Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
07-09-2024 08:50
General
-
Target
d18b8155048708a4fcb9acdb69dd5705_JaffaCakes118.exe
-
Size
96KB
-
MD5
d18b8155048708a4fcb9acdb69dd5705
-
SHA1
5fee7d5bb5a409f289297da9afb36a54f7ca5138
-
SHA256
d10fca34e6d0db1c4eed0db56f51abaadcf8ed1dea1aecbe7693394332eb9d06
-
SHA512
328f9646e3f65c3562024d6f0988b82b97db67fc351501d3078cfce5e20422b23fb6d55cb7c26afaf761f29ab0728411c860138c4fc71096836e517a4e759941
-
SSDEEP
1536:chFusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8prlaSXJtyhsw:c3S4jHS8q/3nTzePCwNUh4E9laSXLyh/
Malware Config
Signatures
-
Gh0st RAT payload 4 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 6 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 18 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d18b8155048708a4fcb9acdb69dd5705_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d18b8155048708a4fcb9acdb69dd5705_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\dtpxrbcxpi"C:\Users\Admin\AppData\Local\Temp\d18b8155048708a4fcb9acdb69dd5705_JaffaCakes118.exe" a -sc:\users\admin\appdata\local\temp\d18b8155048708a4fcb9acdb69dd5705_jaffacakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
23.0MB
MD54845036bdf83a4e7b47d10383cec27e2
SHA1904323a78addbc81d4a997938a128482f7c105ab
SHA256eb01edd803ebbeb075663ad088ca487d0a0dd073339a30a60f9c52b238acb11f
SHA51264e769feeae3b564b33114b07e2ccf9483c011a80aa39c2d9fffff799a2b33c896338e3bbb6f97dd02a4a4d008dcf14968607542072a732e32fa10c888621d4f
-
Filesize
20.6MB
MD5afe3c22a67af2aace005a1da678c337e
SHA172cf25f6c5eee3a2797d6bcf9bac3e9598d9ab1e
SHA25648223fd3634681ec067f6ec890c0b84afd72f3570786573783b55fb9d7ea601e
SHA512bc670a97a0d95b3a278f779032ee46a59bd7cfc8dc1415b157971a1ba1318a5c79ebcff82be41cf853bd056f182438ecca1f2a4e8d490fe1cce352cddc6e5c47
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
4KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
4KB
-
Filesize
312KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
4KB
-
Filesize
316KB
-
Filesize
312KB