General
-
Target
680eedbc1790a699e6a5b869eda61b8b_JaffaCakes118
-
Size
39KB
-
Sample
240522-v568qaaf2w
-
MD5
680eedbc1790a699e6a5b869eda61b8b
-
SHA1
8796ae8bd63a58149d7be308fc674a1252416b66
-
SHA256
5bd6272d4400c8e7dbf95fb2af5e1316a56b8b98bf04d16abca402a7d8a1f816
-
SHA512
db9d77ec5b48dbc8f6d495754fdf9f27c7d86a803262718cea94a2674e3b5681a0c9a118e4ad50eb303bbd40493908f2fd13eb6de208d688d2b009d07ba17731
-
SSDEEP
768:QpdOzdwopc5KwheKA/ItllbsO+CdS+Mp+YSxRWxcyls6bawk0cTYvJJ:+gdwopnJD/ItllbsO+CypixRfy/awuYP
Static task
static1
Behavioral task
behavioral1
Sample
Warcraft 3 Frozen Throne patch 1.26.rar.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Warcraft 3 Frozen Throne patch 1.26.rar.exe
Resource
win10v2004-20240508-en
Malware Config
Extracted
njrat
0.7d
HacKed number 3
h5.no-ip.biz:5552
bd78ec60d140b8ad8b4496b8b8a4f37c
-
reg_key
bd78ec60d140b8ad8b4496b8b8a4f37c
-
splitter
|'|'|
Targets
-
-
Target
Warcraft 3 Frozen Throne patch 1.26.rar.exe
-
Size
93KB
-
MD5
d69fdef0764ae2053aa3289c4641f630
-
SHA1
97cbb1a021d2ba8693f0fb2b5ce608c56d91dd6c
-
SHA256
2aa7c9d0627901316d3f6594146b42bf72a4b65900bf318675b6c2c44dc93162
-
SHA512
6142ad3d3cceb3522cca5dab7ebdf16610f4e73e66ad4ccc249b6a67f15b50cfffa415f6050b5f2a0f138340dd3fd2abfae322ed35d499f600832914e59282bf
-
SSDEEP
1536:1OBNF/z+1N/PoxqPlQeY29bZABCkE+xLkDtUV16gJgiNANW6GRm:1OBNF/Rqa0IEkEPtQXN5G
Score10/10-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Adds Run key to start application
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1