Analysis

  • max time kernel
    150s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    25/08/2024, 09:36

General

  • Target

    c073faa7326b20c97d4a144d6f149cf8_JaffaCakes118.exe

  • Size

    376KB

  • MD5

    c073faa7326b20c97d4a144d6f149cf8

  • SHA1

    eff9d0e9e96d7945d9f823ee66f6e552a38c153c

  • SHA256

    e290f43ea55d8d8f500cef14ba9170a6faa2a4c72efc27167848f624a055a0bb

  • SHA512

    f52530895cbf074fb4bc579d31b6c643e3f51f6bd9771d69c73b2805284e467200025a1fa1a0b72004ecb9e0dacbc26fb2879f3f4261ba8c7853c36b9a8fe6db

  • SSDEEP

    6144:zIHYsZbS31zXqSNQgeiOKnDYVH0pwpMWEmpRBJ1NuUBY+f7zAF11whggaoHofphE:zIVZel6SOgeiOKEVH0ppWfBJ7XBczmRr

Malware Config

Signatures

  • Gh0st RAT payload 13 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c073faa7326b20c97d4a144d6f149cf8_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\c073faa7326b20c97d4a144d6f149cf8_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2104
    • \??\c:\Windows\svchest000.exe
      c:\Windows\svchest000.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2560

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\svchest000.exe

    Filesize

    376KB

    MD5

    c073faa7326b20c97d4a144d6f149cf8

    SHA1

    eff9d0e9e96d7945d9f823ee66f6e552a38c153c

    SHA256

    e290f43ea55d8d8f500cef14ba9170a6faa2a4c72efc27167848f624a055a0bb

    SHA512

    f52530895cbf074fb4bc579d31b6c643e3f51f6bd9771d69c73b2805284e467200025a1fa1a0b72004ecb9e0dacbc26fb2879f3f4261ba8c7853c36b9a8fe6db

  • memory/2104-11-0x0000000000400000-0x000000000054B000-memory.dmp

    Filesize

    1.3MB

  • memory/2104-9-0x0000000000400000-0x000000000054B000-memory.dmp

    Filesize

    1.3MB

  • memory/2104-6-0x0000000000310000-0x0000000000311000-memory.dmp

    Filesize

    4KB

  • memory/2104-5-0x0000000000300000-0x0000000000302000-memory.dmp

    Filesize

    8KB

  • memory/2104-4-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/2104-3-0x0000000000400000-0x000000000054B000-memory.dmp

    Filesize

    1.3MB

  • memory/2104-16-0x0000000002D70000-0x0000000002EBB000-memory.dmp

    Filesize

    1.3MB

  • memory/2104-30-0x0000000000400000-0x000000000054B000-memory.dmp

    Filesize

    1.3MB

  • memory/2104-2-0x00000000002C0000-0x00000000002FE000-memory.dmp

    Filesize

    248KB

  • memory/2104-8-0x0000000000400000-0x000000000054B000-memory.dmp

    Filesize

    1.3MB

  • memory/2104-10-0x0000000000401000-0x0000000000468000-memory.dmp

    Filesize

    412KB

  • memory/2104-7-0x0000000000400000-0x000000000054B000-memory.dmp

    Filesize

    1.3MB

  • memory/2104-1-0x00000000002C0000-0x00000000002FE000-memory.dmp

    Filesize

    248KB

  • memory/2104-0-0x0000000000400000-0x000000000054B000-memory.dmp

    Filesize

    1.3MB

  • memory/2104-35-0x0000000000400000-0x000000000054B000-memory.dmp

    Filesize

    1.3MB

  • memory/2104-34-0x0000000002D70000-0x0000000002EBB000-memory.dmp

    Filesize

    1.3MB

  • memory/2104-33-0x00000000002C0000-0x00000000002FE000-memory.dmp

    Filesize

    248KB

  • memory/2560-19-0x0000000000400000-0x000000000054B000-memory.dmp

    Filesize

    1.3MB

  • memory/2560-29-0x0000000000400000-0x000000000054B000-memory.dmp

    Filesize

    1.3MB

  • memory/2560-28-0x0000000000260000-0x000000000029E000-memory.dmp

    Filesize

    248KB

  • memory/2560-27-0x0000000000400000-0x000000000054B000-memory.dmp

    Filesize

    1.3MB

  • memory/2560-25-0x0000000000400000-0x000000000054B000-memory.dmp

    Filesize

    1.3MB

  • memory/2560-26-0x0000000000400000-0x000000000054B000-memory.dmp

    Filesize

    1.3MB

  • memory/2560-23-0x0000000000400000-0x000000000054B000-memory.dmp

    Filesize

    1.3MB

  • memory/2560-22-0x0000000000400000-0x000000000054B000-memory.dmp

    Filesize

    1.3MB

  • memory/2560-24-0x0000000000400000-0x000000000054B000-memory.dmp

    Filesize

    1.3MB

  • memory/2560-21-0x0000000000260000-0x000000000029E000-memory.dmp

    Filesize

    248KB

  • memory/2560-20-0x0000000000400000-0x000000000054B000-memory.dmp

    Filesize

    1.3MB