General
-
Target
f5d10a1cd7d551938f763b888beb6d6a_JaffaCakes118
-
Size
402KB
-
Sample
240417-p56z3ahf31
-
MD5
f5d10a1cd7d551938f763b888beb6d6a
-
SHA1
153f278af3f4e7f9b13c70492b818f1b53cf4ae1
-
SHA256
bf98d1a2ee8c46f154d5fe665bccb527878fdd013d04472cf450cc3c18318516
-
SHA512
630406002c6c713eb36587bf5f4a81dcc029ba6e613fd30a8eb96772c84ad518d67c7b7a39c5a9b7565bed7cf68cd847d961089c5cae2dd4f00a24da3d561ac6
-
SSDEEP
6144:GmaKVBGmE84IMNv55giU0pKiFYHxfx15RvOagakZBxkTN2gmeGcFnVQb/DAYbDgl:nSmLAuEY71fviagATFmebVQDcYc5
Behavioral task
behavioral1
Sample
f5d10a1cd7d551938f763b888beb6d6a_JaffaCakes118.exe
Resource
win7-20240221-en
Malware Config
Extracted
njrat
0.6.4
hhhmach.ddns.net:1177
5cd8f17f4086744065eb0992a09e05a2
-
reg_key
5cd8f17f4086744065eb0992a09e05a2
-
splitter
|'|'|
Targets
-
-
Target
f5d10a1cd7d551938f763b888beb6d6a_JaffaCakes118
-
Size
402KB
-
MD5
f5d10a1cd7d551938f763b888beb6d6a
-
SHA1
153f278af3f4e7f9b13c70492b818f1b53cf4ae1
-
SHA256
bf98d1a2ee8c46f154d5fe665bccb527878fdd013d04472cf450cc3c18318516
-
SHA512
630406002c6c713eb36587bf5f4a81dcc029ba6e613fd30a8eb96772c84ad518d67c7b7a39c5a9b7565bed7cf68cd847d961089c5cae2dd4f00a24da3d561ac6
-
SSDEEP
6144:GmaKVBGmE84IMNv55giU0pKiFYHxfx15RvOagakZBxkTN2gmeGcFnVQb/DAYbDgl:nSmLAuEY71fviagATFmebVQDcYc5
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1