Analysis
-
max time kernel
148s -
max time network
54s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04-07-2024 17:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe
Resource
win7-20240611-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe
-
Size
136KB
-
MD5
259fdb83f71b42449106b1c196a688c9
-
SHA1
67b7f7cc32f6cde17375119d62111d01f8336bcd
-
SHA256
331da6d9d5d651b9ae582106e4293ad84621f30c93f0551a44015a86a0b42957
-
SHA512
dd24aa1718eab2d02b6dac943ebc8e5e38853053e95c8036181203a0567ebf2ef50e31465db07eef626627b05cc2852a0d18394294e309c3b81c6c51c67fa736
-
SSDEEP
1536:HsOdzeCT5L27tvVBAJ1mcnHnmKaQRmcGCvC9p6bm++RpiY64vKDlh+sWLvvunY7v:MOd6CT5C7/gGKaQRlGCZHYWDSknSQ+
Score
10/10
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x0008000000022f51-6.dat family_gh0strat -
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\xxiaoxiliushui\Parameters\ServiceDll = "C:\\Windows\\system32\\nte574c5bz.dll" 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe -
Loads dropped DLL 3 IoCs
pid Process 1884 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe 744 svchost.exe 1204 rundll32.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\RCX4DA3.tmp 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe File created C:\Windows\SysWOW64\nte574c5bz.dll 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe -
Modifies registry class 63 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\259FDB~1.EXE,0" 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Xxxxxx.Document\CLSID\ = "{E3465516-F150-4B40-B923-19A0A3E123F0}" 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Xxxxxx.Document\shell\print\command 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\Verb\0 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\LocalServer32 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\DefaultIcon 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Xxxxxx.Document\shell\print 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Xxxxxx.Document\shell\printto\command 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Xxxxxx.Document\shell\printto\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\259FDB~1.EXE /pt \"%1\" \"%2\" \"%3\" \"%4\"" 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Xxxxxx.Document\protocol\StdFileEditing\verb 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\Verb 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\AuxUserType\3 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\Printable\ 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Xxxxxx.Document\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\259FDB~1.EXE \"%1\"" 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\Printable 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\259FDB~1.EXE" 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\DefaultExtension\ = ".zzdfg, Xxxxxx Files (*.zzdfg)" 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Xxxxxx.Document\protocol\StdFileEditing\verb\0\ = "&Edit" 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Xxxxxx.Document\shell 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Xxxxxx.Document\protocol\StdFileEditing\verb\0 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Xxxxxx.Document\DocObject\ = "0" 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Xxxxxx.Document\CLSID 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Xxxxxx.Document\protocol\StdFileEditing\server 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Xxxxxx.Document\ = "Xxxxxx Document" 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\DocObject 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Xxxxxx.Document\shell\print\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\259FDB~1.EXE /p \"%1\"" 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\Verb\1 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\Insertable\ 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Xxxxxx.Document\shell\open 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0} 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\ = "Xxxxxx Document" 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\MiscStatus 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.zzdfg\ShellNew\NullFile 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\ProgID\ = "Xxxxxx.Document" 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Xxxxxx.Document 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.zzdfg\ = "Xxxxxx.Document" 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Xxxxxx.Document\Insertable 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Xxxxxx.Document\Insertable\ 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Xxxxxx.Document\protocol\StdFileEditing 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\InprocHandler32 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Xxxxxx.Document\shell\open\command 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.zzdfg 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.zzdfg\ShellNew 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\Insertable 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\AuxUserType 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\AuxUserType\3\ = "xxxxxx" 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\InprocHandler32\ = "ole32.dll" 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Xxxxxx.Document\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\259FDB~1.EXE,0" 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\Verb\1\ = "&Open,0,2" 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\DocObject\ = "0" 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\DefaultExtension 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Xxxxxx.Document\DefaultIcon 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\AuxUserType\2 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Xxxxxx.Document\protocol\StdFileEditing\server\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\259FDB~1.EXE" 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Xxxxxx.Document\shell\printto 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\Verb\0\ = "&Edit,0,2" 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\AuxUserType\2\ = "Xxxxxx" 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\MiscStatus\ = "32" 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Xxxxxx.Document\DocObject 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E3465516-F150-4B40-B923-19A0A3E123F0}\ProgID 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Xxxxxx.Document\protocol 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe 1204 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 744 svchost.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1884 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe 1884 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1884 wrote to memory of 1528 1884 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe 82 PID 1884 wrote to memory of 1528 1884 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe 82 PID 1884 wrote to memory of 1528 1884 259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe 82 PID 744 wrote to memory of 1204 744 svchost.exe 84 PID 744 wrote to memory of 1204 744 svchost.exe 84 PID 744 wrote to memory of 1204 744 svchost.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe"1⤵
- Server Software Component: Terminal Services DLL
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Windows\SysWOW64\cmd.execmd /c del "C:\Users\Admin\AppData\Local\Temp\259fdb83f71b42449106b1c196a688c9_JaffaCakes118.exe"2⤵PID:1528
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "xxiaoxiliushui"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe c:\windows\system32\nte574c5bz.dll, abcd2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1204
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD5b1d2cc9077668a5e69bb89d44c0d0984
SHA1fdfca063c30058cbcb72ce56e9c2e68e8baa388b
SHA256539d4cfc5b67a628f40291351223f66738e58da8aa966779888a52c848aeef42
SHA51234894438c34bf51096db037cc7b34d11f6fa4db409c7fb3af001ec47f9bc7175c39b4e49273408bc8a06a43f05c23214c0067aa958f35b3c1a82b6b9331f004d