Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
24-07-2024 00:11
Behavioral task
behavioral1
Sample
69846d1bcf65f1ddbb961be08ff8f096_JaffaCakes118.dll
Resource
win7-20240704-en
windows7-x64
8 signatures
150 seconds
General
-
Target
69846d1bcf65f1ddbb961be08ff8f096_JaffaCakes118.dll
-
Size
112KB
-
MD5
69846d1bcf65f1ddbb961be08ff8f096
-
SHA1
01c0dfa97a2c8a6a0b910151325abeaecc69c825
-
SHA256
f5cce53450b64e071bb938c4d5efb0304ec4876c8a59907276f367e3a0a95d6f
-
SHA512
98df5ee2854a5525f43d08c8256c6f3352bab0bf55616e8c43170b6ce2113aae86ef5f246287e2c5fe6db6e97eaee68a628a280e04a907fa356c27524d6d1c98
-
SSDEEP
3072:g81m+O6rM/TWeHiYzQhLTIhttHU4o4ugkCiHWwx:l1TMvCYWLTIT64N1kJ2W
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral1/files/0x000c0000000173de-3.dat family_gh0strat -
Loads dropped DLL 1 IoCs
pid Process 2160 svchost.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Lhij\Qhijklmno.bmp rundll32.exe File created C:\Program Files (x86)\Lhij\Qhijklmno.bmp rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe 2160 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 2808 rundll32.exe Token: SeRestorePrivilege 2808 rundll32.exe Token: SeBackupPrivilege 2808 rundll32.exe Token: SeRestorePrivilege 2808 rundll32.exe Token: SeBackupPrivilege 2808 rundll32.exe Token: SeRestorePrivilege 2808 rundll32.exe Token: SeBackupPrivilege 2808 rundll32.exe Token: SeRestorePrivilege 2808 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2520 wrote to memory of 2808 2520 rundll32.exe 30 PID 2520 wrote to memory of 2808 2520 rundll32.exe 30 PID 2520 wrote to memory of 2808 2520 rundll32.exe 30 PID 2520 wrote to memory of 2808 2520 rundll32.exe 30 PID 2520 wrote to memory of 2808 2520 rundll32.exe 30 PID 2520 wrote to memory of 2808 2520 rundll32.exe 30 PID 2520 wrote to memory of 2808 2520 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\69846d1bcf65f1ddbb961be08ff8f096_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\69846d1bcf65f1ddbb961be08ff8f096_JaffaCakes118.dll,#12⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2808
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2160
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19.2MB
MD5f17c1ef1509b5e266afc5ee87d5f56c5
SHA155920e85065ab675abc5018e67038f9e536e4c8b
SHA25629b72ee2475ce72f032662b962b7fdaaf3aad0d32b2a029606e1869a2786c9b5
SHA5129cd133727becd17a552b6b311d7e9894dbbe095d2c2982f92ae5d0ce732b43e9fc34c3da37e179227e68dce5c14232ae638174c4b5bf4d961c265192d47d02bb
