Analysis
-
max time kernel
150s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19/04/2024, 05:28
Behavioral task
behavioral1
Sample
f999f6d00546aee2ccb098d269ba6343_JaffaCakes118.exe
Resource
win7-20240319-en
windows7-x64
General
-
Target
f999f6d00546aee2ccb098d269ba6343_JaffaCakes118.exe
-
Size
127KB
-
MD5
f999f6d00546aee2ccb098d269ba6343
-
SHA1
6cb839e46fd963ec8b52f11c81e8e6a6ea9fcc91
-
SHA256
de3ba37b4c73b12963bf496aa5c13dbaf88c15ce7a97dbb112b8f5436d9d3157
-
SHA512
1117001f3a1a2c573e16cd7ab86bf9343db64c5a48e07524196b81341a9e3d904e91e6234961eb84ca569de3aead74195da79daeb883bb651d049156ff9a05e8
-
SSDEEP
3072:n7CaO7x8fC8t52oje+rKttHkoIIu6kfif20wNA:n7pON8ao6+wKodjkqfXC
Malware Config
Signatures
-
Gh0st RAT payload 2 IoCs
resource yara_rule behavioral2/files/0x000800000001db0e-2.dat family_gh0strat behavioral2/files/0x000d0000000233f1-11.dat family_gh0strat -
Deletes itself 1 IoCs
pid Process 4812 svchost.exe -
Loads dropped DLL 2 IoCs
pid Process 4776 f999f6d00546aee2ccb098d269ba6343_JaffaCakes118.exe 4812 svchost.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Bwxy\Gwxyabcde.gif f999f6d00546aee2ccb098d269ba6343_JaffaCakes118.exe File created C:\Program Files (x86)\Bwxy\Gwxyabcde.gif f999f6d00546aee2ccb098d269ba6343_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe 4812 svchost.exe -
Suspicious behavior: LoadsDriver 6 IoCs
pid Process 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 664 Process not Found -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 4776 f999f6d00546aee2ccb098d269ba6343_JaffaCakes118.exe Token: SeRestorePrivilege 4776 f999f6d00546aee2ccb098d269ba6343_JaffaCakes118.exe Token: SeBackupPrivilege 4776 f999f6d00546aee2ccb098d269ba6343_JaffaCakes118.exe Token: SeRestorePrivilege 4776 f999f6d00546aee2ccb098d269ba6343_JaffaCakes118.exe Token: SeBackupPrivilege 4776 f999f6d00546aee2ccb098d269ba6343_JaffaCakes118.exe Token: SeRestorePrivilege 4776 f999f6d00546aee2ccb098d269ba6343_JaffaCakes118.exe Token: SeBackupPrivilege 4776 f999f6d00546aee2ccb098d269ba6343_JaffaCakes118.exe Token: SeRestorePrivilege 4776 f999f6d00546aee2ccb098d269ba6343_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f999f6d00546aee2ccb098d269ba6343_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f999f6d00546aee2ccb098d269ba6343_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4776
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Deletes itself
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4812
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
113KB
MD57a5449088bf5920fd891b438e6179889
SHA1337c0a27eadc4b1a6f7949dfb6e181508a33daaa
SHA256613b890500e680923769cd2dde4269562ac364bb949be166bf7cfb9a37941779
SHA5126e0b04bc13986c0f82413922a0d3854f7d87308b8fab2fbe9422f8554076bc90628abc1f772cfa4003485c10c0789826339a091bf9fe3e2167dffdd87350ef3a
-
Filesize
97B
MD50f051193e1f76d5c177bab7e521b33f9
SHA192eb75801dc9c69610236863d707b80989458471
SHA256b23a38650ad546f2d261141df025dbd88c61420ab359c536b5363e0097363f62
SHA51296fa9f69bc9cebdfa650964947696fc7a5e134c34b0ff4a0d54167cf7d44b7bed04c827d1c5319fcb34afcdc81da63194a13b0fd4a75305bb031740b6df8eb1a
-
Filesize
8.2MB
MD572b9e5f52e00aed1e5fcd761ccc3780c
SHA1b23f514111b98a24019050097f6962a6dcca868d
SHA2565e10b505864fbc21717063cb309f9351c37942b2251584ddff5caefe9a09ffe6
SHA51281537474172455958b1fd50fa5e4dc6fc03064132f16d8873849af4d4049b084d66244754290c50cfd10a55592d78fbd3cf8224e38cba95bb9960d8b38809ad4
