Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
26/04/2024, 11:18
Behavioral task
behavioral1
Sample
00a62d22e0d2bc1191c7cf03303a9b96_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
General
-
Target
00a62d22e0d2bc1191c7cf03303a9b96_JaffaCakes118.exe
-
Size
126KB
-
MD5
00a62d22e0d2bc1191c7cf03303a9b96
-
SHA1
9b228c28e6e571463708eb41cc8127fb1a063114
-
SHA256
3f046e995d4b615b9ed5cd52372529f54972d7da0dcfbd136c4bd3ff3380fb97
-
SHA512
cb2ca473925e9bc8a0cad27307fec80444cab874d87dd35b25fe28a2035c6f7299daa75e36695b2cab3744bc2a39df0e524123551527764f575c4acb8368d038
-
SSDEEP
3072:1fu81m+O6rM/TWeHiYzmhLTIhttHU4o4ugkCiHWwxA:1f/1TMvCYkLTIT64N1kJ2W
Malware Config
Signatures
-
Gh0st RAT payload 2 IoCs
resource yara_rule behavioral2/files/0x000c000000023b58-2.dat family_gh0strat behavioral2/files/0x000f000000023bb3-11.dat family_gh0strat -
Deletes itself 1 IoCs
pid Process 3680 svchost.exe -
Loads dropped DLL 2 IoCs
pid Process 1488 00a62d22e0d2bc1191c7cf03303a9b96_JaffaCakes118.exe 3680 svchost.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Lhij\Qhijklmno.bmp 00a62d22e0d2bc1191c7cf03303a9b96_JaffaCakes118.exe File created C:\Program Files (x86)\Lhij\Qhijklmno.bmp 00a62d22e0d2bc1191c7cf03303a9b96_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe 3680 svchost.exe -
Suspicious behavior: LoadsDriver 6 IoCs
pid Process 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 660 Process not Found -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 1488 00a62d22e0d2bc1191c7cf03303a9b96_JaffaCakes118.exe Token: SeRestorePrivilege 1488 00a62d22e0d2bc1191c7cf03303a9b96_JaffaCakes118.exe Token: SeBackupPrivilege 1488 00a62d22e0d2bc1191c7cf03303a9b96_JaffaCakes118.exe Token: SeRestorePrivilege 1488 00a62d22e0d2bc1191c7cf03303a9b96_JaffaCakes118.exe Token: SeBackupPrivilege 1488 00a62d22e0d2bc1191c7cf03303a9b96_JaffaCakes118.exe Token: SeRestorePrivilege 1488 00a62d22e0d2bc1191c7cf03303a9b96_JaffaCakes118.exe Token: SeBackupPrivilege 1488 00a62d22e0d2bc1191c7cf03303a9b96_JaffaCakes118.exe Token: SeRestorePrivilege 1488 00a62d22e0d2bc1191c7cf03303a9b96_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\00a62d22e0d2bc1191c7cf03303a9b96_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\00a62d22e0d2bc1191c7cf03303a9b96_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1488
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Deletes itself
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3680
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
112KB
MD5152f29d7e22dcc696f30347dcd60ac54
SHA146f7f0cb14f2bcb23ae85c0cbde26ffdf5917218
SHA256306a49f1d067641875d719a61f128a4a29873b252ed668f4a7a17995352a5c94
SHA512fc17a29cf81180fde87d199b188d4c920f03751e659fa26c2320fe2950ee4381d595cca1c068666207216df1027b4640db29222f4e48a0b6db914acd1ccfa4f3
-
Filesize
99B
MD564bd63045cfa1c388ae7f1748d961506
SHA17e2255a6fea978b93a8239aecaa42a2a2e341d20
SHA2562679b307b8e5d695b9c8aba1815af8025dffd19e81ba7d867e55c8501a0ec9ef
SHA512a2db4c75478933f48f192b6c29d859317befc1a12638aa0c7ebc0893cbac2be0ce6c9f971bf6752b97bae6b824c3e716bb42ce91c1b97f5e3af41920eb75556b
-
Filesize
14.2MB
MD5123f38da94e71643f09ea0c7e5ff919b
SHA1f9377d68a42f5375eb502767f0a093dc072aa02b
SHA2568bb5d84678959de64b7e8af839fb7b1bd66a3c05c39cac32585534fd35deba86
SHA512603382724022a3c45228bc008076b8068d673f77999f85f51a07e69173523cacb9be9ae7b5110a654f9fd1b387f6750d837380b0562b36ecf893e3aba02e1661
