Overview

overview

10

Static

static

3

JaffaCakes...95.exe

windows7-x64

10

JaffaCakes...95.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_50c14c089bdc8f84c4379455b260f57908c4bf94e14a31883ebf0bc53f97f595

  • Size

    157KB

  • Sample

    241229-f6m4xatngp

  • MD5

    b48886bf2d4ef932e3a876787d1ecd86

  • SHA1

    2764dc9a337739bbdb066cb5969488a975e0b7c2

  • SHA256

    50c14c089bdc8f84c4379455b260f57908c4bf94e14a31883ebf0bc53f97f595

  • SHA512

    b3c5160f14c49c3d1201ad60130fd61fd994aa4d5b4d56e5156baec62c652f6e7dfb892b5e34bf75a57661894e1b69e209a081a46ff2dee78244d46f86653f77

  • SSDEEP

    3072:HydqYv+MxqQDTkyoHaO/MJV0ehx1mnAU+bKh:HKx7DTXA6mnR

Score
10/10
njratdiscoveryevasionpersistenceprivilege_escalationtrojan

Malware Config

Targets

    • Target

      JaffaCakes118_50c14c089bdc8f84c4379455b260f57908c4bf94e14a31883ebf0bc53f97f595

    • Size

      157KB

    • MD5

      b48886bf2d4ef932e3a876787d1ecd86

    • SHA1

      2764dc9a337739bbdb066cb5969488a975e0b7c2

    • SHA256

      50c14c089bdc8f84c4379455b260f57908c4bf94e14a31883ebf0bc53f97f595

    • SHA512

      b3c5160f14c49c3d1201ad60130fd61fd994aa4d5b4d56e5156baec62c652f6e7dfb892b5e34bf75a57661894e1b69e209a081a46ff2dee78244d46f86653f77

    • SSDEEP

      3072:HydqYv+MxqQDTkyoHaO/MJV0ehx1mnAU+bKh:HKx7DTXA6mnR

    Score
    10/10
    njratdiscoveryevasionpersistenceprivilege_escalationtrojan

    • Njrat family

      njrat

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion

    • Drops startup file

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

1
T1112

Credential Access

Discovery

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks