General
-
Target
f7f61e2818f060f7bb67313e6add744b_JaffaCakes118
-
Size
6.0MB
-
Sample
240418-pcwzdsch39
-
MD5
f7f61e2818f060f7bb67313e6add744b
-
SHA1
178378f732bad62fabb2b184f688e8a6651a9d9e
-
SHA256
a8aa4dd903c87f0912c6d4b65d26d7c1d75b1e02bda69b68ad1a57028ec9a0fa
-
SHA512
3b77f2dc7606a525943ebf1d9447438d248d1a591bf94e43e166c4ae376e45a81c651a27a8628036d6158e31d52816b8227e44c34bab1e1c0e26e880aed2c570
-
SSDEEP
98304:KxO6OvlIuBy4q7/bYy8yo+x2hbsOYah0ZWXy9YF3W3qywcrUKqXCvYJod1H2O:jvlJro/sRW2mOz9X0Y5arb9oxO
Static task
static1
Behavioral task
behavioral1
Sample
f7f61e2818f060f7bb67313e6add744b_JaffaCakes118.exe
Resource
win7-20240221-en
Malware Config
Extracted
njrat
0.7d
HacKed
127.0.0.1:1177
9e7cec1764a508c362c0d940f4480146
-
reg_key
9e7cec1764a508c362c0d940f4480146
-
splitter
|'|'|
Targets
-
-
Target
f7f61e2818f060f7bb67313e6add744b_JaffaCakes118
-
Size
6.0MB
-
MD5
f7f61e2818f060f7bb67313e6add744b
-
SHA1
178378f732bad62fabb2b184f688e8a6651a9d9e
-
SHA256
a8aa4dd903c87f0912c6d4b65d26d7c1d75b1e02bda69b68ad1a57028ec9a0fa
-
SHA512
3b77f2dc7606a525943ebf1d9447438d248d1a591bf94e43e166c4ae376e45a81c651a27a8628036d6158e31d52816b8227e44c34bab1e1c0e26e880aed2c570
-
SSDEEP
98304:KxO6OvlIuBy4q7/bYy8yo+x2hbsOYah0ZWXy9YF3W3qywcrUKqXCvYJod1H2O:jvlJro/sRW2mOz9X0Y5arb9oxO
-
Detect ZGRat V1
-
Downloads MZ/PE file
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks for any installed AV software in registry
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s)
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Pre-OS Boot
1Bootkit
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Pre-OS Boot
1Bootkit
1Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1