Analysis
-
max time kernel
140s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
11/08/2024, 11:25
General
-
Target
8a2e137f71d46acfff4d7bd2e68c5ec9_JaffaCakes118.exe
-
Size
376KB
-
MD5
8a2e137f71d46acfff4d7bd2e68c5ec9
-
SHA1
d5041ecd6f8b7ea7d6184c38992e87ccf92c3afa
-
SHA256
379af2834fef6bca6300893b7deb4519a5b5479dac68e31e5d0148bc4780ecf6
-
SHA512
9ca3a096419f9e55fa5a36efdc1ac3d450e3476098d088eab843926b922bdffcdce16fd88ae910a0b271fcb77258ab81bb0159b74f4098c81befe4938e0135ee
-
SSDEEP
6144:JgydAWCohF2idZecnl20lHRxp3gpXvHn5cF6KwUclRSKUrI3qxmOKEn:iydCobF3Z4mxxqv5clcO55EvE
Malware Config
Signatures
-
Gh0st RAT payload 2 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Drops file in Drivers directory 2 IoCs
-
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
-
Deletes itself 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Drops file in System32 directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: LoadsDriver 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a2e137f71d46acfff4d7bd2e68c5ec9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8a2e137f71d46acfff4d7bd2e68c5ec9_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Server Software Component: Terminal Services DLL
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s FastUserSwitchingCompatibility1⤵
- Drops file in Drivers directory
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
MD518d801873817006bb86f13e258ca2d35
SHA1cc57b7e4c663213dcc2cf9d3d8c5466efaf1a6bc
SHA256fcbb8a941fd41150fdbb15448a2f477ced6abdf3129e65c9bb735273e284c2ba
SHA512c62d49aea0dff792707587439bcf002385c53f3fd30c5a9e0976558d5392970f77ffa96c7f32dc26b5967cd1fd0a38e8a5b813045d6adf67463b6a10dd639f5e
-
Filesize
84B
MD5f08f58289486770df03e7909fc5616eb
SHA1e749fb3fde9846bb886173142a91bb6c1aafe750
SHA256de2a4c73f568bbdc954df671d5cdb81094e998e17e2c59f697739583b3309157
SHA5123c13b6210ae3ce5794248da4326aad5ad69b93436f070d9b981c5c43f60f9cbcb05e5538f67ab195ed17b7625ae4726c52e0c97bc0f3fcee1c18a85dec76b53e
-
Filesize
464KB
-
Filesize
336KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
464KB
-
Filesize
336KB