Analysis
-
max time kernel
16s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
18-08-2024 00:29
General
-
Target
a4b1e68248d4a72d4e01c8c1063fca82_JaffaCakes118.exe
-
Size
384KB
-
MD5
a4b1e68248d4a72d4e01c8c1063fca82
-
SHA1
5ca575a41a8213846f0546486cbfcbecd8e51a1d
-
SHA256
e4753bccc9ed1a89db4c4a21925a470e56a47d2c0ff1a71e6a6c54d267e92f87
-
SHA512
106fe7b3fc02b79bccea06ff57762bd1878f6278181d94a7ede9322a3f0b1dcfb5e2dfc071b2a90506fb5dfb7e8ea5de3f74962970769c4ce8752937d53f1b81
-
SSDEEP
12288:GdcNedlaTF3Z4mxxyWznGc+L+NAwizaUd4AeG:EPdlgQmXyWznGPMQaUZ
Malware Config
Signatures
-
Gh0st RAT payload 3 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Drops file in Drivers directory 1 IoCs
-
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Drops file in System32 directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\a4b1e68248d4a72d4e01c8c1063fca82_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a4b1e68248d4a72d4e01c8c1063fca82_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Server Software Component: Terminal Services DLL
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
99KB
MD59b3d9e793507ac00d8387183f22db0eb
SHA183cc9fe037fe8146f38ce9be4afc94ee862cb07b
SHA256c31d45a49b0906d17adc94a3d7424eb1d21c7a12b9942c6855f8b12a84ca1270
SHA512dc45791012eb2a6e88ca644b48dc58efc8f16bdefebdc4aad8ae80ce38d774d991943cca80228e6cbbaf0493bd07e0de7c52979490c54e7d616c3a738f9a6a54
-
Filesize
99KB
MD5c2d4f11aed885097f15944444435facb
SHA106f90c5a9397fbc4f2242fc2c6737e6599537497
SHA25674f1e94dea0986e011d2176e478a246e75998fc9e190dcd7b4a310603c82347a
SHA512e983537afcb89a808e4bbe2d2f96329ff88abca37edc15a673d4ff96fccca0a9dfa57442cb0356b5f1be4410ae1b4707d0f42eda99e3e55d651a05ca456443dc
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
452KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
12KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
452KB
-
Filesize
336KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
336KB
-
Filesize
4KB