Analysis
-
max time kernel
149s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03-01-2025 05:40
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_6a8c965281056303b644b31fc4aa6080.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_6a8c965281056303b644b31fc4aa6080.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_6a8c965281056303b644b31fc4aa6080.exe
-
Size
69KB
-
MD5
6a8c965281056303b644b31fc4aa6080
-
SHA1
9c2d82178da83916f18a074b34ca23da574daacb
-
SHA256
d5cf78c53b8357164077ee44e8c0b237c2b75efd06961e9549fbea110a2de053
-
SHA512
cab33f86a9efc3edd6402a117077655a72ac04515aa62132919a1046ddae57e1b9f279dc9fb668258d583285a088420f96c10ba0362255f1655731c12b8e6b4a
-
SSDEEP
1536:GKKk6iEItiagPtHcEFv968/LBHV39QPWSxE0gNTfy4chu:MiEIti7tRv96iHSWkub
Malware Config
Extracted
njrat
0.7d
MoHaMeD
tekken.zapto.org:92
8289f10decadc2243138145a3d36e9b5
-
reg_key
8289f10decadc2243138145a3d36e9b5
-
splitter
|'|'|
Signatures
-
Njrat family
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2104 netsh.exe -
Executes dropped EXE 1 IoCs
pid Process 2752 csrcc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\8289f10decadc2243138145a3d36e9b5 = "\"C:\\Users\\Admin\\AppData\\Roaming\\csrcc.exe\" .." csrcc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\8289f10decadc2243138145a3d36e9b5 = "\"C:\\Users\\Admin\\AppData\\Roaming\\csrcc.exe\" .." csrcc.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch.new JaffaCakes118_6a8c965281056303b644b31fc4aa6080.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new JaffaCakes118_6a8c965281056303b644b31fc4aa6080.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeDebugPrivilege 2752 csrcc.exe Token: 33 2752 csrcc.exe Token: SeIncBasePriorityPrivilege 2752 csrcc.exe Token: 33 2752 csrcc.exe Token: SeIncBasePriorityPrivilege 2752 csrcc.exe Token: 33 2752 csrcc.exe Token: SeIncBasePriorityPrivilege 2752 csrcc.exe Token: 33 2752 csrcc.exe Token: SeIncBasePriorityPrivilege 2752 csrcc.exe Token: 33 2752 csrcc.exe Token: SeIncBasePriorityPrivilege 2752 csrcc.exe Token: 33 2752 csrcc.exe Token: SeIncBasePriorityPrivilege 2752 csrcc.exe Token: 33 2752 csrcc.exe Token: SeIncBasePriorityPrivilege 2752 csrcc.exe Token: 33 2752 csrcc.exe Token: SeIncBasePriorityPrivilege 2752 csrcc.exe Token: 33 2752 csrcc.exe Token: SeIncBasePriorityPrivilege 2752 csrcc.exe Token: 33 2752 csrcc.exe Token: SeIncBasePriorityPrivilege 2752 csrcc.exe Token: 33 2752 csrcc.exe Token: SeIncBasePriorityPrivilege 2752 csrcc.exe Token: 33 2752 csrcc.exe Token: SeIncBasePriorityPrivilege 2752 csrcc.exe Token: 33 2752 csrcc.exe Token: SeIncBasePriorityPrivilege 2752 csrcc.exe Token: 33 2752 csrcc.exe Token: SeIncBasePriorityPrivilege 2752 csrcc.exe Token: 33 2752 csrcc.exe Token: SeIncBasePriorityPrivilege 2752 csrcc.exe Token: 33 2752 csrcc.exe Token: SeIncBasePriorityPrivilege 2752 csrcc.exe Token: 33 2752 csrcc.exe Token: SeIncBasePriorityPrivilege 2752 csrcc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2920 wrote to memory of 2752 2920 JaffaCakes118_6a8c965281056303b644b31fc4aa6080.exe 28 PID 2920 wrote to memory of 2752 2920 JaffaCakes118_6a8c965281056303b644b31fc4aa6080.exe 28 PID 2920 wrote to memory of 2752 2920 JaffaCakes118_6a8c965281056303b644b31fc4aa6080.exe 28 PID 2752 wrote to memory of 2104 2752 csrcc.exe 29 PID 2752 wrote to memory of 2104 2752 csrcc.exe 29 PID 2752 wrote to memory of 2104 2752 csrcc.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6a8c965281056303b644b31fc4aa6080.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6a8c965281056303b644b31fc4aa6080.exe"1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Roaming\csrcc.exe"C:\Users\Admin\AppData\Roaming\csrcc.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\system32\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\csrcc.exe" "csrcc.exe" ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2104
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
69KB
MD56a8c965281056303b644b31fc4aa6080
SHA19c2d82178da83916f18a074b34ca23da574daacb
SHA256d5cf78c53b8357164077ee44e8c0b237c2b75efd06961e9549fbea110a2de053
SHA512cab33f86a9efc3edd6402a117077655a72ac04515aa62132919a1046ddae57e1b9f279dc9fb668258d583285a088420f96c10ba0362255f1655731c12b8e6b4a