Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
23/08/2024, 13:48
General
-
Target
bbfbed6628ef8c7aee1dc3575e807000_JaffaCakes118.exe
-
Size
1.8MB
-
MD5
bbfbed6628ef8c7aee1dc3575e807000
-
SHA1
e77c0e1a22c82781795e2fd2209774d3137f1617
-
SHA256
03a109a2f0aa33b78c4b37cb9c7696d76739de81d88e7192f3b88c07a01c74db
-
SHA512
17a7ae660f584c5db0646de802dfd68f71eac4c08402531e81e104ce21466d75d5bbd1a52120842490bb6bffc529ecd3c58c7ce09056099a8837e62badcf1310
-
SSDEEP
49152:rWIGAqQ6x8sqK6cKv+Am/jYOU4H7x+jWttcES:rBHWx8TajYOFwj/
Malware Config
Signatures
-
Gh0st RAT payload 4 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
-
Sets service image path in registry 2 TTPs 1 IoCs
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 12 IoCs
-
UPX packed file 10 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory 2 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 9 IoCs
-
Suspicious use of SetWindowsHookEx 59 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bbfbed6628ef8c7aee1dc3575e807000_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\bbfbed6628ef8c7aee1dc3575e807000_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\WINDOWS\ls.exeC:\WINDOWS\ls.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility1⤵
- Server Software Component: Terminal Services DLL
- Sets service image path in registry
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Server Software Component
1Terminal Services DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
176KB
MD560187d963dbd1066fbdab69c18043712
SHA10e37b2f54c48a9559358587fbdd909c76c1ed1cb
SHA256379e6233c6d6f07b70b8d6c89037822b0521e260c94fe9f041af6424540308bc
SHA512faa405283152bfd78db0aec5938370e40f1265704f0090f669c2e595a96f4e108045ee572c3c1d300a0476dc3d8a28d5131be032b41845ac31a516b4af38116c
-
Filesize
36KB
MD5ae663d23828e2c0873fb294a8a2a21d1
SHA12edd95515215170f2e5dc2428ac631b5aa2ab681
SHA25621970bccf9c8dd23cbf36b5f5bca9e6bc32335bcfb5e19d2f97a1b2ee2eefa96
SHA51270225619899266d7a307f6eeab2f4c709f48b66c57a2266143c787b984209d454634daaaf9165025e850fc3de8e10a968b900c80d89389ef848551b0701ef311
-
Filesize
156KB
MD5ca08022deda03a89eb0f3232b265bca6
SHA129a3585b6c524a28fd272214691b65a48b7027b1
SHA25600a98605d8ee60639c8de56862a50f1adf3f83e265ab636f98c017b719b013bf
SHA51265587c3c0a3d0feaf1aa7c676626ae0a8bd158595af4e855cf7588ef8a831903350a756dd2f8010dda10173abdb1418751e92c509c6b74a3b829465ab5030c15
-
Filesize
216KB
MD5cba933625bfa502fc4a1d9f34e1e4473
SHA15319194388c0e53321f99f1541b97af191999a09
SHA25625549c7781b3f1b92e73b0ea721d177207cce914a66f3229a71291f2eb160013
SHA512f5fb4b97c4f68a20e0847e6528740ce659c4501726f3b2dff1ac83e88a3b7198099da03edb0f069cd4af7ed568a2373597b235cd239895addfa5226d3a444142
-
Filesize
1.1MB
MD5638e737b2293cf7b1f14c0b4fb1f3289
SHA1f8e2223348433b992a8c42c4a7a9fb4b5c1158bc
SHA256baad4798c3ab24dec8f0ac3cde48e2fee2e2dffa60d2b2497cd295cd6319fd5b
SHA5124d714a0980238c49af10376ff26ec9e6415e7057925b32ec1c24780c3671047ac5b5670e46c1c6cf9f160519be8f37e1e57f05c30c6c4bda3b275b143aa0bf12
-
Filesize
86KB
MD5147127382e001f495d1842ee7a9e7912
SHA192d1ed56032183c75d4b57d7ce30b1c4ae11dc9b
SHA256edf679c02ea2e170e67ab20dfc18558e2bfb4ee5d59eceeaea4b1ad1a626c3cc
SHA51297f5ae90a1bbacfe39b9e0f2954c24f9896cc9dca9d14364c438862996f3bbc04a4aa515742fccb3679d222c1302f5bb40c7eaddd6b5859d2d6ef79490243a4d
-
Filesize
188KB
MD507bb3f83b423098af18b278fb27e30e8
SHA1342c16f8fb15ab08b81caae45bb07a2c2e46df9c
SHA256e34e2e66ad58085be12331af700e233529048a3698a0f9a4d4ca3c0a3ae61222
SHA51219839f9c41edd667c397b2983939086ac85957ca12afd08c8a3b06797dcc19dc86d6c4df3acb33b17a199ee4a1e48d44311c81e8e31222158964009299b0df68
-
Filesize
152KB
MD5c9aceea91f08cf0c3f5a176b3a28bd3d
SHA1c6c648ebd2f84a62fca6250b6e700fde0e436d4b
SHA2566e06cc0b8151b8e253ebd4b6d87b59395ba5251f18cd61180578a592cbabf606
SHA512d6b7043054eac45e622f465a7ea60d51a5ebd63321f68bd6e83b191f364ba8767c0bfd614fb2b99cdee8411b4595940fef947a02c3b71c1f8814b588d6c7e165
-
Filesize
192KB
-
Filesize
192KB
-
Filesize
244KB
-
Filesize
188KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
1.9MB
-
Filesize
4KB
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
272KB
-
Filesize
48KB
-
Filesize
168KB
-
Filesize
48KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
244KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
160KB
-
Filesize
160KB