Analysis
-
max time kernel
147s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
07-09-2024 23:21
General
-
Target
d30b2635874071bc14077678bec52a3c_JaffaCakes118.exe
-
Size
46KB
-
MD5
d30b2635874071bc14077678bec52a3c
-
SHA1
f0f87b36eee34aab8e4df6bb26f4cddb2aaadbd7
-
SHA256
522368c63afd804c949889c0316b113d4019d720b76fec1d773a94b7eee1f94e
-
SHA512
96ac23320acf15b7cfca1b41a954539098faa37b3fc627e5f6536518a9913b4723cc0c53b9c2b0fd3602890e8d06d332952ed7b0ab529520bb2b13862995f1eb
-
SSDEEP
768:rMpD+Zwq3r1uFbaYh+Jnq7az+xRug+n2hpUE+fDNkQp6HwfYTpP3KoDHQPc+e4Z:rmD+HZuY5q7az+GgDbUfZkQTfApP3KoY
Malware Config
Extracted
njrat
0.7d
B HAT
1fcb8fb3a4794ae29f1b8ef01d138a35
-
reg_key
1fcb8fb3a4794ae29f1b8ef01d138a35
-
splitter
|'|'|
Signatures
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 37 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d30b2635874071bc14077678bec52a3c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d30b2635874071bc14077678bec52a3c_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cr.exe"C:\Users\Admin\AppData\Local\Temp\cr.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD59e5ca2d6e285b0a8dc24947172dd71f7
SHA1501a1bc99b21630ea3b6b64d6efd7b321cfe2fe3
SHA25608f2fa392e389a0ae68253e58dc0cce9b99f331b68aa3c53999bd2593fe18830
SHA512a6156d847da04a63c04f0a91956dda3a1565c04c09e56e71a8e337e64143a4685040a520f52c8b56cc310685901f36433e620bb13882553b54f696280bef1296
-
Filesize
4KB
-
Filesize
72KB
-
Filesize
624KB
-
Filesize
7.7MB
-
Filesize
48KB
-
Filesize
64KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
7.7MB
-
Filesize
40KB
-
Filesize
7.7MB
-
Filesize
7.7MB