Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-06-2024 06:22
Behavioral task
behavioral1
Sample
0398d731604fedfb679868be7526407c_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
General
-
Target
0398d731604fedfb679868be7526407c_JaffaCakes118.exe
-
Size
127KB
-
MD5
0398d731604fedfb679868be7526407c
-
SHA1
5b74ddbdfffcff3c7b436d07ea6212c9a6a52b33
-
SHA256
78d7793edd5db4eb68a80473e4c49ac29e600ba9ef0a0452940cf003270c6902
-
SHA512
3346a716cc320803c78c0ebae651f9b72077bf18165f7e2640ae6e1bc3b3d3d4c866a786d3658560e2a19f7fe8efcac881e056d6287eab4959583cdd53f5eb3c
-
SSDEEP
3072:O7CaO7x8fC8t52ojF+rKttHkoIIu6kfif20wNA:O7pON8ao5+wKodjkqfXC
Malware Config
Signatures
-
Gh0st RAT payload 3 IoCs
resource yara_rule behavioral1/files/0x000c000000016a9a-5.dat family_gh0strat behavioral1/files/0x000b000000014230-11.dat family_gh0strat behavioral1/memory/2684-12-0x0000000010000000-0x0000000010028000-memory.dmp family_gh0strat -
Deletes itself 1 IoCs
pid Process 2976 svchost.exe -
Loads dropped DLL 1 IoCs
pid Process 2976 svchost.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Uqrs\Aqrstuvwx.bmp 0398d731604fedfb679868be7526407c_JaffaCakes118.exe File created C:\Program Files (x86)\Uqrs\Aqrstuvwx.bmp 0398d731604fedfb679868be7526407c_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe 2976 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 2684 0398d731604fedfb679868be7526407c_JaffaCakes118.exe Token: SeRestorePrivilege 2684 0398d731604fedfb679868be7526407c_JaffaCakes118.exe Token: SeBackupPrivilege 2684 0398d731604fedfb679868be7526407c_JaffaCakes118.exe Token: SeRestorePrivilege 2684 0398d731604fedfb679868be7526407c_JaffaCakes118.exe Token: SeBackupPrivilege 2684 0398d731604fedfb679868be7526407c_JaffaCakes118.exe Token: SeRestorePrivilege 2684 0398d731604fedfb679868be7526407c_JaffaCakes118.exe Token: SeBackupPrivilege 2684 0398d731604fedfb679868be7526407c_JaffaCakes118.exe Token: SeRestorePrivilege 2684 0398d731604fedfb679868be7526407c_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0398d731604fedfb679868be7526407c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0398d731604fedfb679868be7526407c_JaffaCakes118.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2684
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Deletes itself
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2976
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
113KB
MD5c8bc6dabe1c652c3c7d5b1c4c908c284
SHA1595aba99850dad8299854fc4d65f21129cfd28b4
SHA256baf83946f64bf70ddad6d6eb459ce13f67678a33dd58f4318e9c9972453d45c0
SHA5126a3a0bd44a36c23f09623cd0c04da5b8032e67c1413acd88176b80a892419c4495548eb38cd791b08d451fab001ac72cdc40ada93431e497f6acedd828ebc64f
-
Filesize
4.9MB
MD5f9a03ecd3e9fda4ee098a1189b2dae39
SHA1e5f859a7b5bd71ebc0863a32f802a9275c6c6db1
SHA25614f48377a822403c6da9deff53cc1d7b1d2ce81da7d0ba640360f37318b974cc
SHA51238997f12e4a4842a2ce9a1df89745f4b03bb4fab8e12c61cb4ea2f4863ca6ba21f25ecd498f1531875b2cfe8262b9fb5d4da8284f858d5cae0432393d72b2512
-
Filesize
99B
MD54aece8f5905cb1ea4d31a7b5ea7d482b
SHA14e4116117f430f2c523040f15fa389ea7e66305e
SHA25654c0d754ce1f1eb9922827c4245d9c91d090d6943b12d059f8307d7c2fd4d525
SHA512aff04473291908943f493d348eb6a760f12ac2f9c18bec77cea2b8462d624d87bbca8e18f8f6a1d92a4d5a32772ec25b39e7eecf35b77f1bb964598e9f924c1e
