njrat | ccfedf662c01e59bf6ffca6fd04bbf6fd9182b88bd87011b7dc3b0780bc0748f

Analysis

max time kernel
149s
max time network
123s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
10-01-2025 02:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_d90cfb7d9066834477a23e337cffc24b.exe
Size

539KB
MD5

d90cfb7d9066834477a23e337cffc24b
SHA1

7a83224bd2d4f397023a36f59ae52259ca3c9b0f
SHA256

ccfedf662c01e59bf6ffca6fd04bbf6fd9182b88bd87011b7dc3b0780bc0748f
SHA512

59ec7e2240e0475e6b2afd44a1ada159f62e641712614c3dea5390ded5efbe3aaba32813840cdeef6dd80da7cd0d719bf2245ade48fa6b778a32c2266fa3db0f
SSDEEP

12288:IzxzTDWikLSb4NS7t2X+t40XrjI8LnXe8hlSTtRHLJDr3YSP2m:+DWHSb4Nc0+ETUletRNPoS+m

Score

10^/10

njrat discovery evasion persistence privilege_escalation trojan

Malware Config

Signatures

Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2640	netsh.exe

Executes dropped EXE 3 IoCs

pid	Process
2304	Desktop.exe
2016	test.exe
2112	WindowsServices.exe

Loads dropped DLL 10 IoCs

pid	Process
2520	cmd.exe
2304	Desktop.exe
2304	Desktop.exe
2304	Desktop.exe
2304	Desktop.exe
2016	test.exe
2016	test.exe
2016	test.exe
2112	WindowsServices.exe
2112	WindowsServices.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\7c3d2489f1de59fb6802299eb7012ad7 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WindowsServices.exe\" .."	WindowsServices.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\7c3d2489f1de59fb6802299eb7012ad7 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WindowsServices.exe\" .."	WindowsServices.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WindowsServices.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_d90cfb7d9066834477a23e337cffc24b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Desktop.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeDebugPrivilege	2112	WindowsServices.exe
Token: 33	2112	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	2112	WindowsServices.exe
Token: 33	2112	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	2112	WindowsServices.exe
Token: 33	2112	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	2112	WindowsServices.exe
Token: 33	2112	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	2112	WindowsServices.exe
Token: 33	2112	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	2112	WindowsServices.exe
Token: 33	2112	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	2112	WindowsServices.exe
Token: 33	2112	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	2112	WindowsServices.exe
Token: 33	2112	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	2112	WindowsServices.exe
Token: 33	2112	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	2112	WindowsServices.exe
Token: 33	2112	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	2112	WindowsServices.exe
Token: 33	2112	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	2112	WindowsServices.exe
Token: 33	2112	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	2112	WindowsServices.exe
Token: 33	2112	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	2112	WindowsServices.exe
Token: 33	2112	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	2112	WindowsServices.exe
Token: 33	2112	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	2112	WindowsServices.exe
Token: 33	2112	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	2112	WindowsServices.exe
Token: 33	2112	WindowsServices.exe
Token: SeIncBasePriorityPrivilege	2112	WindowsServices.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 2520	2312	JaffaCakes118_d90cfb7d9066834477a23e337cffc24b.exe	30
PID 2312 wrote to memory of 2520	2312	JaffaCakes118_d90cfb7d9066834477a23e337cffc24b.exe	30
PID 2312 wrote to memory of 2520	2312	JaffaCakes118_d90cfb7d9066834477a23e337cffc24b.exe	30
PID 2312 wrote to memory of 2520	2312	JaffaCakes118_d90cfb7d9066834477a23e337cffc24b.exe	30
PID 2520 wrote to memory of 2304	2520	cmd.exe	32
PID 2520 wrote to memory of 2304	2520	cmd.exe	32
PID 2520 wrote to memory of 2304	2520	cmd.exe	32
PID 2520 wrote to memory of 2304	2520	cmd.exe	32
PID 2304 wrote to memory of 2016	2304	Desktop.exe	33
PID 2304 wrote to memory of 2016	2304	Desktop.exe	33
PID 2304 wrote to memory of 2016	2304	Desktop.exe	33
PID 2304 wrote to memory of 2016	2304	Desktop.exe	33
PID 2016 wrote to memory of 2112	2016	test.exe	35
PID 2016 wrote to memory of 2112	2016	test.exe	35
PID 2016 wrote to memory of 2112	2016	test.exe	35
PID 2016 wrote to memory of 2112	2016	test.exe	35
PID 2112 wrote to memory of 2640	2112	WindowsServices.exe	36
PID 2112 wrote to memory of 2640	2112	WindowsServices.exe	36
PID 2112 wrote to memory of 2640	2112	WindowsServices.exe	36
PID 2112 wrote to memory of 2640	2112	WindowsServices.exe	36

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d90cfb7d9066834477a23e337cffc24b.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d90cfb7d9066834477a23e337cffc24b.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\Run.bat" "
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2520
- - C:\Users\Admin\AppData\Local\Temp\Desktop.exe
    Desktop.exe -p123
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2304
  - - C:\Users\Admin\AppData\Local\Temp\test.exe
      "C:\Users\Admin\AppData\Local\Temp\test.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2016
    - - C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe
        
        "C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2112
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe" "WindowsServices.exe" ENABLE
        6⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\EntryPoint.dll

Filesize
40KB

MD5
1a7b936836035d21ebd2294f574b6eea

SHA1
d0e1ff21f91ec7bc9c57899c051c6c9c98b9cfef

SHA256
52b168751f25a4c68ff6cac2035a8554e35a609eca4f70831592ab02a1fa8ba2

SHA512
5ff43920f0936171252364b5347049941cae7232e80b43b53e1908933fcfb9aefa8141b8f7d00b7a21f42c90e803780bdfc2ddb7182e9017b5294aa8e0ccfe71

Download Submit
C:\Users\Admin\AppData\Local\Temp\Run.bat

Filesize
17B

MD5
33aac93bbfac6285ee2343af52e67951

SHA1
b878552b521d0b8f0031b07749221b6d310217d3

SHA256
d81716d88ad01dd36b74fe8b6fbf194f108e8e05f136a5e3e82b68764c414d8f

SHA512
58a7bd40077d4442e79ecc9cb9295cfea3ff9333ff906c6c7a512872ee168acbec7c358213036f2404073cc1bf4b07ec18c454047d47b320f94e528272bdf90f

Download Submit
\Users\Admin\AppData\Local\Temp\Desktop.exe

Filesize
375KB

MD5
39f78e3d0b70b4300b868fc7f9b4f248

SHA1
c1e16e0efad4f0262d10d53e3b88ba18096a47c6

SHA256
7efc5a7f6498e89c0f77866f93e3d7397d4d648fb6bbd6b51e0da31ec845b666

SHA512
29196747490440fd20b2b2d11e3f41c71ab4e5d9024fd7ebb3305ed6666d7a23dec7175d65ef52a46ac728e3ec9bc22dc6e17897f10fbcff079b855b49bf8ee9

Download Submit
\Users\Admin\AppData\Local\Temp\test.exe

Filesize
99KB

MD5
7c719897cee16aa70ce4a30837386845

SHA1
baf6e80c8b7f3fbb8e76ef1e9127d09777c1d7ae

SHA256
482e2c22b64604de034b502e15a7fb41f8676113e0a369e10839438209af1e48

SHA512
892d5c94056db8ed3a3771cadfaaad3e23fd06a309403e905140eadf9dc5e67540dcf8ff3c85d86b3874524ca33b1b84c927e9e6574d355da68d7cd405263a5c

Download Submit
memory/2016-39-0x0000000000BC0000-0x0000000000BD2000-memory.dmp

Filesize
72KB

Download
memory/2016-43-0x0000000000460000-0x0000000000470000-memory.dmp

Filesize
64KB

Download
memory/2016-44-0x0000000000560000-0x000000000056E000-memory.dmp

Filesize
56KB

Download
memory/2112-52-0x0000000000BD0000-0x0000000000BE2000-memory.dmp

Filesize
72KB

Download
memory/2112-55-0x00000000003A0000-0x00000000003B0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads