Analysis
-
max time kernel
147s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
03-11-2024 12:04
General
-
Target
8b653439517f58d135180ab16effe955_JaffaCakes118.exe
-
Size
405KB
-
MD5
8b653439517f58d135180ab16effe955
-
SHA1
86772f7366a2c7fdcd0daea423fd70121710900a
-
SHA256
2cfa5cd046adf57d926061b64dca6d8ba637885ea0a5e0aec11f0b01e8d3153e
-
SHA512
9c5f054c0af242668197139dd53e64bf23d6285d8ed746a8c5d87a72e3557452b0850fb726a99f3bafe44ac8b93160081a480535c39c63e8a0bd4225319be2f7
-
SSDEEP
3072:yOVTH9dqOVTH9dphiegXp57ewCmFDoBqMvJDA5ZUEb6Evwoe+wiM1uw+TtWn7fJ+:F95D81ew5V5ZH6Evwoe+wiM1uwIx1f
Score
10/10
Malware Config
Extracted
Family
njrat
Version
0.7d
Botnet
HacKed
C2
127.0.0.1:5552
Mutex
7b1cba4c2fd49c8ec47f2b8a10ea378a
Attributes
-
reg_key
7b1cba4c2fd49c8ec47f2b8a10ea378a
-
splitter
|'|'|
Signatures
-
Njrat family
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
-
Suspicious use of AdjustPrivilegeToken 35 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b653439517f58d135180ab16effe955_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8b653439517f58d135180ab16effe955_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\8b653439517f58d135180ab16effe955_JaffaCakes118.exe" "8b653439517f58d135180ab16effe955_JaffaCakes118.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
432KB
-
Filesize
48KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB