Analysis

  • max time kernel
    149s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    19-06-2024 20:26

General

  • Target

    0056ab86ebb18bff6dce7dea69613d32_JaffaCakes118.exe

  • Size

    300KB

  • MD5

    0056ab86ebb18bff6dce7dea69613d32

  • SHA1

    5182f1a5853230b65e9a4c8ee3dbfe63043a7863

  • SHA256

    e97cf49bdf7f8decc6d2c0b5f225267f7a944a8d7403ec56da17ef7094729222

  • SHA512

    b76c09b5c1c83b57bc516eee89ed6f380963338f68a609e6d94e7a788e9c06ad9b193923932dabcb94d463407a57f506599a90f8e3553f162fc48bcd1593b5f2

  • SSDEEP

    6144:D7p8NUDl24LIMW14nDWgRAkPzTtGQn8xID0DMF16HAfe7EHer0MnJ:D7p8NuRYIR3PzBGLxe0Dc6gfe6R

Malware Config

Signatures

  • Gh0st RAT payload 2 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

  • Boot or Logon Autostart Execution: Time Providers 1 TTPs 3 IoCs

    The Windows Time service (W32Time) enables time synchronization across and within domains.

  • Drops file in Program Files directory 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0056ab86ebb18bff6dce7dea69613d32_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\0056ab86ebb18bff6dce7dea69613d32_JaffaCakes118.exe"
    1⤵
    • Boot or Logon Autostart Execution: Time Providers
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2384

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2384-0-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/2384-1-0x0000000000280000-0x00000000002C0000-memory.dmp

    Filesize

    256KB

  • memory/2384-2-0x0000000000280000-0x00000000002C0000-memory.dmp

    Filesize

    256KB

  • memory/2384-4-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/2384-3-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/2384-5-0x00000000001F0000-0x00000000001F1000-memory.dmp

    Filesize

    4KB

  • memory/2384-6-0x0000000000401000-0x0000000000404000-memory.dmp

    Filesize

    12KB

  • memory/2384-9-0x0000000000400000-0x0000000000473000-memory.dmp

    Filesize

    460KB

  • memory/2384-11-0x0000000000280000-0x00000000002C0000-memory.dmp

    Filesize

    256KB