Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
16/05/2024, 21:42
General
-
Target
4d25873976ab5ad9ff4c5c493c1e594c_JaffaCakes118.exe
-
Size
25KB
-
MD5
4d25873976ab5ad9ff4c5c493c1e594c
-
SHA1
4c1fc465246d324aa034357baf8c14e8b9b6ed38
-
SHA256
7a1478300f716986ea695efa848e0184567029051d48991b0625b52493ca4c96
-
SHA512
a058ad6ce3db2ea6384b059a837dd9d94bc156feba2ab1bbd7ff0909f21e1c1ebb0ada82bf9826aff23288192a4caa57d2bd26a7f685dd0ed5fc6a29a0870d36
-
SSDEEP
384:sv3ZIj+TLZ/Lwa2sa+iOpbg1LEvlyxIV/JtFpaDFODfNTOkk56RZKNOvo6fhQp3R:svpbnyaCOpbg1A0CRt2ZOF+0QARaph
Score
10/10
Malware Config
Extracted
Family
njrat
Version
Njrat 0.7 Golden By Hassan Amiri
Botnet
HacKed
C2
192.168.0.166:7777
Mutex
Windows Update
Attributes
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 37 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d25873976ab5ad9ff4c5c493c1e594c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4d25873976ab5ad9ff4c5c493c1e594c_JaffaCakes118.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
32KB
-
Filesize
72KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
9.9MB