gh0strat | 90cc29404dba04fa8a402bd18b5be2a02b19f29cd8194daef80649b7ae60cd4c

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 03:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

378dea62d9b740eb7e13f87b30f8052e_JaffaCakes118.exe
Size

188KB
MD5

378dea62d9b740eb7e13f87b30f8052e
SHA1

74b22a2e4bfe354263474d13001bc89f5e39516d
SHA256

90cc29404dba04fa8a402bd18b5be2a02b19f29cd8194daef80649b7ae60cd4c
SHA512

69de173ba6b5b6dd1a26824bb3357f2edce1b29912cc0a142043351a2f51c879a01414e9fa3da75083f4ffc721c1f9d4b6a117f8365330645c005bb9de1824a7
SSDEEP

3072:5CYA3E4SdT7k26KCAtJfYejUwRH+mbggsS6ouq:5C73EbdTI29CAtBNUwR2PSDu

Score

10^/10

gh0strat bootkit persistence rat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/files/0x0032000000014fa6-2.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Deletes itself 1 IoCs

pid	Process
2624	svchost.exe

Loads dropped DLL 1 IoCs

pid	Process
2624	svchost.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\qrcuqgofeq	svchost.exe
File created	C:\Windows\SysWOW64\qapoyjqdrm	svchost.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum\Version = "7"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum	svchost.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2624	svchost.exe
2624	svchost.exe
2624	svchost.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeBackupPrivilege	2896	378dea62d9b740eb7e13f87b30f8052e_JaffaCakes118.exe
Token: SeRestorePrivilege	2896	378dea62d9b740eb7e13f87b30f8052e_JaffaCakes118.exe
Token: SeBackupPrivilege	2624	svchost.exe
Token: SeSecurityPrivilege	2624	svchost.exe
Token: SeBackupPrivilege	2624	svchost.exe
Token: SeRestorePrivilege	2624	svchost.exe
Token: SeSecurityPrivilege	2624	svchost.exe
Token: SeBackupPrivilege	2624	svchost.exe
Token: SeBackupPrivilege	2624	svchost.exe
Token: SeSecurityPrivilege	2624	svchost.exe
Token: SeBackupPrivilege	2624	svchost.exe
Token: SeBackupPrivilege	2624	svchost.exe
Token: SeSecurityPrivilege	2624	svchost.exe
Token: SeBackupPrivilege	2624	svchost.exe
Token: SeRestorePrivilege	2624	svchost.exe

C:\Users\Admin\AppData\Local\Temp\378dea62d9b740eb7e13f87b30f8052e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\378dea62d9b740eb7e13f87b30f8052e_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2896

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Deletes itself
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\users\admin\applic~1\dvdmc\rtxps.lib

Filesize
1.1MB

MD5
a690e6166b4e2ae8ca9d0d42b7f4a50f

SHA1
299009f0b55117d896a1442e5f093d97a8f04977

SHA256
899bba14fa0af8377b54ea5b8ff47d18d83af8d4e70143ec7c45db15d96d355d

SHA512
e8dbc93ff991f4641a04ca37aed9bcfcb7f05a748e3117c2e40e7ea1442681cd52dd2d26ec523c7f7003a76c2f1816c98fe0e28f1cfcd9f0c8b399611ca0abe0

Download Submit