Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
05-01-2025 19:20
General
-
Target
JaffaCakes118_b914da0547b22709f5805917f2ff682a.exe
-
Size
125KB
-
MD5
b914da0547b22709f5805917f2ff682a
-
SHA1
2234e7d5bb9aa0ca0930e28ed0f9069ae5e392cd
-
SHA256
295161e1ff28aa0d998a9ce2f130229503a321cc8cdeff9d5cb11d81aebbff55
-
SHA512
31cd39c87440b580fb4f2ca036afe40f09498d405036b76ac34d32529f50944ce12f192ec7eaf00dc58e42ff23f40bb00cd4852664014e6f89405cd56bc3e16f
-
SSDEEP
3072:4FQHEzBdz35ufoEX9nsOSVifwB/nW9TU4GXiV:4FQHSBdzJsdXeE4NWg2
Malware Config
Signatures
-
Njrat family
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
Drops startup file 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 35 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b914da0547b22709f5805917f2ff682a.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b914da0547b22709f5805917f2ff682a.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_b914da0547b22709f5805917f2ff682a.exe" "JaffaCakes118_b914da0547b22709f5805917f2ff682a.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
5.7MB
-
Filesize
5.7MB