Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
15-04-2024 22:49
General
-
Target
f21b29771505e7f9259f5efa6f6ebf9c_JaffaCakes118.exe
-
Size
1.3MB
-
MD5
f21b29771505e7f9259f5efa6f6ebf9c
-
SHA1
d5ccd855ec03fb5e841e4bf34a0999a2b64687e8
-
SHA256
f105cb3485a82fd898764b344111e763c5d017fbda2d90a5d58fe6363cc8ec13
-
SHA512
6b9df94ac54e8b5ad661e80751bf75b9ca8a452e5320c33ba27e87d8dcef6a0c6b6cff0df7fad532e9c10bd755334c8ddb4268557e094a6d9f82c16c0e0fbcaf
-
SSDEEP
24576:Axxxxxxxxxxxxxxxxxxtx712xxxxxxxxxhVbaGq:Axxxxxxxxxxxxxxxxxxtx7Uxxxxxxxxs
Score
10/10
Malware Config
Extracted
Family
njrat
Version
0.7NC
Botnet
NYAN CAT
C2
milla.publicvm.com:5050
Mutex
affbaafe724f4591
Attributes
-
reg_key
affbaafe724f4591
-
splitter
@!#&^%$
Signatures
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 27 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f21b29771505e7f9259f5efa6f6ebf9c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f21b29771505e7f9259f5efa6f6ebf9c_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3736 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.7MB
-
Filesize
1.4MB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
624KB
-
Filesize
48KB
-
Filesize
5.6MB
-
Filesize
64KB
-
Filesize
584KB
-
Filesize
40KB