General
-
Target
01b33e2f3771840f00b903054595d14d_JaffaCakes118
-
Size
97KB
-
Sample
240426-z92w1sdd2v
-
MD5
01b33e2f3771840f00b903054595d14d
-
SHA1
a87763550d32548dc8f845c972efa9deeccec39a
-
SHA256
4b5cce1e6a5afda51bcb86ce84fa074196cc8e49bc7a6c2cf04202ea6e514cb7
-
SHA512
105cd853f60289535a93af4b3afa263eab595eacee0fbe18b3b0d4ddaebe12b44ac92c7cb9991d9092446eaaffc469241b337bc1aeedc9079751e3fc1fbcd511
-
SSDEEP
1536:WAp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4IE41K:d5eznsjsguGDFqG7cK
Static task
static1
Behavioral task
behavioral1
Sample
01b33e2f3771840f00b903054595d14d_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
01b33e2f3771840f00b903054595d14d_JaffaCakes118.exe
Resource
win10v2004-20240419-en
Malware Config
Extracted
njrat
0.7d
neuf
doddyfire.linkpc.net:10000
e1a87040f2026369a233f9ae76301b7b
-
reg_key
e1a87040f2026369a233f9ae76301b7b
-
splitter
|'|'|
Targets
-
-
Target
01b33e2f3771840f00b903054595d14d_JaffaCakes118
-
Size
97KB
-
MD5
01b33e2f3771840f00b903054595d14d
-
SHA1
a87763550d32548dc8f845c972efa9deeccec39a
-
SHA256
4b5cce1e6a5afda51bcb86ce84fa074196cc8e49bc7a6c2cf04202ea6e514cb7
-
SHA512
105cd853f60289535a93af4b3afa263eab595eacee0fbe18b3b0d4ddaebe12b44ac92c7cb9991d9092446eaaffc469241b337bc1aeedc9079751e3fc1fbcd511
-
SSDEEP
1536:WAp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4IE41K:d5eznsjsguGDFqG7cK
Score10/10-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1