Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
16/07/2024, 01:41
General
-
Target
4c4a305814cfc48c3cf463c6b8429fbb_JaffaCakes118.exe
-
Size
595KB
-
MD5
4c4a305814cfc48c3cf463c6b8429fbb
-
SHA1
3e266976430a8d671aee5f5278903868957fc79c
-
SHA256
ac26f4cd5c47cbdbb3e8717d539e64b9540f857dc671510840c74611ba3db4c4
-
SHA512
9142693a86c09f307dbc65d765bb5f47093d348238d7eb70f2461c8e7f0d95a3da71f2e20f1fcc4d98b69e4887ede80de3eb100a07dc510301437755d3de4356
-
SSDEEP
12288:w+33Gch6RUQRThZHu2SQdFZ7Yc+F3Z4mxxtoEtlK+kt9T2MN+:w+3GUQJhZOgFWjQmX+GW+
Malware Config
Signatures
-
Gh0st RAT payload 2 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Drops file in Drivers directory 2 IoCs
-
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
-
Deletes itself 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Drops file in System32 directory 1 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c4a305814cfc48c3cf463c6b8429fbb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4c4a305814cfc48c3cf463c6b8429fbb_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Server Software Component: Terminal Services DLL
- Loads dropped DLL
- Drops file in System32 directory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s FastUserSwitchingCompatibility1⤵
- Drops file in Drivers directory
- Deletes itself
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
95KB
MD5a139da5e7c1a81796537ce3ca361c4e3
SHA1fd9f7a2783b16b271bf2fcaa7bda3ae6af5f4fba
SHA2560a05979621a55c92ca2904737025403cf05259f370ef46c4667f3c75360dd4d8
SHA512fa16e6e56e4ca53a48856366a4d7575347497109cf874a1b71ea005e4a45a6bcec9ff423cc1c3a3fc278fab075ed4801a45871b65078746e54315a1ca3ad845b
-
Filesize
84B
MD5e9ad8327e63342510dbeedb2798eaa68
SHA164583bf5e33941c42443a0ec7a61ad9324ceb55b
SHA2566a1354be4d302dbc5bca274f03469b1d46d6c8e72d89da8ec4df60ddff5b1ffa
SHA512c5f3acc841c307d46fa9149e186213f9a63c3345ddb09b9e7f7dbd687e5eebacda679c025497b1446968b42600a3971a644cd112958cdd85dcf77514a0d6d176
-
Filesize
948KB
-
Filesize
336KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
336KB
-
Filesize
948KB