Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
31-12-2024 01:46
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_000f45f0e74708e3b79e7dd0598c5d9b.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_000f45f0e74708e3b79e7dd0598c5d9b.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_000f45f0e74708e3b79e7dd0598c5d9b.exe
-
Size
121KB
-
MD5
000f45f0e74708e3b79e7dd0598c5d9b
-
SHA1
23a1d58a40d4d2e90b47e5303eead4a9c65a79e8
-
SHA256
f3708be0f01799bf40ab729a335e3b689049b6017f2671fbf92bf2579de24595
-
SHA512
aade94af175ee2500134584f22cf1dd87d73b9fabeec2dbce9f44d72d587bdd0a66f56a5d3edd889e70d3dd4d5d6597847ad9fbd1a4a67d8b5c2fd703bc6178b
-
SSDEEP
3072:NPJQ1c9AXY7IQZyPPLs+dkPwDEJv1pp8hj:NGXYEXL1dkPWqppU
Malware Config
Extracted
njrat
0.6.4
Neymar.Jr
Zapa.duckdns.org:7575
08e864d6f4c1fdf78ee0e9f6bdeb0bc1
-
reg_key
08e864d6f4c1fdf78ee0e9f6bdeb0bc1
-
splitter
|'|'|
Signatures
-
Njrat family
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2724 netsh.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\08e864d6f4c1fdf78ee0e9f6bdeb0bc1.exe dwn.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\08e864d6f4c1fdf78ee0e9f6bdeb0bc1.exe dwn.exe -
Executes dropped EXE 1 IoCs
pid Process 2544 dwn.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\08e864d6f4c1fdf78ee0e9f6bdeb0bc1 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\dwn.exe\" .." dwn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\08e864d6f4c1fdf78ee0e9f6bdeb0bc1 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\dwn.exe\" .." dwn.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
Suspicious behavior: EnumeratesProcesses 36 IoCs
pid Process 2544 dwn.exe 2544 dwn.exe 2544 dwn.exe 2544 dwn.exe 2544 dwn.exe 2544 dwn.exe 2544 dwn.exe 2544 dwn.exe 2544 dwn.exe 2544 dwn.exe 2544 dwn.exe 2544 dwn.exe 2544 dwn.exe 2544 dwn.exe 2544 dwn.exe 2544 dwn.exe 2544 dwn.exe 2544 dwn.exe 2544 dwn.exe 2544 dwn.exe 2544 dwn.exe 2544 dwn.exe 2544 dwn.exe 2544 dwn.exe 2544 dwn.exe 2544 dwn.exe 2544 dwn.exe 2544 dwn.exe 2544 dwn.exe 2544 dwn.exe 2544 dwn.exe 2544 dwn.exe 2544 dwn.exe 2544 dwn.exe 2544 dwn.exe 2544 dwn.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2544 dwn.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1048 wrote to memory of 2544 1048 JaffaCakes118_000f45f0e74708e3b79e7dd0598c5d9b.exe 29 PID 1048 wrote to memory of 2544 1048 JaffaCakes118_000f45f0e74708e3b79e7dd0598c5d9b.exe 29 PID 1048 wrote to memory of 2544 1048 JaffaCakes118_000f45f0e74708e3b79e7dd0598c5d9b.exe 29 PID 2544 wrote to memory of 2724 2544 dwn.exe 30 PID 2544 wrote to memory of 2724 2544 dwn.exe 30 PID 2544 wrote to memory of 2724 2544 dwn.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_000f45f0e74708e3b79e7dd0598c5d9b.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_000f45f0e74708e3b79e7dd0598c5d9b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\dwn.exe"C:\Users\Admin\AppData\Local\Temp\dwn.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Windows\system32\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\dwn.exe" "dwn.exe" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2724
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
121KB
MD5000f45f0e74708e3b79e7dd0598c5d9b
SHA123a1d58a40d4d2e90b47e5303eead4a9c65a79e8
SHA256f3708be0f01799bf40ab729a335e3b689049b6017f2671fbf92bf2579de24595
SHA512aade94af175ee2500134584f22cf1dd87d73b9fabeec2dbce9f44d72d587bdd0a66f56a5d3edd889e70d3dd4d5d6597847ad9fbd1a4a67d8b5c2fd703bc6178b