Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03/07/2024, 16:26
Behavioral task
behavioral1
Sample
230876a57d507995553887fa1c603e14_JaffaCakes118.exe
Resource
win7-20240611-en
windows7-x64
General
-
Target
230876a57d507995553887fa1c603e14_JaffaCakes118.exe
-
Size
127KB
-
MD5
230876a57d507995553887fa1c603e14
-
SHA1
3a2ae4d54f6ff85dad52267005c4dc09b4fc3c6e
-
SHA256
cc0f7546d28bb46aa072e1a94e75221a8d00244cfa53b4afc9a0217d9da3395b
-
SHA512
c2eddefd1f3d98d339c6141cea4564d8841cc99fa9166d39c38ec35f10316f6e3c54bbe1102ed9196dc5dadbe980976edcde98d0239afae2e41d9b6301d0aea8
-
SSDEEP
3072:V7CaO7x8fC8t52oja+rKttHkoIIu6kfif20wNA:V7pON8ao++wKodjkqfXC
Malware Config
Signatures
-
Gh0st RAT payload 2 IoCs
resource yara_rule behavioral2/files/0x000700000002328e-2.dat family_gh0strat behavioral2/files/0x000b0000000233ff-11.dat family_gh0strat -
Deletes itself 1 IoCs
pid Process 4044 svchost.exe -
Loads dropped DLL 2 IoCs
pid Process 1260 230876a57d507995553887fa1c603e14_JaffaCakes118.exe 4044 svchost.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Fbcd\Kbcdefghi.gif 230876a57d507995553887fa1c603e14_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Fbcd\Kbcdefghi.gif 230876a57d507995553887fa1c603e14_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe 4044 svchost.exe -
Suspicious behavior: LoadsDriver 6 IoCs
pid Process 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 656 Process not Found -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 1260 230876a57d507995553887fa1c603e14_JaffaCakes118.exe Token: SeRestorePrivilege 1260 230876a57d507995553887fa1c603e14_JaffaCakes118.exe Token: SeBackupPrivilege 1260 230876a57d507995553887fa1c603e14_JaffaCakes118.exe Token: SeRestorePrivilege 1260 230876a57d507995553887fa1c603e14_JaffaCakes118.exe Token: SeBackupPrivilege 1260 230876a57d507995553887fa1c603e14_JaffaCakes118.exe Token: SeRestorePrivilege 1260 230876a57d507995553887fa1c603e14_JaffaCakes118.exe Token: SeBackupPrivilege 1260 230876a57d507995553887fa1c603e14_JaffaCakes118.exe Token: SeRestorePrivilege 1260 230876a57d507995553887fa1c603e14_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\230876a57d507995553887fa1c603e14_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\230876a57d507995553887fa1c603e14_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1260
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Deletes itself
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4044
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
113KB
MD5ebb95c2321e080ee885ef60136aa8fa7
SHA19c89d4b106bb1d7979cc7731efbbee8f3d1ecdc6
SHA256bd6d2d2eb70370b70e94fc49278dee3815bf1589ee2c1bdc7fc0d34bd9b7600c
SHA512e331597f895506b72fc9ef3f694391d084e1daf97bc7b0d9c8e61618fe6694c599ca910156d3965956e00e2fd670752ab9ecc2054f0fc0626a3914594f35d5b8
-
Filesize
99B
MD5d20129d050359b23536cc3bc5498de4c
SHA19bd54efd1549905bad130b8ebc80ae90f22fbbaa
SHA256c288e7cabe4679a8de4522daf3fb5f97f4e92ca8a3e25a5fd7172af562f13eb6
SHA51204120ac5c19bf4b7a898f06d143cc380fd3d34dd9bf82fd44e5fb2b6db816dbf22c3a93ae8ecd430069492aaba8b502f0a1ba89c2f3015cf96091e7a951c33c0
-
Filesize
9.8MB
MD5f1709f8254b343bc761ec651135c9856
SHA1233f53fbe33a71261792789a249019936d2c41d1
SHA2563bf5fdc989d818f0b84d79420814ef30f8ff95c307b0ea2eefccb2881a35c0a5
SHA512f273c33d852353f7be393970f096f64c7deabfcef450bf68df052e62c5f926119f094052bd962ad9cdeed0cfaac3c8e843bd1100a9803abcced089dfcbecaf95
