" .." SynTPHelper.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\SynTPHelper.exe ffcb6225c7e88893052511133926e4b9_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeDebugPrivilege 2184 SynTPHelper.exe Token: 33 2184 SynTPHelper.exe Token: SeIncBasePriorityPrivilege 2184 SynTPHelper.exe Token: 33 2184 SynTPHelper.exe Token: SeIncBasePriorityPrivilege 2184 SynTPHelper.exe Token: 33 2184 SynTPHelper.exe Token: SeIncBasePriorityPrivilege 2184 SynTPHelper.exe Token: 33 2184 SynTPHelper.exe Token: SeIncBasePriorityPrivilege 2184 SynTPHelper.exe Token: 33 2184 SynTPHelper.exe Token: SeIncBasePriorityPrivilege 2184 SynTPHelper.exe Token: 33 2184 SynTPHelper.exe Token: SeIncBasePriorityPrivilege 2184 SynTPHelper.exe Token: 33 2184 SynTPHelper.exe Token: SeIncBasePriorityPrivilege 2184 SynTPHelper.exe Token: 33 2184 SynTPHelper.exe Token: SeIncBasePriorityPrivilege 2184 SynTPHelper.exe Token: 33 2184 SynTPHelper.exe Token: SeIncBasePriorityPrivilege 2184 SynTPHelper.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2904 wrote to memory of 2184 2904 ffcb6225c7e88893052511133926e4b9_JaffaCakes118.exe 29 PID 2904 wrote to memory of 2184 2904 ffcb6225c7e88893052511133926e4b9_JaffaCakes118.exe 29 PID 2904 wrote to memory of 2184 2904 ffcb6225c7e88893052511133926e4b9_JaffaCakes118.exe 29 PID 2184 wrote to memory of 1576 2184 SynTPHelper.exe 30 PID 2184 wrote to memory of 1576 2184 SynTPHelper.exe 30 PID 2184 wrote to memory of 1576 2184 SynTPHelper.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\ffcb6225c7e88893052511133926e4b9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ffcb6225c7e88893052511133926e4b9_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\SynTPHelper.exe"C:\Windows\SynTPHelper.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\system32\netsh.exenetsh firewall add allowedprogram "C:\Windows\SynTPHelper.exe" "SynTPHelper.exe" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:1576
-
-
Network
-
Remote address:8.8.8.8:53Requestccdollar.linkpc.netIN AResponseccdollar.linkpc.netIN A52.23.204.241
-
Remote address:8.8.8.8:53Requestccdollar.linkpc.netIN A
-
152 B 3
-
152 B 3
-
152 B 3
-
104 B 2
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
405KB
MD5ffcb6225c7e88893052511133926e4b9
SHA1ad1046228ed2d6797382440ea4ed689b0d466f1d
SHA256cf5a0b717ea5d16d8d20760a6c29561f762988f3ff5a54d6a423c0379c57ee1f
SHA51275999b2d228c4488ea0d7f988ea6aed25320b06591b60ba001075a2ee3cf36f93b7b386bb6b7890ff70b1874fd53baf2856e522a2be885aeb54031898133703a