Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
26/07/2024, 09:30
General
-
Target
737aed4aa50f0b9b36503e83201c290a_JaffaCakes118.exe
-
Size
381KB
-
MD5
737aed4aa50f0b9b36503e83201c290a
-
SHA1
56723ad3764c6380bacf9e4fd27abc066d8503df
-
SHA256
a922afe80776c0efec842b15a70c6af126482240e815a40300674ef1674f9852
-
SHA512
ae0c7616186f8713ae3be3ef8d8acbeea16727636e1ecfe106a7cda0d178014ccf130d4fe0417dd199a0c70c899745c9dfe95dd15f80cc844d3a1d6341406f5b
-
SSDEEP
6144:yy/VEoQ1fVDaq5wF2idZecnl20lHRxp3g8q0o7IHLyvZ8e/62t6mS2Us/MC0:N/VBQ1fVDavF3Z4mxxNxtu2S6mSTxR
Malware Config
Signatures
-
Gh0st RAT payload 3 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Drops file in Drivers directory 2 IoCs
-
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
-
Deletes itself 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Drops file in System32 directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: LoadsDriver 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\737aed4aa50f0b9b36503e83201c290a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\737aed4aa50f0b9b36503e83201c290a_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Server Software Component: Terminal Services DLL
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Drops file in Drivers directory
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
95KB
MD517d2806cdd911ccf2b88bac4d0f58fdb
SHA139a1dd6b9d064c041f99bed12f611f92d793c5df
SHA25624df3685d2fc91a7e3735c3af1f4cb72728c5956ee7150fc22489440705953c7
SHA512cc8ed8ee96e16b70913c9f3cea8113e4c8ef160448e08f31c34f9b9596707dcb7d5634f453571ebb4602fa7fdddb033adc30d74ed67dea016a180d37c2290db5
-
Filesize
84B
MD5deb870199c8aa45e875feb5203852cb3
SHA15da7b61e2185927a135de7c6b99fd8099d58cc2f
SHA2560e9df24b2ed4a20fd8321dd57188817321437b0da1bfa0031aa0042ce80b1c84
SHA5120b663b3304cb30bbddc793a550b8bd9c788931cd86e0277600e7015bc98c0e40ce294276c963216871534188605e226dfca11b437e49471b60f61d134ee41e4f
-
Filesize
95KB
MD50b303b01a8e1c221300b0c1530c8ac70
SHA13f7c21bdfb5410421794c1e8f009a22f1c91ca41
SHA256fb72920283af6c49143491885fc08d1245d69b05e94b718f464922ba7eefa7ba
SHA512879ccc1277b8a980b88f3966c877541e1b4dc7668db495281476cc4de0372b36fd4153ad714f28cff190e78de535212651652b65bef974973df568e7b2e49dd6
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
448KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
12KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
448KB
-
Filesize
336KB
-
Filesize
336KB