Analysis
-
max time kernel
129s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18-08-2024 10:58
Static task
static1
Behavioral task
behavioral1
Sample
a68524dae41a8b375df2d5cb1f97d0c0_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
a68524dae41a8b375df2d5cb1f97d0c0_JaffaCakes118.exe
-
Size
653KB
-
MD5
a68524dae41a8b375df2d5cb1f97d0c0
-
SHA1
19d42d30ec35f5193712aff3aab1ae169e999cb6
-
SHA256
ce01bfbc281f04da903341cf0ec5b66b0c318f4424864a31e90eab101403ae02
-
SHA512
8086d6d4d9b9dd0b3a844d1f584937c624925e5ec4c510ba8456c864ead4c74ae1aa817ba10ec4adf68a65a68e759fcad127a83f82539f564c57ac1d427089f9
-
SSDEEP
12288:jcsfWQxTWRfMMMMM2MMMMMdtXTfWWV9BDYsDwT3ngYK7UZa78RgusdavBvBfle:QYtTWRfMMMMM2MMMMMXXTfWs7DKCV7Dx
Malware Config
Signatures
-
Gh0st RAT payload 2 IoCs
resource yara_rule behavioral2/memory/3132-2-0x0000000000400000-0x0000000000763000-memory.dmp family_gh0strat behavioral2/memory/3132-12-0x0000000000400000-0x0000000000763000-memory.dmp family_gh0strat -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\MyInformations.ini a68524dae41a8b375df2d5cb1f97d0c0_JaffaCakes118.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1164 3132 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a68524dae41a8b375df2d5cb1f97d0c0_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe -
Kills process with taskkill 1 IoCs
pid Process 116 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 116 taskkill.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3132 a68524dae41a8b375df2d5cb1f97d0c0_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3132 wrote to memory of 116 3132 a68524dae41a8b375df2d5cb1f97d0c0_JaffaCakes118.exe 85 PID 3132 wrote to memory of 116 3132 a68524dae41a8b375df2d5cb1f97d0c0_JaffaCakes118.exe 85 PID 3132 wrote to memory of 116 3132 a68524dae41a8b375df2d5cb1f97d0c0_JaffaCakes118.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\a68524dae41a8b375df2d5cb1f97d0c0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a68524dae41a8b375df2d5cb1f97d0c0_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /t /im ZhuDongFangYu.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:116
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3132 -s 7402⤵
- Program crash
PID:1164
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3132 -ip 31321⤵PID:3880
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
417B
MD53b604095e9a88320407fede297f1f5aa
SHA1c2f2fed65d006de6be23ae22e0649046e83db078
SHA256d38f0a514467ecac611548681ef574bb1737505d4549c2b9f7eabba0f854480c
SHA512abe296ab6217e5e6b6719deab39b5598df9ce6c976d821c66ec8f8ec389536389ca5fb2bf4e570ec0bf9c8e3d1772445c73de2b170e0dc1ef6251b1bf561db8d