Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
25/08/2024, 09:36
Static task
static1
Behavioral task
behavioral1
Sample
c073faa7326b20c97d4a144d6f149cf8_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
c073faa7326b20c97d4a144d6f149cf8_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
c073faa7326b20c97d4a144d6f149cf8_JaffaCakes118.exe
-
Size
376KB
-
MD5
c073faa7326b20c97d4a144d6f149cf8
-
SHA1
eff9d0e9e96d7945d9f823ee66f6e552a38c153c
-
SHA256
e290f43ea55d8d8f500cef14ba9170a6faa2a4c72efc27167848f624a055a0bb
-
SHA512
f52530895cbf074fb4bc579d31b6c643e3f51f6bd9771d69c73b2805284e467200025a1fa1a0b72004ecb9e0dacbc26fb2879f3f4261ba8c7853c36b9a8fe6db
-
SSDEEP
6144:zIHYsZbS31zXqSNQgeiOKnDYVH0pwpMWEmpRBJ1NuUBY+f7zAF11whggaoHofphE:zIVZel6SOgeiOKEVH0ppWfBJ7XBczmRr
Malware Config
Signatures
-
Gh0st RAT payload 13 IoCs
resource yara_rule behavioral1/memory/2104-11-0x0000000000400000-0x000000000054B000-memory.dmp family_gh0strat behavioral1/memory/2104-10-0x0000000000401000-0x0000000000468000-memory.dmp family_gh0strat behavioral1/memory/2104-9-0x0000000000400000-0x000000000054B000-memory.dmp family_gh0strat behavioral1/memory/2104-8-0x0000000000400000-0x000000000054B000-memory.dmp family_gh0strat behavioral1/memory/2104-7-0x0000000000400000-0x000000000054B000-memory.dmp family_gh0strat behavioral1/memory/2560-24-0x0000000000400000-0x000000000054B000-memory.dmp family_gh0strat behavioral1/memory/2104-30-0x0000000000400000-0x000000000054B000-memory.dmp family_gh0strat behavioral1/memory/2560-29-0x0000000000400000-0x000000000054B000-memory.dmp family_gh0strat behavioral1/memory/2560-27-0x0000000000400000-0x000000000054B000-memory.dmp family_gh0strat behavioral1/memory/2560-25-0x0000000000400000-0x000000000054B000-memory.dmp family_gh0strat behavioral1/memory/2560-26-0x0000000000400000-0x000000000054B000-memory.dmp family_gh0strat behavioral1/memory/2560-23-0x0000000000400000-0x000000000054B000-memory.dmp family_gh0strat behavioral1/memory/2104-35-0x0000000000400000-0x000000000054B000-memory.dmp family_gh0strat -
Executes dropped EXE 1 IoCs
pid Process 2560 svchest000.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Kris = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c073faa7326b20c97d4a144d6f149cf8_JaffaCakes118.exe" c073faa7326b20c97d4a144d6f149cf8_JaffaCakes118.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification \??\c:\Windows\BJ.exe c073faa7326b20c97d4a144d6f149cf8_JaffaCakes118.exe File created \??\c:\Windows\BJ.exe c073faa7326b20c97d4a144d6f149cf8_JaffaCakes118.exe File created \??\c:\Windows\svchest000.exe c073faa7326b20c97d4a144d6f149cf8_JaffaCakes118.exe File opened for modification \??\c:\Windows\svchest000.exe c073faa7326b20c97d4a144d6f149cf8_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c073faa7326b20c97d4a144d6f149cf8_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchest000.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2104 wrote to memory of 2560 2104 c073faa7326b20c97d4a144d6f149cf8_JaffaCakes118.exe 30 PID 2104 wrote to memory of 2560 2104 c073faa7326b20c97d4a144d6f149cf8_JaffaCakes118.exe 30 PID 2104 wrote to memory of 2560 2104 c073faa7326b20c97d4a144d6f149cf8_JaffaCakes118.exe 30 PID 2104 wrote to memory of 2560 2104 c073faa7326b20c97d4a144d6f149cf8_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\c073faa7326b20c97d4a144d6f149cf8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c073faa7326b20c97d4a144d6f149cf8_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\Windows\svchest000.exec:\Windows\svchest000.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2560
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
376KB
MD5c073faa7326b20c97d4a144d6f149cf8
SHA1eff9d0e9e96d7945d9f823ee66f6e552a38c153c
SHA256e290f43ea55d8d8f500cef14ba9170a6faa2a4c72efc27167848f624a055a0bb
SHA512f52530895cbf074fb4bc579d31b6c643e3f51f6bd9771d69c73b2805284e467200025a1fa1a0b72004ecb9e0dacbc26fb2879f3f4261ba8c7853c36b9a8fe6db