gh0strat | 90cc29404dba04fa8a402bd18b5be2a02b19f29cd8194daef80649b7ae60cd4c

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11/07/2024, 03:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

378dea62d9b740eb7e13f87b30f8052e_JaffaCakes118.exe
Size

188KB
MD5

378dea62d9b740eb7e13f87b30f8052e
SHA1

74b22a2e4bfe354263474d13001bc89f5e39516d
SHA256

90cc29404dba04fa8a402bd18b5be2a02b19f29cd8194daef80649b7ae60cd4c
SHA512

69de173ba6b5b6dd1a26824bb3357f2edce1b29912cc0a142043351a2f51c879a01414e9fa3da75083f4ffc721c1f9d4b6a117f8365330645c005bb9de1824a7
SSDEEP

3072:5CYA3E4SdT7k26KCAtJfYejUwRH+mbggsS6ouq:5C73EbdTI29CAtBNUwR2PSDu

Score

10^/10

gh0strat bootkit persistence rat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral2/files/0x00090000000234ad-2.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Deletes itself 1 IoCs

pid	Process
1216	svchost.exe

Loads dropped DLL 1 IoCs

pid	Process
1216	svchost.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	svchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\qjncidmhrv	svchost.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7"	svchost.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1216	svchost.exe
1216	svchost.exe
1216	svchost.exe
1216	svchost.exe
1216	svchost.exe
1216	svchost.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeBackupPrivilege	4652	378dea62d9b740eb7e13f87b30f8052e_JaffaCakes118.exe
Token: SeRestorePrivilege	4652	378dea62d9b740eb7e13f87b30f8052e_JaffaCakes118.exe
Token: SeBackupPrivilege	1216	svchost.exe
Token: SeRestorePrivilege	1216	svchost.exe
Token: SeBackupPrivilege	1216	svchost.exe
Token: SeBackupPrivilege	1216	svchost.exe
Token: SeSecurityPrivilege	1216	svchost.exe
Token: SeSecurityPrivilege	1216	svchost.exe
Token: SeBackupPrivilege	1216	svchost.exe
Token: SeBackupPrivilege	1216	svchost.exe
Token: SeSecurityPrivilege	1216	svchost.exe
Token: SeBackupPrivilege	1216	svchost.exe
Token: SeBackupPrivilege	1216	svchost.exe
Token: SeSecurityPrivilege	1216	svchost.exe
Token: SeBackupPrivilege	1216	svchost.exe
Token: SeRestorePrivilege	1216	svchost.exe

C:\Users\Admin\AppData\Local\Temp\378dea62d9b740eb7e13f87b30f8052e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\378dea62d9b740eb7e13f87b30f8052e_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4652

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility
1⤵
- Deletes itself
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\users\admin\applic~1\oykrp\srolq.lib

Filesize
2.8MB

MD5
9922d27f0e708f8e7e0b144cb50be479

SHA1
c6774f1ad9535319cd61b75f9171f0513804e57e

SHA256
737ec87e6c0e2783f653fdf8f29ecfa6cb22d34ee5e8506fd17da6da131d343b

SHA512
e4ae2b53617605bfe71150e6a08b6bdf7bd188733348bbd9d1d030083d022419879483f251be1f806821c6de5192e33b8fbbb89962ed0330d865987cb7519d43

Download Submit