Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
-
submitted
27/06/2024, 12:45 UTC
General
-
Target
160f0df132f7ef72bb0925d66fc9fc7f_JaffaCakes118.exe
-
Size
96KB
-
MD5
160f0df132f7ef72bb0925d66fc9fc7f
-
SHA1
508c55d6ff391df0b4e4efdd7786bdaffd10a23d
-
SHA256
5d176047bf863b5efbc3da771af58acba1a59f933807aec5bc0929e71822e7a8
-
SHA512
15c764d6aca16fcb01d8fbe8a9a3944643ada7a739a9fab1102729451e49efbb3750b8fd258fd96fad5b786ff93aa6c89b0bde0d0f8e4e12ee29af9973d6cf6e
-
SSDEEP
1536:8uFusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8przeoobQdbNcO0sJ:8US4jHS8q/3nTzePCwNUh4E9zeoVPWsJ
Malware Config
Signatures
-
Gh0st RAT payload 4 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory 1 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 6 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 18 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\160f0df132f7ef72bb0925d66fc9fc7f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\160f0df132f7ef72bb0925d66fc9fc7f_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\hncrnfktpv"C:\Users\Admin\AppData\Local\Temp\160f0df132f7ef72bb0925d66fc9fc7f_JaffaCakes118.exe" a -sc:\users\admin\appdata\local\temp\160f0df132f7ef72bb0925d66fc9fc7f_jaffacakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
-
DNSbibo9.8800.orgRemote address:8.8.8.8:53Requestbibo9.8800.orgIN AResponsebibo9.8800.orgIN A59.24.3.174 -
DNSconf.f.360.cnRemote address:8.8.8.8:53Requestconf.f.360.cnIN AResponseconf.f.360.cnIN CNAMEconf.f.qh-lb.comconf.f.qh-lb.comIN A180.163.222.151conf.f.qh-lb.comIN A180.163.243.109
-
DNSbibo9.8800.orgRemote address:8.8.8.8:53Requestbibo9.8800.orgIN AResponsebibo9.8800.orgIN A93.46.8.90
-
59.24.3.174:889bibo9.8800.org -
93.46.8.90:889bibo9.8800.org
-
8.8.8.8:53bibo9.8800.orgdns
DNS Request
bibo9.8800.org
DNS Response
59.24.3.174
-
8.8.8.8:53conf.f.360.cndns
DNS Request
conf.f.360.cn
DNS Response
180.163.222.151180.163.243.109
-
8.8.8.8:53bibo9.8800.orgdns
DNS Request
bibo9.8800.org
DNS Response
93.46.8.90
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20.0MB
MD52751caf1130dd296ebc2fbd054203bde
SHA1317ba0cdf0a01be6a12578e7f2c6d7820174fc42
SHA25642c683c1c6a59bc5b018abf70f79dcfa5300cfaab3f65f4c3f4184cf9c21d7fc
SHA51259eb05773a0789650a29f863f9edcce27641ac4752b46e7fbff949fbf8b6f0176ed13742d1e611cf08c1cf7f6fc76014db7ab558085a4a1594cc0dc6b23c343d
-
Filesize
23.4MB
MD5c9d25b27b24056c1d85a4b47b7ad6bec
SHA1e0658f61f37a7b6a39edcc22508b7c5aa5b2e7c8
SHA2568fcc11c16e9b58f528304bb5d60186658e1ad697b3080f314d04daa15df1c66c
SHA512eb4cae0074c8fce316c363e1c5d14bea810a925eef8c5c77cd55441aebdb7544a1ba070fbdc4f9bd3aefb7710a3db3c892a15ff13ce3dbcf5b1e2ceef8744b5d
-
Filesize
4KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
4KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
4KB
-
Filesize
312KB
-
Filesize
316KB
-
Filesize
312KB