Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
22-09-2024 17:09
General
-
Target
f2743e403ab405cdd0924a06d138df34_JaffaCakes118.exe
-
Size
259KB
-
MD5
f2743e403ab405cdd0924a06d138df34
-
SHA1
e164a75ad1975f72b3c216722a7d14b1987738ee
-
SHA256
326c96af0ea7fe35ea7a8f27d066c40504806a58be14313a4d7b6aecf74f7a74
-
SHA512
baeffceee12429e01a88d39e6f32aca8bcf5d8de32419a2a591101f6f70f3de0cc2e754e1417fb620a8daed60f1d890304fc1eaecec51aeb24bae59f66eb0551
-
SSDEEP
3072:CXOgeluv4V3aWxbMXy2x+kKEAWB24OHxTWewwx+VCcgRdsK68sJspL7sTAX:IOgFva35bmGbNHxDZUIR8nJGvX
Score
10/10
Malware Config
Signatures
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
-
Suspicious use of AdjustPrivilegeToken 37 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f2743e403ab405cdd0924a06d138df34_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f2743e403ab405cdd0924a06d138df34_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\f2743e403ab405cdd0924a06d138df34_JaffaCakes118.exe" "f2743e403ab405cdd0924a06d138df34_JaffaCakes118.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
288KB
-
Filesize
232KB
-
Filesize
9.9MB
-
Filesize
56KB
-
Filesize
4KB
-
Filesize
9.9MB