General
-
Target
cc15a4328fd432864596951111205eac_JaffaCakes118
-
Size
9.8MB
-
Sample
240831-cxlyps1aqd
-
MD5
cc15a4328fd432864596951111205eac
-
SHA1
f06bbeae34ede64c58bf3304320bdc722a6f672c
-
SHA256
fb600ea4c6c05fcd6ad853d797541fe97b5af09c0bdc76591974585900f334fe
-
SHA512
bb9132323bd2b268ae346a1ada9238dba13cd00e2e1d372bde277aff37ca253a695215d1daea93fd7587943fcd410c51c4010e29060497d0374dfaf2395081ed
-
SSDEEP
196608:Gviq75/TzufgxZx4aMkCl+6UYEo0BPZuPTC9W9CPqOvLr6No:OiC/Rjck96UYE5Bcp9CPq4+i
Static task
static1
Behavioral task
behavioral1
Sample
cc15a4328fd432864596951111205eac_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
njrat
Njrat 0.7 Golden By Hassan Amiri
HacKed
192.168.0.96:228
Windows Update
-
reg_key
Windows Update
-
splitter
|Hassan|
Targets
-
-
Target
cc15a4328fd432864596951111205eac_JaffaCakes118
-
Size
9.8MB
-
MD5
cc15a4328fd432864596951111205eac
-
SHA1
f06bbeae34ede64c58bf3304320bdc722a6f672c
-
SHA256
fb600ea4c6c05fcd6ad853d797541fe97b5af09c0bdc76591974585900f334fe
-
SHA512
bb9132323bd2b268ae346a1ada9238dba13cd00e2e1d372bde277aff37ca253a695215d1daea93fd7587943fcd410c51c4010e29060497d0374dfaf2395081ed
-
SSDEEP
196608:Gviq75/TzufgxZx4aMkCl+6UYEo0BPZuPTC9W9CPqOvLr6No:OiC/Rjck96UYE5Bcp9CPq4+i
Score10/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1