Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
09/07/2024, 05:35
Behavioral task
behavioral1
Sample
2f26c45c94db662d2a3367c3fd54e6c1_JaffaCakes118.dll
Resource
win7-20240704-en
windows7-x64
7 signatures
150 seconds
General
-
Target
2f26c45c94db662d2a3367c3fd54e6c1_JaffaCakes118.dll
-
Size
124KB
-
MD5
2f26c45c94db662d2a3367c3fd54e6c1
-
SHA1
8f12faba5382ee0bda866285639e0366b1bb8e53
-
SHA256
a9b2d91e662639b93aa7c2e56327e9971cb0fe2fd94d14b35e29cdefd7822658
-
SHA512
5feeb153c9190c47e83c9a63ad947023a640a0d86f4ebdf36221edfbde01f6053c073d70b44c8b147c7502ca7bd2e6ccb21411c4bcc9ba192603dc430b54998f
-
SSDEEP
3072:Bzk9z4Uh+yQAbAbu7NWtMpebimeN7kgMwli/:uDTQAbbMbxg7kVwl
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral1/files/0x000c000000016d66-3.dat family_gh0strat -
Loads dropped DLL 1 IoCs
pid Process 1096 svchost.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Jmlv\Pdkuqiwmo.jpg rundll32.exe File created C:\Program Files (x86)\Jmlv\Pdkuqiwmo.jpg rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe 1096 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 2444 rundll32.exe Token: SeRestorePrivilege 2444 rundll32.exe Token: SeBackupPrivilege 2444 rundll32.exe Token: SeRestorePrivilege 2444 rundll32.exe Token: SeBackupPrivilege 2444 rundll32.exe Token: SeRestorePrivilege 2444 rundll32.exe Token: SeBackupPrivilege 2444 rundll32.exe Token: SeRestorePrivilege 2444 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2448 wrote to memory of 2444 2448 rundll32.exe 30 PID 2448 wrote to memory of 2444 2448 rundll32.exe 30 PID 2448 wrote to memory of 2444 2448 rundll32.exe 30 PID 2448 wrote to memory of 2444 2448 rundll32.exe 30 PID 2448 wrote to memory of 2444 2448 rundll32.exe 30 PID 2448 wrote to memory of 2444 2448 rundll32.exe 30 PID 2448 wrote to memory of 2444 2448 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f26c45c94db662d2a3367c3fd54e6c1_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f26c45c94db662d2a3367c3fd54e6c1_JaffaCakes118.dll,#12⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2444
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1096
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9.7MB
MD566c2634143d6ccfe8e8e2ab1dfc03756
SHA1b4c147700630be3550410b161a28cba00ac56808
SHA25600e77f9824fb568003e8f3acfa71c51803256b46e90696cec8edf031f1b1d4b4
SHA512438d8c44f43eec08957deeae06bc5a7156b208f8b6237ca5e1d5a04b50a57f120077d9c413492faa66ee2dce2077a8dec11034ea7101f4e844de555d7151d9c8
