Analysis

  • max time kernel
    120s
  • max time network
    130s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    28/04/2024, 09:15

General

  • Target

    04dbbb89d97f1ca868da34f01f56f6eb_JaffaCakes118.exe

  • Size

    23.9MB

  • MD5

    04dbbb89d97f1ca868da34f01f56f6eb

  • SHA1

    949b48fa19e4cb6244977a8d6ddbdf3a1296d10f

  • SHA256

    bde30e142c6fe2ad822f4d9f5fe1be1977789b5fef120314ff7c88f59bf98970

  • SHA512

    4ee350dcd334b773edf6b222515b78b60cac99384e464645460e188e3668b74e85d42804f48ebb918ca90779de7b4b5066f3d49a362fcfdf59a58dbc7ed0265d

  • SSDEEP

    6144:Gw0avOvtYSiod4uYzqAvZd/246UvmZIxs2:LvGvViG4HOKZde9m

Malware Config

Signatures

  • Gh0st RAT payload 1 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in System32 directory 2 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\04dbbb89d97f1ca868da34f01f56f6eb_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\04dbbb89d97f1ca868da34f01f56f6eb_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1440
    • \??\c:\users\admin\appdata\local\gibyqhkncw
      "C:\Users\Admin\AppData\Local\Temp\04dbbb89d97f1ca868da34f01f56f6eb_JaffaCakes118.exe" a -sc:\users\admin\appdata\local\temp\04dbbb89d97f1ca868da34f01f56f6eb_jaffacakes118.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1676
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    1⤵
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    • Drops file in System32 directory
    • Checks processor information in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2984

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \??\c:\programdata\application data\storm\update\%sessionname%\tvkoh.cc3

          Filesize

          24.0MB

          MD5

          b258151887d457001a356dd682d0f991

          SHA1

          109da56f8e3f6d283a17bd0fa3e74459d44080d1

          SHA256

          966528d30491d8646d0429ac3fbf8e96c5de831ef7d6dfaec383f5a14a69db3f

          SHA512

          2be4d31165172285e557493b3d94d4bdf8134bb31e4a20ec12b12f2615d991f56d120d718031b54f47de1ca05664d818b8e0afb8315aa550bb7e1dfecc80a798

        • \Users\Admin\AppData\Local\gibyqhkncw

          Filesize

          23.9MB

          MD5

          b214d8807e6ce59a9a685c8f6f31788b

          SHA1

          a57bc6899aeca668ab136df85b0eb506c7f9252b

          SHA256

          66c749bf116d5a63a898105fcc449cae7202aa7b0e981282d6c168ea02bcae1c

          SHA512

          b946d7099526d425c4ab1c959e2f1cd3ff162a0dc5e3ea15a4b387efd9031faa4689b53dcb9a2eb52e8dbc3dc8aeed7f11d066075c85bc6df05b7b64de06078d

        • memory/2984-13-0x00000000001B0000-0x00000000001B1000-memory.dmp

          Filesize

          4KB