Analysis

  • max time kernel
    140s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    19-06-2024 19:06

General

  • Target

    001856b5877ef8d7b3f14d9c28db6435_JaffaCakes118.exe

  • Size

    107KB

  • MD5

    001856b5877ef8d7b3f14d9c28db6435

  • SHA1

    9d93e8b9680d97508b667dbaad2e4000bcef8119

  • SHA256

    74f7974514affbb0e6e4b11e6ce19097d2a6efc097364881af76215bd4ceb5d9

  • SHA512

    47f3795d08b8e58bacc2db96891c8cd332dfae735fc6ab0cf12516beb86bd1e66c0a2d19fa77a5b0f2ea65a381aae97582f81d7366a5a02bcfce37cc19a8b9e3

  • SSDEEP

    3072:A8CSyGEmjY0+Xb9kHDgHcgKb+TweCUjDo+:VCSyGFjP+XyUHhqaweCUjE+

Malware Config

Signatures

  • Gh0st RAT payload 3 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

  • Drops file in Drivers directory 1 IoCs
  • Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\001856b5877ef8d7b3f14d9c28db6435_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\001856b5877ef8d7b3f14d9c28db6435_JaffaCakes118.exe"
    1⤵
    • Server Software Component: Terminal Services DLL
    • Drops file in System32 directory
    PID:1252
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    1⤵
    • Drops file in Drivers directory
    • Deletes itself
    • Loads dropped DLL
    PID:1080

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Windows\SysWOW64\FastUserSwitchingCompatibilityexxxx.dll

    Filesize

    96KB

    MD5

    a44273652f0bb9e60b75cd9cff928189

    SHA1

    f97c0e4224d88795ca778fbea14c09b193e59915

    SHA256

    3c3bc99626a02059db0ed029ab7798952439ab7e9b49e82b5c8c1ed5dae5b397

    SHA512

    54d38b2581c43d744ec7df4aa309fd077f6b430938bc4a65d69789a5ef032b169a2924e798adb3e28d3cd54eda99af18d8d5b4eba7c1e53a85af10dacd841674

  • memory/1252-0-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

  • memory/1252-5-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB