Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09/04/2024, 15:26
Behavioral task
behavioral1
Sample
ea4e105f4d990e8aac897612fea0bf61_JaffaCakes118.dll
Resource
win7-20240319-en
windows7-x64
General
-
Target
ea4e105f4d990e8aac897612fea0bf61_JaffaCakes118.dll
-
Size
3.3MB
-
MD5
ea4e105f4d990e8aac897612fea0bf61
-
SHA1
58025b2f7f65d1a4c24a510ac7df4dd59a9abe22
-
SHA256
11febbff95d74b9bee4f1bda030d6146801ada929ff9aaa1e4a49ef09ac534fb
-
SHA512
9cce466af7b305fb70fd9408e53a4c8ee2dcf8dfa605d6181e20fe052ac3839885d45b9abaa344e207c5ea416da411e3ae96ccdf5b1c096a40a11a4979429ba2
-
SSDEEP
3072:bixrcYyNNBxIf58d6UuSMhXk22T94oz7vEEZzcEKJOSQQQQQQQQQQQQQQQQQQQQ9:aANBxIxh0u4TSg7vECzcx0o
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x000b00000002322e-3.dat family_gh0strat -
Loads dropped DLL 1 IoCs
pid Process 4188 svchost.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Rnop\Wnopqrstu.gif rundll32.exe File created C:\Program Files (x86)\Rnop\Wnopqrstu.gif rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe 4188 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 4204 rundll32.exe Token: SeRestorePrivilege 4204 rundll32.exe Token: SeBackupPrivilege 4204 rundll32.exe Token: SeRestorePrivilege 4204 rundll32.exe Token: SeBackupPrivilege 4204 rundll32.exe Token: SeRestorePrivilege 4204 rundll32.exe Token: SeBackupPrivilege 4204 rundll32.exe Token: SeRestorePrivilege 4204 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4872 wrote to memory of 4204 4872 rundll32.exe 85 PID 4872 wrote to memory of 4204 4872 rundll32.exe 85 PID 4872 wrote to memory of 4204 4872 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ea4e105f4d990e8aac897612fea0bf61_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ea4e105f4d990e8aac897612fea0bf61_JaffaCakes118.dll,#12⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4204
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4188
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12.5MB
MD57318d750af28b9fa65c0785213b01861
SHA1d1b228f20429697723fb7d60f915b04ddf10bbc3
SHA2561dd5983909c02cef6f1c569b023e77ba51de500c496f2d53eb78d0530a8c58ab
SHA512aae4af53429684ff509882adb8a87e6ce70298185a34e4be3045ef531b18c7beebb60888280e91578525d6ee3ec9409cedaa75b3d4491f588cc202e664571679
