Analysis
-
max time kernel
51s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
28/06/2024, 11:08
General
-
Target
19e4e80e460be21c65b4f9c301e3f496_JaffaCakes118.exe
-
Size
622KB
-
MD5
19e4e80e460be21c65b4f9c301e3f496
-
SHA1
70924dbf4df9f1a8f6fa71c4e3c32396af96b1ea
-
SHA256
ddc4229965026aa9924993a918d2f9714eef2653e63177ee0d55eab29263e229
-
SHA512
02b83f7f6b577e533c46dece2a4c985cc809d24eeea8fb385984558eabf38a0aa6efa09393907e673a6f795bf206aaa2ee67e99c0c8afa3260cfdf537b32cd39
-
SSDEEP
12288:ejx8N1mIf52F3Z4mxxzDqVTVOCFcYHwpC:etWDcQmXaVTzFcYHx
Malware Config
Signatures
-
Gh0st RAT payload 5 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Drops file in Drivers directory 2 IoCs
-
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Drops file in System32 directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\19e4e80e460be21c65b4f9c301e3f496_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\19e4e80e460be21c65b4f9c301e3f496_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\temp.exe"C:\Users\Admin\AppData\Local\Temp\temp.exe"2⤵
- Drops file in Drivers directory
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s FastUserSwitchingCompatibility1⤵
- Drops file in Drivers directory
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
95KB
MD58a416eb17fc2c3e3f6e593cd2b8a0722
SHA1e36e61e0ecc7c0fdfb0cb863c248d8fd159a0f00
SHA25676900af9d55d26062de3903ed69f7fc0897fdc32ea0a87aece9e9f98f0f6edcd
SHA512aa27bede562ab4b361a3dd74de82d66d082312d3097834d92d7743d1b25c4261a1ba4e2b7359687694ed193ff0b426d4c9a8fc47f1ea21fd491d53c6e2e6a5d1
-
Filesize
113KB
MD5137ed378b55aa82249626bec609d6464
SHA186c6a4c72b1c0e42d99a12be54c0659d3d62acc5
SHA2560cc74640135237eeb16d31f80f41579a06be7207089bdd1c8bd1e5509fc2cb98
SHA51239ff6fe64b05ad87b4e2d1229a7d8c199c4ccf5135662e4e26e03fde0b4cf09c67f2a44ab94e72758faf8c103318bc571c387e831a8f55438360ed9b7a6ab09c
-
Filesize
42B
MD5560394dc7eb02789d863178d97329fdf
SHA133e11f1297ede2403116511119f408a68524b535
SHA2565834971e6c1d68456512c113bb0bf55ba66f2ab5d57411ca92e975a2880ddfa5
SHA51231a8b3e1ed8df34fa54f78fa2b7f7d00e3ea1a398eff357ac4cba3cfebeff92626cc999fae5b3eb0efeda712d791537193b5f6815fb300cea81533e950801502
-
Filesize
95KB
MD54faa094f85729f88e410e4486f5d5b04
SHA1d3636b488018078edd33ddcf115be6ed260ddacf
SHA256bf0e3ea3a39a3fe72d30b808ea5e2f16e038ae83ad46446382303474e7d7374e
SHA5128c7cb823b6ae65f05c274cca007ab46f8995b7c7c60a845d2143018bd255d24856c8a250be7cf74c41d7d25a6dca732f3087d32ec3bee9dbb3f252d7f975daf8
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
16KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
772KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
772KB
-
Filesize
336KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
336KB