Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
27/06/2024, 23:48
Behavioral task
behavioral1
Sample
18007ebfa88f13515e9c0c6e342652d6_JaffaCakes118.exe
Resource
win7-20240611-en
windows7-x64
General
-
Target
18007ebfa88f13515e9c0c6e342652d6_JaffaCakes118.exe
-
Size
144KB
-
MD5
18007ebfa88f13515e9c0c6e342652d6
-
SHA1
3ebd007660b73f2385e587a64ea1ae55a3799206
-
SHA256
289af2132a4e26d0178127ee799c3afdcc76f2c9aa61bd817dfb42c1728dee21
-
SHA512
b04b3c7b525f2b397b634e969b56b213763b953e31563b0730bc163bccb59db7dba400f5f6c2ab99358dcb7e32c3b322dc5146ecfcfb1f16614ab316d041aa9c
-
SSDEEP
3072:cmggJXDFNoz9lRZCJogwY1tnkv1Y67KrUVPJoZWWRZanAmst:cyuz9XgJpwY1Z8YcSUVyZWWXDD
Malware Config
Signatures
-
Gh0st RAT payload 4 IoCs
resource yara_rule behavioral1/files/0x0048000000014651-5.dat family_gh0strat behavioral1/memory/2344-9-0x0000000010000000-0x0000000010024000-memory.dmp family_gh0strat behavioral1/files/0x000500000000b309-11.dat family_gh0strat behavioral1/memory/2056-12-0x0000000010000000-0x0000000010024000-memory.dmp family_gh0strat -
Deletes itself 1 IoCs
pid Process 2056 svchost.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\FileName.jpg 18007ebfa88f13515e9c0c6e342652d6_JaffaCakes118.exe File created C:\Windows\FileName.jpg 18007ebfa88f13515e9c0c6e342652d6_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe 2056 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 2344 18007ebfa88f13515e9c0c6e342652d6_JaffaCakes118.exe Token: SeRestorePrivilege 2344 18007ebfa88f13515e9c0c6e342652d6_JaffaCakes118.exe Token: SeBackupPrivilege 2344 18007ebfa88f13515e9c0c6e342652d6_JaffaCakes118.exe Token: SeRestorePrivilege 2344 18007ebfa88f13515e9c0c6e342652d6_JaffaCakes118.exe Token: SeBackupPrivilege 2344 18007ebfa88f13515e9c0c6e342652d6_JaffaCakes118.exe Token: SeRestorePrivilege 2344 18007ebfa88f13515e9c0c6e342652d6_JaffaCakes118.exe Token: SeBackupPrivilege 2344 18007ebfa88f13515e9c0c6e342652d6_JaffaCakes118.exe Token: SeRestorePrivilege 2344 18007ebfa88f13515e9c0c6e342652d6_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\18007ebfa88f13515e9c0c6e342652d6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\18007ebfa88f13515e9c0c6e342652d6_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2344
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
PID:2056
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
127KB
MD52ea11f18ede3b4970adb223dfc70a52e
SHA1dda11f74c1ef67fa6e293c72e10370c8d78c98c4
SHA256857fb383ece98712de558b8e3bb03aa96ef9ed846a8ec08ec4eea20237b98ce4
SHA512b86b1a14c76fe9b2af33e0a44b4ab2eae10a13755228cb8d7856be8413149e55bf0c1a89e3066bb6381f13272ffad402b1587127eeeb6dff905bcee540a15724
-
Filesize
14.1MB
MD5e50bde91cbcb2e7e21d1ae77731031d9
SHA16e22f7805c3a93f63219fc2d131ac218b4dc009c
SHA25656b34350311c5646f50e02ae15c91863f1a3453e3395899feb33adc28d59d4bf
SHA512694499ff5d294cef35f5a176a56a155491ee38c58e90edfe2f5c0018347048a776337e4722ac9711215f2e0b2ba9d9491fdfbdd13b3f0def2a00641d2e6a0e1c
-
Filesize
99B
MD5ba40ef4e4a58d7af0e59ef6bd7ec9a33
SHA1c394916de16bcbf2540c2bba488ca9c08bb7bc69
SHA256c0fad946c78ea1994d54628109fe63b043d6321d2a9922acf414ce4191bb7682
SHA512b1f584f9d2ac496ec1f01c2a4b45948ccbc45c0c4c2e8e2d71b21b75e03395c0170f0e2ab4aad9df28c276e095e017672a475b4a46eb1963dcef7201b6e4da7c
