Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
21/07/2024, 12:18
Behavioral task
behavioral1
Sample
608f65c6ad2b2ad3dc25a21fb0daa720_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
608f65c6ad2b2ad3dc25a21fb0daa720_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
608f65c6ad2b2ad3dc25a21fb0daa720_JaffaCakes118.exe
-
Size
130KB
-
MD5
608f65c6ad2b2ad3dc25a21fb0daa720
-
SHA1
147bdec05897e1813220f5b39f14bf25b1a321b2
-
SHA256
d243f0ecc030243424808d584a5c8c71cf7ad5f0575530d5baa168d91706bdae
-
SHA512
d80d97c5e42329c61f82928a50bb8f5cce1e5676897101531830fd99ad1acab6e82ee2e31bcacaf71ea81debdf534beabe96d7e65e236f6b4b44dce426c7625d
-
SSDEEP
3072:OaijF0w0u1U1HqzJRCSdci1Ih1Lky5OAWtY:riBoMJgsIr4wOAWt
Score
10/10
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral1/memory/2064-12-0x0000000000400000-0x0000000000425000-memory.dmp family_gh0strat -
Executes dropped EXE 1 IoCs
pid Process 2432 Sogou.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\KRIS = "C:\\Windows\\Sogou.exe" 608f65c6ad2b2ad3dc25a21fb0daa720_JaffaCakes118.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\svchest.ini Sogou.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Sogou.exe 608f65c6ad2b2ad3dc25a21fb0daa720_JaffaCakes118.exe File created C:\Windows\Sogou.exe 608f65c6ad2b2ad3dc25a21fb0daa720_JaffaCakes118.exe -
Kills process with taskkill 2 IoCs
pid Process 1796 taskkill.exe 2528 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe 2432 Sogou.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2432 Sogou.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2064 608f65c6ad2b2ad3dc25a21fb0daa720_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1796 taskkill.exe Token: SeDebugPrivilege 2528 taskkill.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2064 wrote to memory of 1796 2064 608f65c6ad2b2ad3dc25a21fb0daa720_JaffaCakes118.exe 29 PID 2064 wrote to memory of 1796 2064 608f65c6ad2b2ad3dc25a21fb0daa720_JaffaCakes118.exe 29 PID 2064 wrote to memory of 1796 2064 608f65c6ad2b2ad3dc25a21fb0daa720_JaffaCakes118.exe 29 PID 2064 wrote to memory of 1796 2064 608f65c6ad2b2ad3dc25a21fb0daa720_JaffaCakes118.exe 29 PID 2064 wrote to memory of 2432 2064 608f65c6ad2b2ad3dc25a21fb0daa720_JaffaCakes118.exe 32 PID 2064 wrote to memory of 2432 2064 608f65c6ad2b2ad3dc25a21fb0daa720_JaffaCakes118.exe 32 PID 2064 wrote to memory of 2432 2064 608f65c6ad2b2ad3dc25a21fb0daa720_JaffaCakes118.exe 32 PID 2064 wrote to memory of 2432 2064 608f65c6ad2b2ad3dc25a21fb0daa720_JaffaCakes118.exe 32 PID 2432 wrote to memory of 2528 2432 Sogou.exe 33 PID 2432 wrote to memory of 2528 2432 Sogou.exe 33 PID 2432 wrote to memory of 2528 2432 Sogou.exe 33 PID 2432 wrote to memory of 2528 2432 Sogou.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\608f65c6ad2b2ad3dc25a21fb0daa720_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\608f65c6ad2b2ad3dc25a21fb0daa720_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Ksafetray.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1796
-
-
C:\Windows\Sogou.exeC:\Windows\Sogou.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Ksafetray.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2528
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92B
MD537d0d8b47a21cc7cc89fbf7214cf4e72
SHA10dd9f8df2951de73df7be15d127757c068cbe62f
SHA256aece9ef5e316d296d49537387cdaab0b860ed528a8b2b265a8d97c429de60d3a
SHA5127e8fc59706854e64b899af910ded39d27b7686d6c2315869b114822babf2517c5f129d9664e7ecb2c72a8296315f459f6c118f9f2bf509adce81282762fcd112