Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
12/07/2024, 19:05
General
-
Target
3e8574f66a35ae0b578c6576086cc3a3_JaffaCakes118.exe
-
Size
546KB
-
MD5
3e8574f66a35ae0b578c6576086cc3a3
-
SHA1
d8e4b9c01b299121e9f1e07bb4a11d213e2c0b72
-
SHA256
ce3a9db1b6123956acf0ede920bb024bd91a6f6a174cf1473935f1b6b0e0b185
-
SHA512
b7a363945cd9cde2e71f528a2031ff2ea18c1b913e4aa2ba26cb0023b46044a36b05438c6ac5f7cc2cffae88d2dc4aaa3637f655f3c94bc6c5c94004458c887f
-
SSDEEP
12288:wXXGxu5d+qPqQgXenGiqNeBcGyF3Z4mxxBSuCd6ZYyZOk:wXXnZPkI5wWAQmXBSuCdcROk
Malware Config
Signatures
-
Gh0st RAT payload 2 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Drops file in Drivers directory 2 IoCs
-
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
-
Deletes itself 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Drops file in System32 directory 1 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3e8574f66a35ae0b578c6576086cc3a3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3e8574f66a35ae0b578c6576086cc3a3_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Server Software Component: Terminal Services DLL
- Loads dropped DLL
- Drops file in System32 directory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Drops file in Drivers directory
- Deletes itself
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
84B
MD5102bee0eff5104a35021408e15f58010
SHA179e6f1cc4a466a8a66b0169807e2807290506ac7
SHA2565b1c58d085f557e322af9d011e3e1f04e0034de9dd92a0a99cf66ef850daff1a
SHA5122211d63ff7b77df42ff183a76c06c3453fb9c9128a22d0e7dad2d72b0e46f0298757852aab0071eabc9e736fd43a19c5d7f733943e3e181254246bb9e9e13136
-
Filesize
95KB
MD5d540965c376044e0c1a358e703e9ea8f
SHA1dc7c0dde91e53817799705a2568edd1477b2a799
SHA2562b1de12452521fb16ad6e3d909347d4f8c408fc1f88b4128d6ca5064e3c43f90
SHA5122b4995a700ac1ea0508f88a9f65a76a4ca12e81e1c47a435ff7e1d32e6357214b8f5c0aedc7af88445a752376a6a805df6bdd35a03bd3a5c56ff5b85e3f73449
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
952KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
336KB
-
Filesize
952KB
-
Filesize
336KB