Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
11-07-2024 19:37
Behavioral task
behavioral1
Sample
3a783b67cb6a17b443ee9820946dda26_JaffaCakes118.exe
Resource
win7-20240705-en
windows7-x64
General
-
Target
3a783b67cb6a17b443ee9820946dda26_JaffaCakes118.exe
-
Size
127KB
-
MD5
3a783b67cb6a17b443ee9820946dda26
-
SHA1
2b714568d9b5b81d3f77be134983d7c5f06a345c
-
SHA256
408632ad84bc391103e20efc4e790c0a38e8f8631c438148fa52ad9a2727fcbb
-
SHA512
125b34a2ac981bae64e06f968c4d87e2e2130a4ab6cce52ce4cddf9fbbecf252fbbc197003fc8abeeae5517d5488a3446c724b7cfc4f171873e5b1ec9a9145da
-
SSDEEP
3072:7eJB5WpPCMtzFCi9k2ttBB0NoYu/kvi3WZg:7eL5BM1si9kQfSNt+ka0
Malware Config
Signatures
-
Gh0st RAT payload 2 IoCs
resource yara_rule behavioral2/files/0x00090000000233dd-2.dat family_gh0strat behavioral2/files/0x000d000000023435-11.dat family_gh0strat -
Deletes itself 1 IoCs
pid Process 1468 svchost.exe -
Loads dropped DLL 2 IoCs
pid Process 3896 3a783b67cb6a17b443ee9820946dda26_JaffaCakes118.exe 1468 svchost.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Rnop\Wnopqrstu.gif 3a783b67cb6a17b443ee9820946dda26_JaffaCakes118.exe File created C:\Program Files (x86)\Rnop\Wnopqrstu.gif 3a783b67cb6a17b443ee9820946dda26_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe 1468 svchost.exe -
Suspicious behavior: LoadsDriver 6 IoCs
pid Process 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 660 Process not Found -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 3896 3a783b67cb6a17b443ee9820946dda26_JaffaCakes118.exe Token: SeRestorePrivilege 3896 3a783b67cb6a17b443ee9820946dda26_JaffaCakes118.exe Token: SeBackupPrivilege 3896 3a783b67cb6a17b443ee9820946dda26_JaffaCakes118.exe Token: SeRestorePrivilege 3896 3a783b67cb6a17b443ee9820946dda26_JaffaCakes118.exe Token: SeBackupPrivilege 3896 3a783b67cb6a17b443ee9820946dda26_JaffaCakes118.exe Token: SeRestorePrivilege 3896 3a783b67cb6a17b443ee9820946dda26_JaffaCakes118.exe Token: SeBackupPrivilege 3896 3a783b67cb6a17b443ee9820946dda26_JaffaCakes118.exe Token: SeRestorePrivilege 3896 3a783b67cb6a17b443ee9820946dda26_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a783b67cb6a17b443ee9820946dda26_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3a783b67cb6a17b443ee9820946dda26_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:3896
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Deletes itself
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1468
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
114KB
MD530c4d7a7cca3b8be32741bc8e8a955e9
SHA1b701502f528bef3fa0216ae68acefc5f35159d53
SHA25607acdef1b143098de6b02045c83821bc349e19093a3e187f029d6076d88d2d5c
SHA512e63c525093099793e60c231e7125e36cd0c8c3dd239d1f88d3171a5f3b3e55eed5fdff1b51080b10ee273475189e2c69ae66193a03013fad84d140ff19928b04
-
Filesize
99B
MD55f3d7a288a2f0faa5bfcf8bf07379492
SHA1c116b383cfadafb8be0da1a02108a523465020b1
SHA25699fbf5d736d89fe15ec187fc8aa03d42be4522e053ea5e6e7c4074559ec32d5a
SHA512690b85542380d8be9d33a3e0189ee7ae154a2e6fa604a825bbf3f662ed3a1e943bc2905b7bc13d2360809698943dd7e3df6f01f06c411698f1179ea31b1d4de6
-
Filesize
10.2MB
MD5ad92e233f2363263722dec0526ecb39b
SHA14fe85bcf99c5b33f8c197578df7eb3469a236de7
SHA25695a955d94780eaed5919524a346414507fdfbf69e6d1f5bafd369c281dbfa147
SHA512cc9d98d6667977aebce27a3ecb95612187318b4f853f91ccc9e032e9761d59ecd63e97a2ce52edf773f05ed1c09e8659af18c47dfc20668926be2566efc17ff4
