Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
02/01/2025, 08:03
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_63b02e797ff83d6564f8a179a334b450.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
JaffaCakes118_63b02e797ff83d6564f8a179a334b450.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_63b02e797ff83d6564f8a179a334b450.exe
-
Size
122KB
-
MD5
63b02e797ff83d6564f8a179a334b450
-
SHA1
8c385e68245bb3beff75431179efae7749528ec9
-
SHA256
8546ca6aed3fa349818ef096c0fc5738a1e875a89329cc1204ce01b8db87e366
-
SHA512
cf2888a6a717f9969f132b6fae1290857a80c0fe7808122a0c461aa01cb74ec056acbb1c941fa3d3fac8aa945d227b042340f6e0e4f2fcc8c2fbb3b321b8891b
-
SSDEEP
1536:eHWw9O9qCDO3w0rW3cT1lxP3qIVHOqA5ZX6w5qqdkXA9SzcFDOgiXbqruuN8:QO9qCDOFwIZsX6w5HdSA9hFDZW
Malware Config
Extracted
njrat
0.6.4
HacKed
rwan.no-ip.biz:1177
5cd8f17f4086744065eb0992a09e05a2
-
reg_key
5cd8f17f4086744065eb0992a09e05a2
-
splitter
|'|'|
Signatures
-
Njrat family
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 4836 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation JaffaCakes118_63b02e797ff83d6564f8a179a334b450.exe -
Executes dropped EXE 2 IoCs
pid Process 1308 Trojan.exe 552 Trojan.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3412 set thread context of 2564 3412 JaffaCakes118_63b02e797ff83d6564f8a179a334b450.exe 89 PID 1308 set thread context of 552 1308 Trojan.exe 93 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_63b02e797ff83d6564f8a179a334b450.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_63b02e797ff83d6564f8a179a334b450.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Trojan.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Trojan.exe -
Suspicious behavior: EnumeratesProcesses 33 IoCs
pid Process 552 Trojan.exe 552 Trojan.exe 552 Trojan.exe 552 Trojan.exe 552 Trojan.exe 552 Trojan.exe 552 Trojan.exe 552 Trojan.exe 552 Trojan.exe 552 Trojan.exe 552 Trojan.exe 552 Trojan.exe 552 Trojan.exe 552 Trojan.exe 552 Trojan.exe 552 Trojan.exe 552 Trojan.exe 552 Trojan.exe 552 Trojan.exe 552 Trojan.exe 552 Trojan.exe 552 Trojan.exe 552 Trojan.exe 552 Trojan.exe 552 Trojan.exe 552 Trojan.exe 552 Trojan.exe 552 Trojan.exe 552 Trojan.exe 552 Trojan.exe 552 Trojan.exe 552 Trojan.exe 552 Trojan.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3412 JaffaCakes118_63b02e797ff83d6564f8a179a334b450.exe Token: SeDebugPrivilege 1308 Trojan.exe Token: SeDebugPrivilege 552 Trojan.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 3412 wrote to memory of 2564 3412 JaffaCakes118_63b02e797ff83d6564f8a179a334b450.exe 89 PID 3412 wrote to memory of 2564 3412 JaffaCakes118_63b02e797ff83d6564f8a179a334b450.exe 89 PID 3412 wrote to memory of 2564 3412 JaffaCakes118_63b02e797ff83d6564f8a179a334b450.exe 89 PID 3412 wrote to memory of 2564 3412 JaffaCakes118_63b02e797ff83d6564f8a179a334b450.exe 89 PID 3412 wrote to memory of 2564 3412 JaffaCakes118_63b02e797ff83d6564f8a179a334b450.exe 89 PID 2564 wrote to memory of 1308 2564 JaffaCakes118_63b02e797ff83d6564f8a179a334b450.exe 90 PID 2564 wrote to memory of 1308 2564 JaffaCakes118_63b02e797ff83d6564f8a179a334b450.exe 90 PID 2564 wrote to memory of 1308 2564 JaffaCakes118_63b02e797ff83d6564f8a179a334b450.exe 90 PID 1308 wrote to memory of 552 1308 Trojan.exe 93 PID 1308 wrote to memory of 552 1308 Trojan.exe 93 PID 1308 wrote to memory of 552 1308 Trojan.exe 93 PID 1308 wrote to memory of 552 1308 Trojan.exe 93 PID 1308 wrote to memory of 552 1308 Trojan.exe 93 PID 552 wrote to memory of 4836 552 Trojan.exe 94 PID 552 wrote to memory of 4836 552 Trojan.exe 94 PID 552 wrote to memory of 4836 552 Trojan.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_63b02e797ff83d6564f8a179a334b450.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_63b02e797ff83d6564f8a179a334b450.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_63b02e797ff83d6564f8a179a334b450.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_63b02e797ff83d6564f8a179a334b450.exe2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\Trojan.exe"C:\Users\Admin\AppData\Local\Temp\Trojan.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\Trojan.exeC:\Users\Admin\AppData\Local\Temp\Trojan.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Trojan.exe" "Trojan.exe" ENABLE5⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4836
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\JaffaCakes118_63b02e797ff83d6564f8a179a334b450.exe.log
Filesize128B
MD5a5dcc7c9c08af7dddd82be5b036a4416
SHA14f998ca1526d199e355ffb435bae111a2779b994
SHA256e24033ceec97fd03402b03acaaabd1d1e378e83bb1683afbccac760e00f8ead5
SHA51256035de734836c0c39f0b48641c51c26adb6e79c6c65e23ca96603f71c95b8673e2ef853146e87efc899dd1878d0bbc2c82d91fbf0fce81c552048e986f9bb5a
-
Filesize
122KB
MD563b02e797ff83d6564f8a179a334b450
SHA18c385e68245bb3beff75431179efae7749528ec9
SHA2568546ca6aed3fa349818ef096c0fc5738a1e875a89329cc1204ce01b8db87e366
SHA512cf2888a6a717f9969f132b6fae1290857a80c0fe7808122a0c461aa01cb74ec056acbb1c941fa3d3fac8aa945d227b042340f6e0e4f2fcc8c2fbb3b321b8891b