Analysis
-
max time kernel
150s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
16-04-2024 06:53
Behavioral task
behavioral1
Sample
f2ef5cde02e79c38338e7bb163d63b5f_JaffaCakes118.exe
Resource
win7-20231129-en
windows7-x64
General
-
Target
f2ef5cde02e79c38338e7bb163d63b5f_JaffaCakes118.exe
-
Size
134KB
-
MD5
f2ef5cde02e79c38338e7bb163d63b5f
-
SHA1
3d272166feefc6bf275182bf57c9d12fc0bd5fcc
-
SHA256
ff1a30e56965197f69bb88572482f53816230b416924d30097dcce9bcb0c32ee
-
SHA512
086b88e9385419978f04f6a8a3d0dc7ebd8b8c66ac99d2218b8f9b2398d9e2ed51d49ec4587e451ea19ce156e1f7c0dfd624b025dc182936b9d0c3cfc962203b
-
SSDEEP
3072:MMwZSQpKa3VGVnpUlCz764/9xpEEBqbZuwK5iGHeqovv:M3JVGpxx9b3wZuwK4GHeqo
Malware Config
Signatures
-
Gh0st RAT payload 2 IoCs
resource yara_rule behavioral2/files/0x000300000001e97c-2.dat family_gh0strat behavioral2/files/0x000e00000002334e-11.dat family_gh0strat -
Deletes itself 1 IoCs
pid Process 1656 svchost.exe -
Loads dropped DLL 2 IoCs
pid Process 628 f2ef5cde02e79c38338e7bb163d63b5f_JaffaCakes118.exe 1656 svchost.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\FileName.jpg f2ef5cde02e79c38338e7bb163d63b5f_JaffaCakes118.exe File created C:\Windows\FileName.jpg f2ef5cde02e79c38338e7bb163d63b5f_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe 1656 svchost.exe -
Suspicious behavior: LoadsDriver 6 IoCs
pid Process 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 660 Process not Found -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 628 f2ef5cde02e79c38338e7bb163d63b5f_JaffaCakes118.exe Token: SeRestorePrivilege 628 f2ef5cde02e79c38338e7bb163d63b5f_JaffaCakes118.exe Token: SeBackupPrivilege 628 f2ef5cde02e79c38338e7bb163d63b5f_JaffaCakes118.exe Token: SeRestorePrivilege 628 f2ef5cde02e79c38338e7bb163d63b5f_JaffaCakes118.exe Token: SeBackupPrivilege 628 f2ef5cde02e79c38338e7bb163d63b5f_JaffaCakes118.exe Token: SeRestorePrivilege 628 f2ef5cde02e79c38338e7bb163d63b5f_JaffaCakes118.exe Token: SeBackupPrivilege 628 f2ef5cde02e79c38338e7bb163d63b5f_JaffaCakes118.exe Token: SeRestorePrivilege 628 f2ef5cde02e79c38338e7bb163d63b5f_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f2ef5cde02e79c38338e7bb163d63b5f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f2ef5cde02e79c38338e7bb163d63b5f_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:628
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Deletes itself
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1656
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
101KB
MD56be72d4ad0a31518eb3b3b819cfd5b9b
SHA1314beb3e971046d636cbb2d55c8c48000f62d9fe
SHA256193f711c4563a59608047a6326a396631536bcf0bc6a01e1a9b28cdb380d3861
SHA51243dbe3f541c9a9604c9f11a79112a0c3f22ec5701167d08558ec8392f7b07a9ab769c3c623b6085cb3fa00664687331daa929dcd3274a265d7261e0d024cc59c
-
Filesize
99B
MD5ff9c55becd1b9d495db040194c71858a
SHA162b88a3da2a9ec77b13dcef65abbd3dbf7408bfa
SHA256c6f4ea1d450175564cd8a8fe5579c8d89e56a1fe24555cdbb63e625ff96b2359
SHA5123a9146bb8e8877c52d8656d90b868d3d68bc38c9f3ced20717f373a0043f91c591981a0ca1b5367c573c8d9ad43a82ef77e37868b30b5ae02e2622fa31b43e92
-
Filesize
2.3MB
MD5bb2942800b6df758e8db3dcdea3116b0
SHA1490ffe6e6de56cb7e4c3d44706dcf042b0cc1fd8
SHA256d8b0a9dbe6921bc35ccb454fc5de46af3cd2932be5c9e3fcc98f7a9498604442
SHA5120f1cf46bccd1cae59aa9ed9d3a6a3723e52ee97bda780b27dfe87c3e7856ab363b65f21f15b464ee290a150d736e4b644e1afb446c6507571ee324de9527bceb
