Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
10/05/2024, 14:27
General
-
Target
2f92bdeab118ac90e7e99b24eec2843c_JaffaCakes118.exe
-
Size
31KB
-
MD5
2f92bdeab118ac90e7e99b24eec2843c
-
SHA1
d95135efd565a861df5be09c847f48398080ad38
-
SHA256
dcb8aee5f2aef4121feeb28256daba7e68227a4cbc9d1cd2805231abb3fc7850
-
SHA512
9adebb1657e6763ec51bec8ce40f8e608e228cc4f025b45d8ff04035519b7fe0c6285ec7cc01c458c7b376ed78a573f7e635363bbfb0f5beca05f862d927c9a8
-
SSDEEP
768:7bS/69DdxkzxP6bGCMGHfQNvgVQmIDUu0tiqVj:AqqeziIQVkjj
Score
10/10
Malware Config
Signatures
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 35 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f92bdeab118ac90e7e99b24eec2843c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2f92bdeab118ac90e7e99b24eec2843c_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\2f92bdeab118ac90e7e99b24eec2843c_JaffaCakes118.exe" "2f92bdeab118ac90e7e99b24eec2843c_JaffaCakes118.exe" ENABLE2⤵
- Modifies Windows Firewall
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB