Analysis
-
max time kernel
140s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
19-06-2024 19:06
Behavioral task
behavioral1
Sample
001856b5877ef8d7b3f14d9c28db6435_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
001856b5877ef8d7b3f14d9c28db6435_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
001856b5877ef8d7b3f14d9c28db6435_JaffaCakes118.exe
-
Size
107KB
-
MD5
001856b5877ef8d7b3f14d9c28db6435
-
SHA1
9d93e8b9680d97508b667dbaad2e4000bcef8119
-
SHA256
74f7974514affbb0e6e4b11e6ce19097d2a6efc097364881af76215bd4ceb5d9
-
SHA512
47f3795d08b8e58bacc2db96891c8cd332dfae735fc6ab0cf12516beb86bd1e66c0a2d19fa77a5b0f2ea65a381aae97582f81d7366a5a02bcfce37cc19a8b9e3
-
SSDEEP
3072:A8CSyGEmjY0+Xb9kHDgHcgKb+TweCUjDo+:VCSyGFjP+XyUHhqaweCUjE+
Malware Config
Signatures
-
Gh0st RAT payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1252-0-0x0000000000400000-0x000000000041D000-memory.dmp family_gh0strat \Windows\SysWOW64\FastUserSwitchingCompatibilityexxxx.dll family_gh0strat behavioral1/memory/1252-5-0x0000000000400000-0x000000000041D000-memory.dmp family_gh0strat -
Drops file in Drivers directory 1 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Drivers\beep.sys svchost.exe -
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
Processes:
001856b5877ef8d7b3f14d9c28db6435_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibilityexxxx.dll" 001856b5877ef8d7b3f14d9c28db6435_JaffaCakes118.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 1080 svchost.exe -
Loads dropped DLL 1 IoCs
Processes:
svchost.exepid process 1080 svchost.exe -
Drops file in System32 directory 1 IoCs
Processes:
001856b5877ef8d7b3f14d9c28db6435_JaffaCakes118.exedescription ioc process File opened for modification C:\Windows\SysWOW64\FastUserSwitchingCompatibilityexxxx.dll 001856b5877ef8d7b3f14d9c28db6435_JaffaCakes118.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 476
Processes
-
C:\Users\Admin\AppData\Local\Temp\001856b5877ef8d7b3f14d9c28db6435_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\001856b5877ef8d7b3f14d9c28db6435_JaffaCakes118.exe"1⤵
- Server Software Component: Terminal Services DLL
- Drops file in System32 directory
PID:1252
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Drops file in Drivers directory
- Deletes itself
- Loads dropped DLL
PID:1080
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
MD5a44273652f0bb9e60b75cd9cff928189
SHA1f97c0e4224d88795ca778fbea14c09b193e59915
SHA2563c3bc99626a02059db0ed029ab7798952439ab7e9b49e82b5c8c1ed5dae5b397
SHA51254d38b2581c43d744ec7df4aa309fd077f6b430938bc4a65d69789a5ef032b169a2924e798adb3e28d3cd54eda99af18d8d5b4eba7c1e53a85af10dacd841674