Analysis
-
max time kernel
145s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
24-08-2024 04:46
General
-
Target
bdeae0db47216ff68d46763fe6cab9f8_JaffaCakes118.exe
-
Size
96KB
-
MD5
bdeae0db47216ff68d46763fe6cab9f8
-
SHA1
b8f1fe96444e83c1a48497c7469c04ed5e9c7787
-
SHA256
023d3b4d9ccb843ceb8e367ae2dd2a84a7d9834bdcc2dac60a112f10eb4ad189
-
SHA512
bf825dd542f62c1fe6ec688940812d46bbb4aa72c394e53017e90871044dc457675f9d9baf377d04a9b176c967a108e6225ffc0df8f6933710785f2519c5d0a4
-
SSDEEP
1536:xhFusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8pr5lqiOaN:x3S4jHS8q/3nTzePCwNUh4E95l8aN
Malware Config
Signatures
-
Gh0st RAT payload 3 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 18 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bdeae0db47216ff68d46763fe6cab9f8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\bdeae0db47216ff68d46763fe6cab9f8_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\ggotkrnldq"C:\Users\Admin\AppData\Local\Temp\bdeae0db47216ff68d46763fe6cab9f8_JaffaCakes118.exe" a -sc:\users\admin\appdata\local\temp\bdeae0db47216ff68d46763fe6cab9f8_jaffacakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21.0MB
MD5804010a137c9d5535c529af9356e6fa4
SHA140bcb8da19ac9e41e194e7a7c990ed73d17e1212
SHA256b172bbe9a94d16b394aa89dd656ba481ac1fa6876aaf8d597bc986e47fdcd871
SHA512cd0248d3d1291a947dfab8871aee776f364ecbbdc3d85833e64b1631c41e7dcaa27f07026656b477ae2a5adb5487cbb7211060c14eeca02b2daed15ebcadb70b
-
Filesize
22.4MB
MD563c47d885241c9bcc71c7a6e51a399d6
SHA108ee8779e1e21e6374daae973a0c0f51c3482dd2
SHA2566b00deb07fc79fb93f0d6bcee433afd47a018976b6e1be5a6084951609dec201
SHA512932119c0080dbeceebec03094945c70cbb69c6fc0e1db797b258238426b875e17c9ba4433c32e622c4cc555a11411bd0e425f7e7883ea36b95831ff348d4fc26
-
Filesize
4KB
-
Filesize
156KB
-
Filesize
312KB
-
Filesize
4KB
-
Filesize
316KB
-
Filesize
312KB
-
Filesize
316KB
-
Filesize
4KB
-
Filesize
312KB
-
Filesize
312KB