Overview

overview

10

Static

static

3

JaffaCakes...b0.exe

windows7-x64

10

JaffaCakes...b0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_60f6807b536b05490c6d8f6a269315b0

  • Size

    71KB

  • Sample

    250101-169ywszman

  • MD5

    60f6807b536b05490c6d8f6a269315b0

  • SHA1

    cc4d406ef696fdb2039e79cdedd99be61fbe5bfa

  • SHA256

    8fcb9e5189c78b5100eaf2ac0cb8de81a7d3e041eb0d83929b878c33004057d7

  • SHA512

    16ca97c0a1912217455101459a822328f5837559fc845ffcff64fcf4209055a706953745b0c96b7c405824de3a7ab3d240795b174efd5385e48df1a28966fe2c

  • SSDEEP

    768:oBZguOHIR5bp1Z8gkkT8pRTpqw7HLaEg1bVSnoYSC7JO8BCb53i6faci57ij6/:3s5bp78PkI/TpqOraEH2CObw6Fi57iA

Score
10/10
njratdiscoveryevasionpersistenceprivilege_escalationtrojan

Malware Config

Targets

    • Target

      JaffaCakes118_60f6807b536b05490c6d8f6a269315b0

    • Size

      71KB

    • MD5

      60f6807b536b05490c6d8f6a269315b0

    • SHA1

      cc4d406ef696fdb2039e79cdedd99be61fbe5bfa

    • SHA256

      8fcb9e5189c78b5100eaf2ac0cb8de81a7d3e041eb0d83929b878c33004057d7

    • SHA512

      16ca97c0a1912217455101459a822328f5837559fc845ffcff64fcf4209055a706953745b0c96b7c405824de3a7ab3d240795b174efd5385e48df1a28966fe2c

    • SSDEEP

      768:oBZguOHIR5bp1Z8gkkT8pRTpqw7HLaEg1bVSnoYSC7JO8BCb53i6faci57ij6/:3s5bp78PkI/TpqOraEH2CObw6Fi57iA

    Score
    10/10
    njratdiscoveryevasionpersistenceprivilege_escalationtrojan

    • Njrat family

      njrat

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks