Analysis
-
max time kernel
148s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
04/07/2024, 17:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe
Resource
win7-20240611-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe
-
Size
136KB
-
MD5
259fdb83f71b42449106b1c196a688c9
-
SHA1
67b7f7cc32f6cde17375119d62111d01f8336bcd
-
SHA256
331da6d9d5d651b9ae582106e4293ad84621f30c93f0551a44015a86a0b42957
-
SHA512
dd24aa1718eab2d02b6dac943ebc8e5e38853053e95c8036181203a0567ebf2ef50e31465db07eef626627b05cc2852a0d18394294e309c3b81c6c51c67fa736
-
SSDEEP
1536:HsOdzeCT5L27tvVBAJ1mcnHnmKaQRmcGCvC9p6bm++RpiY64vKDlh+sWLvvunY7v:MOd6CT5C7/gGKaQRlGCZHYWDSknSQ+
Score
10/10
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral1/files/0x000500000000b309-6.dat family_gh0strat -
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\xxiaoxiliushui\Parameters\ServiceDll = "C:\\Windows\\system32\\ntf76079fz.dll" 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe -
Deletes itself 1 IoCs
pid Process 2440 cmd.exe -
Loads dropped DLL 6 IoCs
pid Process 2516 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe 636 svchost.exe 808 rundll32.exe 808 rundll32.exe 808 rundll32.exe 808 rundll32.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\ntf76079fz.dll 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\RCX8F6.tmp 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe -
Modifies registry class 63 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Xxxxxx.Document\protocol\StdFileEditing\verb\0\ = "&Edit" 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\AuxUserType\2 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\Printable 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Xxxxxx.Document 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Xxxxxx.Document\shell\printto\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\259FDB~1.EXE /pt \"%1\" \"%2\" \"%3\" \"%4\"" 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\Verb\0 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\Verb 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\ProgID 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Xxxxxx.Document\ = "Xxxxxx Document" 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\259FDB~1.EXE,0" 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\MiscStatus 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Xxxxxx.Document\protocol 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\Insertable 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Xxxxxx.Document\protocol\StdFileEditing\server\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\259FDB~1.EXE" 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\DefaultExtension\ = ".zzdfg, Xxxxxx Files (*.zzdfg)" 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Xxxxxx.Document\shell\open\command 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Xxxxxx.Document\Insertable 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0} 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\DefaultExtension 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Xxxxxx.Document\shell\print\command 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\Verb\0\ = "&Edit,0,2" 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\AuxUserType\3\ = "xxxxxx" 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Xxxxxx.Document\DocObject 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\ProgID\ = "Xxxxxx.Document" 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\InprocHandler32 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Xxxxxx.Document\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\259FDB~1.EXE \"%1\"" 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.zzdfg\ = "Xxxxxx.Document" 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Xxxxxx.Document\protocol\StdFileEditing 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\AuxUserType\3 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Xxxxxx.Document\protocol\StdFileEditing\server 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Xxxxxx.Document\shell 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Xxxxxx.Document\protocol\StdFileEditing\verb\0 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\Verb\1\ = "&Open,0,2" 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\Insertable\ 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\259FDB~1.EXE" 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Xxxxxx.Document\shell\open 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Xxxxxx.Document\CLSID 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Xxxxxx.Document\Insertable\ 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.zzdfg\ShellNew 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.zzdfg\ShellNew\NullFile 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\Verb\1 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\AuxUserType 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\DocObject 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Xxxxxx.Document\DocObject\ = "0" 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Xxxxxx.Document\shell\printto\command 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\MiscStatus\ = "32" 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\LocalServer32 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Xxxxxx.Document\shell\print 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.zzdfg 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Xxxxxx.Document\CLSID\ = "{E3465516-F150-4B40-B923-19A0A3E123F0}" 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Xxxxxx.Document\DefaultIcon 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\AuxUserType\2\ = "Xxxxxx" 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\DocObject\ = "0" 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\InprocHandler32\ = "ole32.dll" 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Xxxxxx.Document\protocol\StdFileEditing\verb 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\DefaultIcon 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Xxxxxx.Document\shell\printto 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Xxxxxx.Document\shell\print\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\259FDB~1.EXE /p \"%1\"" 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\ = "Xxxxxx Document" 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\Printable\ 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Xxxxxx.Document\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\259FDB~1.EXE,0" 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 45 IoCs
pid Process 808 rundll32.exe 808 rundll32.exe 808 rundll32.exe 808 rundll32.exe 808 rundll32.exe 808 rundll32.exe 808 rundll32.exe 808 rundll32.exe 808 rundll32.exe 808 rundll32.exe 808 rundll32.exe 808 rundll32.exe 808 rundll32.exe 808 rundll32.exe 808 rundll32.exe 808 rundll32.exe 808 rundll32.exe 808 rundll32.exe 808 rundll32.exe 808 rundll32.exe 808 rundll32.exe 808 rundll32.exe 808 rundll32.exe 808 rundll32.exe 808 rundll32.exe 808 rundll32.exe 808 rundll32.exe 808 rundll32.exe 808 rundll32.exe 808 rundll32.exe 808 rundll32.exe 808 rundll32.exe 808 rundll32.exe 808 rundll32.exe 808 rundll32.exe 808 rundll32.exe 808 rundll32.exe 808 rundll32.exe 808 rundll32.exe 808 rundll32.exe 808 rundll32.exe 808 rundll32.exe 808 rundll32.exe 808 rundll32.exe 808 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 636 svchost.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2516 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe 2516 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2516 wrote to memory of 2440 2516 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe 29 PID 2516 wrote to memory of 2440 2516 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe 29 PID 2516 wrote to memory of 2440 2516 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe 29 PID 2516 wrote to memory of 2440 2516 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe 29 PID 636 wrote to memory of 808 636 svchost.exe 31 PID 636 wrote to memory of 808 636 svchost.exe 31 PID 636 wrote to memory of 808 636 svchost.exe 31 PID 636 wrote to memory of 808 636 svchost.exe 31 PID 636 wrote to memory of 808 636 svchost.exe 31 PID 636 wrote to memory of 808 636 svchost.exe 31 PID 636 wrote to memory of 808 636 svchost.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe"1⤵
- Server Software Component: Terminal Services DLL
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\SysWOW64\cmd.execmd /c del "C:\Users\Admin\AppData\Local\Temp\259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe"2⤵
- Deletes itself
PID:2440
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "xxiaoxiliushui"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe c:\windows\system32\ntf76079fz.dll, abcd2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:808
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD5b1d2cc9077668a5e69bb89d44c0d0984
SHA1fdfca063c30058cbcb72ce56e9c2e68e8baa388b
SHA256539d4cfc5b67a628f40291351223f66738e58da8aa966779888a52c848aeef42
SHA51234894438c34bf51096db037cc7b34d11f6fa4db409c7fb3af001ec47f9bc7175c39b4e49273408bc8a06a43f05c23214c0067aa958f35b3c1a82b6b9331f004d