Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
26-05-2024 04:50
General
-
Target
69faf02b87f0305929d8e81f91ef666dJaffaCakes118.exe
-
Size
374KB
-
MD5
69faf02b87f0305929d8e81f91ef666d
-
SHA1
b08a1ab9d0df1e40547c9ea825160030afbbfef7
-
SHA256
89391d2c2fbb330a15ae91f8587be857bd7f92e4bd00bd3d81241f0b4cf8bdb6
-
SHA512
50203169fc043ea661f8c515fa832f06335d80d63ba778f99923bfbf23100e6df2c4bb9ed572afdc6f950a63b82a9be2e608163558dd5a4915fc5dd7e226de95
-
SSDEEP
6144:lvZzQJVb5p72cHF1ybDFwekh212KhvwIb759QOaBjpaVRPu23E2rJmWjFS:lYVOiF1WD7kE1dTYOi8V5u23zmWFS
Malware Config
Signatures
-
Gh0st RAT payload 6 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 4 IoCs
-
UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
-
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\69faf02b87f0305929d8e81f91ef666dJaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\69faf02b87f0305929d8e81f91ef666dJaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft SQL Server\SQLServse.exe"C:\Program Files (x86)\Microsoft SQL Server\SQLServse.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft SQL Server\SQLServse.exe"C:\Program Files (x86)\Microsoft SQL Server\SQLServse.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft SQL Server\SQLServse.exe"C:\Program Files (x86)\Microsoft SQL Server\SQLServse.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft SQL Server\SQLServse.exe"C:\Program Files (x86)\Microsoft SQL Server\SQLServse.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 708 -s 6482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 708 -ip 7081⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1340 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38.4MB
MD57f9a3ba761fcce48175aa8b9ea3ef997
SHA1574d5702bfadfa0335ebc5e3ad87fcfbcb7b2ff0
SHA256f934a873c5bde221d891006564f14cdf7a3666812e50ccaaff4639302af369ec
SHA512d35ed8a66b01ed58a2e1e5aad70eabe6357692b5b957b793a6d101a3a666f138f93d3d35d0eaaae09999af4da6647eae9d1d0e456ec434b1fc5f2558c8328acb
-
Filesize
416KB
-
Filesize
416KB
-
Filesize
416KB
-
Filesize
416KB
-
Filesize
3.4MB
-
Filesize
416KB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
416KB
-
Filesize
416KB
-
Filesize
3.4MB
-
Filesize
416KB
-
Filesize
3.4MB
-
Filesize
4KB
-
Filesize
416KB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
416KB