Analysis

  • max time kernel
    139s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/08/2024, 12:50

General

  • Target

    962b401701e355f097244730cf24803d_JaffaCakes118.exe

  • Size

    417KB

  • MD5

    962b401701e355f097244730cf24803d

  • SHA1

    1c46d10eed48ab74bd143b13b5e5d0e8a20d5d3e

  • SHA256

    fa8897dbf10286460690855f9902b7a4b2ae65328a0650ac3ed1922ead5f9e53

  • SHA512

    de34976e69a80989076fa5cd8f8833fdb2e14b5e862fe8313181d9fc660150fa771550b15e8bd0b74d25d6a1a790360f4a8f4c9519a43f855c33216d11e4c2bd

  • SSDEEP

    12288:2R4RoOXuDUVtBExF3Z4mxxdXF/jhERUuL:voW5VtBAQmXVF/VCUuL

Malware Config

Signatures

  • Gh0st RAT payload 2 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

  • Drops file in Drivers directory 2 IoCs
  • Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\962b401701e355f097244730cf24803d_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\962b401701e355f097244730cf24803d_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3012
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe
      2⤵
      • Drops file in Drivers directory
      • Server Software Component: Terminal Services DLL
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      PID:4716
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs -s FastUserSwitchingCompatibility
    1⤵
    • Drops file in Drivers directory
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:2876

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4.exe

    Filesize

    65KB

    MD5

    e84663d8c8180b028c5a02b37ac3d51a

    SHA1

    67d61e2158e2125d669e1593b604821f48d72075

    SHA256

    72c7c912680afd3e9092bcc6d5c2c7b9dd20213bb0e4a3349fd43564513ebda4

    SHA512

    b2e2a6fe65e82afe069868d28790b34423ac716c0ef919fc5a3993c9805038c9fdc4652213949a41d5a2e059b3ab75397add469ce5c4e2ffb2c48e5bdb5464ae

  • C:\Users\Admin\AppData\Local\Temp\dll.tmp

    Filesize

    88KB

    MD5

    808e73e0355448a1e6d12021c207c81d

    SHA1

    2cfb9f8b0ae3301448ba88dfe651e1a026cd729e

    SHA256

    6e751821bf9d5d54300b3ccadb83ae320deca4ca4df2c2855f78cbe90924d5a6

    SHA512

    fadde2465d4acf780580851fe1cbe41d4f2523930bbee46bb37c926c91c6f3aad443e67b2bd6c84748b2dd016bf6ea241b147c4967a28fdd98b7d48845896239

  • C:\Windows\SysWOW64\install.tmp

    Filesize

    50B

    MD5

    bca35becd9dd601e1d6f8dc0336ad0f7

    SHA1

    fdc74b2ccede7ad09e64aeec41a8d36c32f8feec

    SHA256

    d0e5420f5fc76577b271863fb3e52ea089d432a8b2ad6382854cdaf116a6f731

    SHA512

    d98826054b930027dd6588fd30a83650f6a90d82d4fa0c7b8151258988144ef310ea2fc9584c186ec9ac972ff739650cb18d14518f3985dfb6bb2ecc9436805f

  • memory/3012-0-0x0000000001000000-0x000000000108E000-memory.dmp

    Filesize

    568KB

  • memory/3012-1-0x0000000000560000-0x00000000005B4000-memory.dmp

    Filesize

    336KB

  • memory/3012-64-0x0000000003080000-0x0000000003081000-memory.dmp

    Filesize

    4KB

  • memory/3012-63-0x0000000003080000-0x0000000003081000-memory.dmp

    Filesize

    4KB

  • memory/3012-62-0x0000000003080000-0x0000000003081000-memory.dmp

    Filesize

    4KB

  • memory/3012-61-0x0000000003080000-0x0000000003081000-memory.dmp

    Filesize

    4KB

  • memory/3012-60-0x0000000003080000-0x0000000003081000-memory.dmp

    Filesize

    4KB

  • memory/3012-59-0x0000000003080000-0x0000000003081000-memory.dmp

    Filesize

    4KB

  • memory/3012-58-0x0000000003080000-0x0000000003081000-memory.dmp

    Filesize

    4KB

  • memory/3012-57-0x0000000003080000-0x0000000003081000-memory.dmp

    Filesize

    4KB

  • memory/3012-56-0x0000000003080000-0x0000000003081000-memory.dmp

    Filesize

    4KB

  • memory/3012-55-0x0000000003080000-0x0000000003081000-memory.dmp

    Filesize

    4KB

  • memory/3012-54-0x0000000003080000-0x0000000003081000-memory.dmp

    Filesize

    4KB

  • memory/3012-53-0x0000000003080000-0x0000000003081000-memory.dmp

    Filesize

    4KB

  • memory/3012-52-0x0000000003080000-0x0000000003081000-memory.dmp

    Filesize

    4KB

  • memory/3012-51-0x0000000003080000-0x0000000003081000-memory.dmp

    Filesize

    4KB

  • memory/3012-50-0x0000000003080000-0x0000000003081000-memory.dmp

    Filesize

    4KB

  • memory/3012-49-0x0000000003080000-0x0000000003081000-memory.dmp

    Filesize

    4KB

  • memory/3012-48-0x0000000003090000-0x0000000003091000-memory.dmp

    Filesize

    4KB

  • memory/3012-47-0x0000000003090000-0x0000000003091000-memory.dmp

    Filesize

    4KB

  • memory/3012-46-0x0000000003090000-0x0000000003091000-memory.dmp

    Filesize

    4KB

  • memory/3012-45-0x0000000003090000-0x0000000003091000-memory.dmp

    Filesize

    4KB

  • memory/3012-44-0x0000000003090000-0x0000000003091000-memory.dmp

    Filesize

    4KB

  • memory/3012-43-0x0000000003090000-0x0000000003091000-memory.dmp

    Filesize

    4KB

  • memory/3012-42-0x0000000000CF0000-0x0000000000CF1000-memory.dmp

    Filesize

    4KB

  • memory/3012-41-0x0000000000C90000-0x0000000000C91000-memory.dmp

    Filesize

    4KB

  • memory/3012-40-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

    Filesize

    4KB

  • memory/3012-39-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

    Filesize

    4KB

  • memory/3012-38-0x0000000000CE0000-0x0000000000CE1000-memory.dmp

    Filesize

    4KB

  • memory/3012-37-0x0000000003080000-0x0000000003081000-memory.dmp

    Filesize

    4KB

  • memory/3012-36-0x0000000000C00000-0x0000000000C01000-memory.dmp

    Filesize

    4KB

  • memory/3012-35-0x0000000000C70000-0x0000000000C71000-memory.dmp

    Filesize

    4KB

  • memory/3012-34-0x0000000000C40000-0x0000000000C41000-memory.dmp

    Filesize

    4KB

  • memory/3012-33-0x0000000000C50000-0x0000000000C51000-memory.dmp

    Filesize

    4KB

  • memory/3012-32-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

    Filesize

    4KB

  • memory/3012-31-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

    Filesize

    4KB

  • memory/3012-30-0x0000000000C60000-0x0000000000C61000-memory.dmp

    Filesize

    4KB

  • memory/3012-29-0x0000000000C10000-0x0000000000C11000-memory.dmp

    Filesize

    4KB

  • memory/3012-28-0x0000000000C30000-0x0000000000C31000-memory.dmp

    Filesize

    4KB

  • memory/3012-27-0x0000000003080000-0x0000000003081000-memory.dmp

    Filesize

    4KB

  • memory/3012-26-0x0000000003080000-0x0000000003081000-memory.dmp

    Filesize

    4KB

  • memory/3012-25-0x0000000003080000-0x0000000003081000-memory.dmp

    Filesize

    4KB

  • memory/3012-24-0x0000000003090000-0x0000000003091000-memory.dmp

    Filesize

    4KB

  • memory/3012-23-0x0000000003090000-0x0000000003091000-memory.dmp

    Filesize

    4KB

  • memory/3012-22-0x0000000003090000-0x0000000003091000-memory.dmp

    Filesize

    4KB

  • memory/3012-21-0x0000000003090000-0x0000000003091000-memory.dmp

    Filesize

    4KB

  • memory/3012-20-0x0000000003090000-0x0000000003091000-memory.dmp

    Filesize

    4KB

  • memory/3012-19-0x0000000003090000-0x0000000003091000-memory.dmp

    Filesize

    4KB

  • memory/3012-18-0x0000000003090000-0x0000000003091000-memory.dmp

    Filesize

    4KB

  • memory/3012-17-0x0000000003090000-0x0000000003091000-memory.dmp

    Filesize

    4KB

  • memory/3012-16-0x0000000003090000-0x0000000003091000-memory.dmp

    Filesize

    4KB

  • memory/3012-15-0x0000000000BC0000-0x0000000000BC1000-memory.dmp

    Filesize

    4KB

  • memory/3012-14-0x0000000003090000-0x0000000003091000-memory.dmp

    Filesize

    4KB

  • memory/3012-13-0x0000000003090000-0x0000000003091000-memory.dmp

    Filesize

    4KB

  • memory/3012-12-0x0000000003090000-0x0000000003091000-memory.dmp

    Filesize

    4KB

  • memory/3012-11-0x0000000003090000-0x0000000003091000-memory.dmp

    Filesize

    4KB

  • memory/3012-10-0x0000000003090000-0x0000000003091000-memory.dmp

    Filesize

    4KB

  • memory/3012-9-0x0000000003090000-0x0000000003091000-memory.dmp

    Filesize

    4KB

  • memory/3012-8-0x0000000000700000-0x0000000000701000-memory.dmp

    Filesize

    4KB

  • memory/3012-7-0x0000000000BA0000-0x0000000000BA1000-memory.dmp

    Filesize

    4KB

  • memory/3012-6-0x0000000000530000-0x0000000000531000-memory.dmp

    Filesize

    4KB

  • memory/3012-5-0x0000000000540000-0x0000000000541000-memory.dmp

    Filesize

    4KB

  • memory/3012-4-0x0000000000BB0000-0x0000000000BB1000-memory.dmp

    Filesize

    4KB

  • memory/3012-3-0x00000000005C0000-0x00000000005C1000-memory.dmp

    Filesize

    4KB

  • memory/3012-2-0x00000000005E0000-0x00000000005E1000-memory.dmp

    Filesize

    4KB

  • memory/3012-87-0x0000000000560000-0x00000000005B4000-memory.dmp

    Filesize

    336KB

  • memory/3012-86-0x0000000001000000-0x000000000108E000-memory.dmp

    Filesize

    568KB

  • memory/4716-84-0x0000000000400000-0x0000000000427000-memory.dmp

    Filesize

    156KB