Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system - submitted
21/04/2024, 15:34
Behavioral task
behavioral1
Sample
ff9a0067b5b1701670f9ac24b87c6992_JaffaCakes118.exe
Resource
win7-20231129-en
windows7-x64
7 signatures
150 seconds
General
- Target ff9a0067b5b1701670f9ac24b87c6992_JaffaCakes118.exe
- Size 152KB
- Sample240421-szynaaec46
- SHA256 a86e2d8e833910b655ec60bff7a47fe74210e805e2098aa4c78c2ea6660e7284
- MD5 ff9a0067b5b1701670f9ac24b87c6992
- SHA1 92c5d7e233864870442dadcaf95b5561b5d6d898
- SHA512 4aaec3761baa87cab7160600b2a18522f4aac642d142317d4cdb2ce9b81b5016612b94975b9212ce87b42a39d4ac4183577ebd492b3e01620db4800687c6729b
- SSDEEP 3072:VbAsU4cQIuP1YTzA42vdwe5jma/cQbqRNbqI6ZzO583Q:VzIa8Afvqem4yRMnzO+A
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Gh0st RAT payload 2 IoCs
resource yara_rule behavioral2/files/0x001c00000001e97e-2.dat family_gh0strat behavioral2/files/0x000b000000023457-11.dat family_gh0strat - Deletes itself 1 IoCs
pid Process 1700 svchost.exe - Loads dropped DLL 2 IoCs
pid Process 2960 ff9a0067b5b1701670f9ac24b87c6992_JaffaCakes118.exe 1700 svchost.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Huot\Qvvpyjurw.bmp ff9a0067b5b1701670f9ac24b87c6992_JaffaCakes118.exe File created C:\Program Files (x86)\Huot\Qvvpyjurw.bmp ff9a0067b5b1701670f9ac24b87c6992_JaffaCakes118.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe - Suspicious behavior: LoadsDriver 6 IoCs
pid Process 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 656 Process not Found - Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 2960 ff9a0067b5b1701670f9ac24b87c6992_JaffaCakes118.exe Token: SeRestorePrivilege 2960 ff9a0067b5b1701670f9ac24b87c6992_JaffaCakes118.exe Token: SeBackupPrivilege 2960 ff9a0067b5b1701670f9ac24b87c6992_JaffaCakes118.exe Token: SeRestorePrivilege 2960 ff9a0067b5b1701670f9ac24b87c6992_JaffaCakes118.exe Token: SeBackupPrivilege 2960 ff9a0067b5b1701670f9ac24b87c6992_JaffaCakes118.exe Token: SeRestorePrivilege 2960 ff9a0067b5b1701670f9ac24b87c6992_JaffaCakes118.exe Token: SeBackupPrivilege 2960 ff9a0067b5b1701670f9ac24b87c6992_JaffaCakes118.exe Token: SeRestorePrivilege 2960 ff9a0067b5b1701670f9ac24b87c6992_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff9a0067b5b1701670f9ac24b87c6992_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ff9a0067b5b1701670f9ac24b87c6992_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2960
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Deletes itself
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1700
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\4100.dl
- Size 132KB
- SHA256 6558e79f589e287a3f1309fb58d962fca9a7023072be94e81bcbc14e2ddd5583
- MD5 f21aa52699b149ab33090f5173ec87db
- SHA1 9cd69378768ee66ebe87cb161aa1cbf40b76746a
- SHA512 c0fac3d9eb1f53991be7e7f67a7190b81df11922e87fc33d2d0ecd5e83bdbc399a0fa75aa59e35872820cc4f025ddd65986e977228b77a24d157c88946e4f382
- SSDEEP 3072:eAsU4cQIuP1YTzA42vdwe5jma/cQbqRNbqI6ZzO583Q:KIa8Afvqem4yRMnzO+A
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\NT_Path.jpg
- Size 95B
- SHA256 362e8477933fa459d0333bd9c27263310f40e8a69709773e903b08dc6c158e2b
- MD5 e4346ab3a40277078fec0522347bad15
- SHA1 abad15d52fccb21e6930f5762ffa709cd7f785a4
- SHA512 6d4fafb6dec1c77233bf53efa9ec9276bb50a88a9f9ffda8f5ea188611defc1568c14fca1be9e51a33e4a8ed49607ab7417ed4fe4db2f906d0936b1d5932e8c7
- MD5 SHA1 SHA512
- Path \??\c:\program files (x86)\huot\qvvpyjurw.bmp
- Size 16.6MB
- SHA256 3af925498836f3ef55c0ee06b08f9ea48eb2882c1e4dbb286776df16c126f2af
- MD5 082c89f436793c7dccfd8e3c55febe74
- SHA1 36c6f5efdf8ac5b275d57d916e403a36e534947c
- SHA512 fae54d442251d437be754c206efa87b1b942fcfe3f2533377749855a47281d92518eecfbf26d72ba358206259911e2b4fcaddcba8b1806cca5b43cc51cee5ead
- SSDEEP 49152:U77777777777777777777777777777777777777777777777777777777777777O:F
- MD5 SHA1 SHA512 SSDEEP
