Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03/07/2024, 16:58
Behavioral task
behavioral1
Sample
231f50b83923b7c69c64b8f7956b2366_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
General
-
Target
231f50b83923b7c69c64b8f7956b2366_JaffaCakes118.exe
-
Size
127KB
-
MD5
231f50b83923b7c69c64b8f7956b2366
-
SHA1
1955c88ddbabe52f2944c731cbe0cbb5936d16ce
-
SHA256
d243a211ebe831e10ca35baaa2d24b49d119837c6b496e17681817087ecf89e3
-
SHA512
5eaf7f772087889effed7fd03aad9f5050aa5b1017a0a85bf25272b12943d6c0825c8138f3534b87baa707abf9aa9041a7adca62c2826b276949e32ed4732876
-
SSDEEP
3072:c7CaO7x8fC8t52ojM+rKttHkoIIu6kfif20wNA:c7pON8aoQ+wKodjkqfXC
Malware Config
Signatures
-
Gh0st RAT payload 2 IoCs
resource yara_rule behavioral2/files/0x0005000000023276-2.dat family_gh0strat behavioral2/files/0x000b0000000233fe-11.dat family_gh0strat -
Deletes itself 1 IoCs
pid Process 1012 svchost.exe -
Loads dropped DLL 2 IoCs
pid Process 372 231f50b83923b7c69c64b8f7956b2366_JaffaCakes118.exe 1012 svchost.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Rnop\Wnopqrstu.gif 231f50b83923b7c69c64b8f7956b2366_JaffaCakes118.exe File created C:\Program Files (x86)\Rnop\Wnopqrstu.gif 231f50b83923b7c69c64b8f7956b2366_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe 1012 svchost.exe -
Suspicious behavior: LoadsDriver 6 IoCs
pid Process 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 664 Process not Found -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 372 231f50b83923b7c69c64b8f7956b2366_JaffaCakes118.exe Token: SeRestorePrivilege 372 231f50b83923b7c69c64b8f7956b2366_JaffaCakes118.exe Token: SeBackupPrivilege 372 231f50b83923b7c69c64b8f7956b2366_JaffaCakes118.exe Token: SeRestorePrivilege 372 231f50b83923b7c69c64b8f7956b2366_JaffaCakes118.exe Token: SeBackupPrivilege 372 231f50b83923b7c69c64b8f7956b2366_JaffaCakes118.exe Token: SeRestorePrivilege 372 231f50b83923b7c69c64b8f7956b2366_JaffaCakes118.exe Token: SeBackupPrivilege 372 231f50b83923b7c69c64b8f7956b2366_JaffaCakes118.exe Token: SeRestorePrivilege 372 231f50b83923b7c69c64b8f7956b2366_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\231f50b83923b7c69c64b8f7956b2366_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\231f50b83923b7c69c64b8f7956b2366_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:372
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Deletes itself
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1012
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
113KB
MD57fbf87f4662b6841630613923920cb58
SHA163398a99546b56d53c4db059e0141b71377d998a
SHA25637086ee6b810b23b6e7786ea804acbd36604dfde5eaae406c219bffffd1f06d9
SHA512aab6055dc1c9380ce63e601dc49f80c0e63179d78a258d6b8e73940459556060755fbfa42f0e11cd498e60fa1bc3d0e44953875ac1f2455fb1339e9fb193fb5f
-
Filesize
99B
MD5b6c9854afcde789f0df40df2765e1879
SHA10bdb5d01ee42252dfa6207e7cc6defb8f9574f2d
SHA2561d7191a00e31d295562b49285f6b7dd04dffef88834690a3e1a1153e2e9a9c14
SHA5128564b25582b035d26b924914aac1e25ec73dead299cb9c45539a2081c3e710a8a3db4fcddd1e88a33a70b64210b0e620f39d76800c230c7b7694589027d2a554
-
Filesize
17.9MB
MD523fd9457dfe062a42d0eb38bce2b1edd
SHA19c999dea2ab9336028fdf7467462697a33771719
SHA25670a026d46657003bcc1d86ddb13484e93ab972a812d67eb7260d5fe924a6497a
SHA5128254df7288610aba148a23dc758e7d4ed33a44d7646ac3395bb7676584d1354e21642e59f364a14801845efddeee8c53dc370e013c2a5c07d23c808351f9f0ab
