Analysis

  • max time kernel
    148s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    22-06-2024 23:01

General

  • Target

    04487fea5794d373da98f32d2a87778b_JaffaCakes118.exe

  • Size

    69KB

  • MD5

    04487fea5794d373da98f32d2a87778b

  • SHA1

    66088fe9dcf19108a12d7e5a0a61796ba2c5a886

  • SHA256

    48114ea6f8616e182b6f19ce8861a5d6014ef0c1d4377355b642e6a3355a4ed8

  • SHA512

    3c2f55b7e1adf69831cc7ecbcb053b9f7a82761cfcbc632358071b6ea3925a0c1c1f892a0d96646db6305b62f19b52db58372947bb68abb8c323822d30a41cb8

  • SSDEEP

    768:mXzzabcv30NuMkNNe1ZV6ieZopVqYU/9++WdoOkG5OoySP9SpcL1GbNg2sZ9K4pP:bjKaM/g+WuVpcL1GbNg2sZ9WmbF3

Score
10/10

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

B HAT

Mutex

c3f67240befd41c0bbbef976afa47823

Attributes
  • reg_key

    c3f67240befd41c0bbbef976afa47823

  • splitter

    |'|'|

Signatures

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Suspicious use of AdjustPrivilegeToken 37 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\04487fea5794d373da98f32d2a87778b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\04487fea5794d373da98f32d2a87778b_JaffaCakes118.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1464

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1464-0-0x00000000745DE000-0x00000000745DF000-memory.dmp

    Filesize

    4KB

  • memory/1464-1-0x0000000000CE0000-0x0000000000CF8000-memory.dmp

    Filesize

    96KB

  • memory/1464-2-0x0000000000330000-0x000000000033C000-memory.dmp

    Filesize

    48KB

  • memory/1464-3-0x00000000745D0000-0x0000000074CBE000-memory.dmp

    Filesize

    6.9MB

  • memory/1464-4-0x00000000745D0000-0x0000000074CBE000-memory.dmp

    Filesize

    6.9MB