Analysis
-
max time kernel
150s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
15-07-2024 04:32
General
-
Target
483ba25d2dee6afb2e23ff4335bc0655_JaffaCakes118.exe
-
Size
358KB
-
MD5
483ba25d2dee6afb2e23ff4335bc0655
-
SHA1
30f543d282d5952321775d268807cc2d398aab8b
-
SHA256
6148ba2f6a941f7fb0b233d7616247d1501cc916c512593eec33443605f09f57
-
SHA512
f131aeaa1ce2f30261ae3f03f78dfb3d517d47be3c17e7e17eba9c2e70d4b90badadfa731bf7814a8aaa7894b0c1b7e620696ec37c6403a0cf41666136d803ba
-
SSDEEP
6144:druMZwgRf/pWUaO1u4nDWgRAkPVkGQn8xID0DMFFGsdPVgrKvzW0nUQz1:drucf/JDR3PVkGLxe0DuPyWva0x1
Malware Config
Signatures
-
Gh0st RAT payload 5 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Deletes itself 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Drops file in Program Files directory 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\483ba25d2dee6afb2e23ff4335bc0655_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\483ba25d2dee6afb2e23ff4335bc0655_JaffaCakes118.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Deletes itself
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
133KB
MD5c3c1f99946f7bed1c49520c7f356f6b4
SHA1bacd9b5ac807a290ae935cfa06af8cbf3cad1d38
SHA2561afde4bfb742a6a927053415e2aafab4603341aef0d2fb3d65e2ee12b4a204a6
SHA512da735b3c82e224a7206620474e36ef74c2016951a584f48e62686a30e992fcbc52b456ccda0414738bc6056638600c4538722e99dc26fea88211c48932915b63
-
Filesize
7.0MB
MD5f63991daffb4363da8e1860b5eefdc10
SHA1ca2e8596ae5caef23ff210519acf34c9edf6f0b6
SHA25632d6ecd6cd331f026c50cfbddb01e5a6ae8f7a093d7efd31e5074a3133bc19a5
SHA5122d89708a1f8e9beaa32460b8cc3a6669b7507dfb024baf358c72a01ab2ab067e54db247c7170d5fba26c586285b50da639bdfb84b9ab421c83ef57ebf30130c4
-
Filesize
98B
MD53bd36bd049f1dd656e2d011055813c16
SHA19852ab62454b1eb114e582671dd436f1983c4eb8
SHA256ea1792f80a8d46f76eed99e32dcf484357a37e0ccffd5dc97f66a04f8b32d8db
SHA5125ce75eed4aea50a569d18c0d3c1b8d9fd5d0335b8ff09b71ab56e9c7182d5c0b7eb078cfd429001882384ea11d47348219ab54ecaf1b93e21a0549f3737c2f61
-
Filesize
576KB
-
Filesize
688KB
-
Filesize
256KB
-
Filesize
580KB
-
Filesize
580KB
-
Filesize
1.1MB
-
Filesize
640KB
-
Filesize
580KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
1.5MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
580KB
-
Filesize
148KB
-
Filesize
580KB
-
Filesize
580KB
