Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2024, 09:36
Static task
static1
Behavioral task
behavioral1
Sample
c073faa7326b20c97d4a144d6f149cf8_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
c073faa7326b20c97d4a144d6f149cf8_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
c073faa7326b20c97d4a144d6f149cf8_JaffaCakes118.exe
-
Size
376KB
-
MD5
c073faa7326b20c97d4a144d6f149cf8
-
SHA1
eff9d0e9e96d7945d9f823ee66f6e552a38c153c
-
SHA256
e290f43ea55d8d8f500cef14ba9170a6faa2a4c72efc27167848f624a055a0bb
-
SHA512
f52530895cbf074fb4bc579d31b6c643e3f51f6bd9771d69c73b2805284e467200025a1fa1a0b72004ecb9e0dacbc26fb2879f3f4261ba8c7853c36b9a8fe6db
-
SSDEEP
6144:zIHYsZbS31zXqSNQgeiOKnDYVH0pwpMWEmpRBJ1NuUBY+f7zAF11whggaoHofphE:zIVZel6SOgeiOKEVH0ppWfBJ7XBczmRr
Malware Config
Signatures
-
Gh0st RAT payload 12 IoCs
resource yara_rule behavioral2/memory/5064-7-0x0000000000400000-0x000000000054B000-memory.dmp family_gh0strat behavioral2/memory/5064-9-0x0000000000400000-0x000000000054B000-memory.dmp family_gh0strat behavioral2/memory/5064-10-0x0000000000401000-0x0000000000468000-memory.dmp family_gh0strat behavioral2/memory/5064-8-0x0000000000400000-0x000000000054B000-memory.dmp family_gh0strat behavioral2/memory/5064-11-0x0000000000400000-0x000000000054B000-memory.dmp family_gh0strat behavioral2/memory/3504-23-0x0000000000400000-0x000000000054B000-memory.dmp family_gh0strat behavioral2/memory/3504-22-0x0000000000400000-0x000000000054B000-memory.dmp family_gh0strat behavioral2/memory/3504-26-0x0000000000400000-0x000000000054B000-memory.dmp family_gh0strat behavioral2/memory/3504-21-0x0000000000400000-0x000000000054B000-memory.dmp family_gh0strat behavioral2/memory/3504-24-0x0000000000400000-0x000000000054B000-memory.dmp family_gh0strat behavioral2/memory/5064-28-0x0000000000400000-0x000000000054B000-memory.dmp family_gh0strat behavioral2/memory/5064-30-0x0000000000400000-0x000000000054B000-memory.dmp family_gh0strat -
Executes dropped EXE 1 IoCs
pid Process 3504 svchest425075242507520.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Kris = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c073faa7326b20c97d4a144d6f149cf8_JaffaCakes118.exe" c073faa7326b20c97d4a144d6f149cf8_JaffaCakes118.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created \??\c:\Windows\BJ.exe c073faa7326b20c97d4a144d6f149cf8_JaffaCakes118.exe File opened for modification \??\c:\Windows\BJ.exe c073faa7326b20c97d4a144d6f149cf8_JaffaCakes118.exe File created \??\c:\Windows\svchest425075242507520.exe c073faa7326b20c97d4a144d6f149cf8_JaffaCakes118.exe File opened for modification \??\c:\Windows\svchest425075242507520.exe c073faa7326b20c97d4a144d6f149cf8_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c073faa7326b20c97d4a144d6f149cf8_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchest425075242507520.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5064 wrote to memory of 3504 5064 c073faa7326b20c97d4a144d6f149cf8_JaffaCakes118.exe 84 PID 5064 wrote to memory of 3504 5064 c073faa7326b20c97d4a144d6f149cf8_JaffaCakes118.exe 84 PID 5064 wrote to memory of 3504 5064 c073faa7326b20c97d4a144d6f149cf8_JaffaCakes118.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\c073faa7326b20c97d4a144d6f149cf8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c073faa7326b20c97d4a144d6f149cf8_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\Windows\svchest425075242507520.exec:\Windows\svchest425075242507520.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3504
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
376KB
MD5c073faa7326b20c97d4a144d6f149cf8
SHA1eff9d0e9e96d7945d9f823ee66f6e552a38c153c
SHA256e290f43ea55d8d8f500cef14ba9170a6faa2a4c72efc27167848f624a055a0bb
SHA512f52530895cbf074fb4bc579d31b6c643e3f51f6bd9771d69c73b2805284e467200025a1fa1a0b72004ecb9e0dacbc26fb2879f3f4261ba8c7853c36b9a8fe6db