Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
22/08/2024, 09:19
General
-
Target
b71ad43b7fb81608ce1b36a5be5dec7d_JaffaCakes118.exe
-
Size
380KB
-
MD5
b71ad43b7fb81608ce1b36a5be5dec7d
-
SHA1
ec7914dada86c26417d6a91ca2068113f7970c2a
-
SHA256
518b446934ff93f157103844072294d485333c58e3d6e02af55d1feff072b49d
-
SHA512
cf056cb701adc8b97bb4b82f96d566ec0111d156431ed8ecd73398f23e490182ce384c67517874047e95e6236acac00db152e23111ef3efe0f861b6888778ace
-
SSDEEP
6144:S39J9xt91YUj6W+F8u5bRFF2idZecnl20lHRxp3gHPp3SBo03ty/4QTRGP/D1WiW:AxRefPF3Z4mxxEPj0AR+D1WF8qGqr
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Drops file in Drivers directory 1 IoCs
-
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
-
ASPack v2.12-2.42 2 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Loads dropped DLL 2 IoCs
-
Drops file in System32 directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: LoadsDriver 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b71ad43b7fb81608ce1b36a5be5dec7d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b71ad43b7fb81608ce1b36a5be5dec7d_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Server Software Component: Terminal Services DLL
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
370KB
MD590468db3d00ccdb527d84bcf37c37532
SHA1f7948fed8ac18b2f5c85e456d3aacac496db0479
SHA256c8e4f18ff8bcd6ce22695956ab7f7139727cd0736b7ae9800898ed6c7ec344d2
SHA51241ce0b1765248401407c3bda59f900b0f024ad1cff5dc69cb6a86de0bee1dcdd46556250937cbea84549c4ec2a026164e01729d7ac50b3bf389bc899bb645cdd
-
Filesize
370KB
MD5e763e2fe37c5f879c8dd01298c321e14
SHA1ecf499d4b15390911e04c4fce85120d20eab374b
SHA256a8b2d556aab03feacfd8a4582411135a30c648a9d5dd3862b1f185a0f12587ac
SHA5127b47c408ade588da768143e0fd7ba44538714d560e60a83c5a6959ba2d5b0731691cc7468244c988cf7637b50d50d44c0f6249e5efd7414dbf893963599b279a
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
388KB
-
Filesize
4KB
-
Filesize
336KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
508KB
-
Filesize
508KB
-
Filesize
388KB
-
Filesize
508KB