Analysis
-
max time kernel
149s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
14-09-2024 00:49
General
-
Target
df31c83efef6b1f2fa1855b57c94a365_JaffaCakes118.exe
-
Size
43KB
-
MD5
df31c83efef6b1f2fa1855b57c94a365
-
SHA1
6b4e4345af409c4629f22a06b469069d72f7e589
-
SHA256
9900ad0c7904f3773303ee2e5781681bceec369643e6a29592130206b71ee661
-
SHA512
fa70e26664c169c1f80d98eab7687f7b950162147e223f6bf089e3d6487efa7fa66878f16b2f1594b7fa89b4e639735faab682f9e23c74ce0802b0953c7caae6
-
SSDEEP
384:HZy+Hl9n1iDcsyEqt3ptKwQsElGhOEazcIij+ZsNO3PlpJKkkjh/TzF7pWn5mgra:599nU4pEqt5tKhohuuXQ/o8C+L
Score
10/10
Malware Config
Extracted
Family
njrat
Version
Njrat 0.7 Golden By Hassan Amiri
Botnet
HacKed
C2
127.0.0.1:5552
Mutex
Windows Update
Attributes
-
reg_key
Windows Update
-
splitter
|Hassan|
Signatures
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 37 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\df31c83efef6b1f2fa1855b57c94a365_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\df31c83efef6b1f2fa1855b57c94a365_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
72KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
6.9MB