Analysis
-
max time kernel
150s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
19-06-2024 20:03
Behavioral task
behavioral1
Sample
0041e68c1e6e5894f3257688e898e8e8_JaffaCakes118.exe
Resource
win7-20240419-en
General
-
Target
0041e68c1e6e5894f3257688e898e8e8_JaffaCakes118.exe
-
Size
127KB
-
MD5
0041e68c1e6e5894f3257688e898e8e8
-
SHA1
4e8a8bbd7d3a1f45e02505780da9079af5fdb89d
-
SHA256
6a552dc09ebd93d33e54831a3d0d1951b838a79df1e2d7c6fc73a1bbcb515ce4
-
SHA512
649852a2555d52cc37a7ba822cef75932fa2b03591e8a6696f6135f9b38ab187f8c975467006cd6dfa25e2cabe840ae64e2894ece0dcfaa5e94b30b9b75d0a29
-
SSDEEP
3072:17CaO7x8fC8t52oj2+rKttHkoIIu6kfif20wNA:17pON8aoi+wKodjkqfXC
Malware Config
Signatures
-
Gh0st RAT payload 4 IoCs
Processes:
resource yara_rule C:\Program Files (x86)\Bwxy\Gwxyabcde.gif family_gh0strat \??\c:\program files (x86)\bwxy\gwxyabcde.gif family_gh0strat behavioral1/memory/2052-9-0x0000000010000000-0x0000000010028000-memory.dmp family_gh0strat C:\2898300.dll family_gh0strat -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 1700 svchost.exe -
Loads dropped DLL 1 IoCs
Processes:
svchost.exepid process 1700 svchost.exe -
Drops file in Program Files directory 2 IoCs
Processes:
0041e68c1e6e5894f3257688e898e8e8_JaffaCakes118.exedescription ioc process File opened for modification C:\Program Files (x86)\Bwxy\Gwxyabcde.gif 0041e68c1e6e5894f3257688e898e8e8_JaffaCakes118.exe File created C:\Program Files (x86)\Bwxy\Gwxyabcde.gif 0041e68c1e6e5894f3257688e898e8e8_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe 1700 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
0041e68c1e6e5894f3257688e898e8e8_JaffaCakes118.exedescription pid process Token: SeBackupPrivilege 2052 0041e68c1e6e5894f3257688e898e8e8_JaffaCakes118.exe Token: SeRestorePrivilege 2052 0041e68c1e6e5894f3257688e898e8e8_JaffaCakes118.exe Token: SeBackupPrivilege 2052 0041e68c1e6e5894f3257688e898e8e8_JaffaCakes118.exe Token: SeRestorePrivilege 2052 0041e68c1e6e5894f3257688e898e8e8_JaffaCakes118.exe Token: SeBackupPrivilege 2052 0041e68c1e6e5894f3257688e898e8e8_JaffaCakes118.exe Token: SeRestorePrivilege 2052 0041e68c1e6e5894f3257688e898e8e8_JaffaCakes118.exe Token: SeBackupPrivilege 2052 0041e68c1e6e5894f3257688e898e8e8_JaffaCakes118.exe Token: SeRestorePrivilege 2052 0041e68c1e6e5894f3257688e898e8e8_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0041e68c1e6e5894f3257688e898e8e8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0041e68c1e6e5894f3257688e898e8e8_JaffaCakes118.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2052
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Deletes itself
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1700
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
113KB
MD5756629819676fecd59d410cbd7e63ed2
SHA1a774b4a83ecea402c90665c8de0875f2b6eebb1e
SHA256598f949ae3d4007255c55c737eb61523007c49186da603104c4d824c8f6ad226
SHA5128022f0b383278fd744de569a149e9eef3395232a2f5762b2b66c5a8a788d1afb2147d2de58a11d58b35424e9469a1b238884b716efe53f1a05d11df1acaa2989
-
Filesize
115KB
MD5f065dfec0f0f7433f7db441053cfedd0
SHA11de022600cef1d2c0f1de30ed712176302953fcb
SHA25669dccb4b21ff42c305f02dfa1b4031df51caf1fbcbfd5740e2401e3d759b4ddb
SHA5120bd0062aea8887de7446dce1a8227e7abbdf30744c811cef3e12878512a8e1ca837a6bafe34dcd44a061d588460818315345a0b47a1ccdf760630f4fce00a9fe
-
Filesize
99B
MD5e5ebe7ae0c59b2bbb1afa726567db18b
SHA13be1443373a20a1ecee46d1c133222c28b492e86
SHA25662abdd99f21f2a944dca412a0b691d6f652d0c50df28dc29c0fb96bb536e8a89
SHA512725504210eabf5d60a3825a5dc6b5feba4718f3ef0384fec3e67f98b2faef2832f7c7ee5b40a6027ffb1599a93048424b67c6b1c4f1ebe55853a489bf45ddb75
-
Filesize
12.0MB
MD52433c2f3efd9c757dc48bc8ae4bb9672
SHA1dae03ca287ebf8f8ff81b65ff2f7f357e4008d4f
SHA256e34e859b38d8fc50ddfee9081e20634c7ba9718c3cbe8c4cfaf52c5bc47dfe57
SHA51299b25d3377e0b7f2b051b4cff06e765f4b6aae19896782ff2621076792dd4a53a61158052a389dfc0f40d5f9d066db1e553aad9a8e769de3625f3a7dca07b41f