Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
15/09/2024, 11:02
Behavioral task
behavioral1
Sample
e2550344fd15408fb2d43a230f4c1ff7_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
e2550344fd15408fb2d43a230f4c1ff7_JaffaCakes118.exe
Resource
win10v2004-20240910-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
e2550344fd15408fb2d43a230f4c1ff7_JaffaCakes118.exe
-
Size
113KB
-
MD5
e2550344fd15408fb2d43a230f4c1ff7
-
SHA1
bb8216ace49da4158166c8fe9e46be797f1bc609
-
SHA256
dfc7d3a9a884304c3adca7d6118d08988319bb86289cbda42750485df97020e6
-
SHA512
354b63d4c805e7fab427c9f06f22f0b5ec103a354b7738922e53c47fae2d8c121c686a0170a2e59d47888c2b4c6da7a4fbfba729246f8ae86c6eea0c68312456
-
SSDEEP
1536:T/JHe0U26jOEg+yuq9ceVrfsGS50vCx3bodc6kEJCizUAJ:TxzKOEVfq9pV7sGSw/vkEJCEJ
Score
10/10
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral1/memory/2532-11-0x0000000000400000-0x0000000000421000-memory.dmp family_gh0strat -
Executes dropped EXE 1 IoCs
pid Process 2340 svchost.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\KRIS = "C:\\Windows\\svchost.exe" e2550344fd15408fb2d43a230f4c1ff7_JaffaCakes118.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\svchest.ini svchost.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\svchost.exe e2550344fd15408fb2d43a230f4c1ff7_JaffaCakes118.exe File opened for modification C:\Windows\svchost.exe e2550344fd15408fb2d43a230f4c1ff7_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e2550344fd15408fb2d43a230f4c1ff7_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe -
Kills process with taskkill 2 IoCs
pid Process 2380 taskkill.exe 2848 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 51 IoCs
pid Process 2340 svchost.exe 2340 svchost.exe 2340 svchost.exe 2340 svchost.exe 2340 svchost.exe 2340 svchost.exe 2340 svchost.exe 2340 svchost.exe 2340 svchost.exe 2340 svchost.exe 2340 svchost.exe 2340 svchost.exe 2340 svchost.exe 2340 svchost.exe 2340 svchost.exe 2340 svchost.exe 2340 svchost.exe 2340 svchost.exe 2340 svchost.exe 2340 svchost.exe 2340 svchost.exe 2340 svchost.exe 2340 svchost.exe 2340 svchost.exe 2340 svchost.exe 2340 svchost.exe 2340 svchost.exe 2340 svchost.exe 2340 svchost.exe 2340 svchost.exe 2340 svchost.exe 2340 svchost.exe 2340 svchost.exe 2340 svchost.exe 2340 svchost.exe 2340 svchost.exe 2340 svchost.exe 2340 svchost.exe 2340 svchost.exe 2340 svchost.exe 2340 svchost.exe 2340 svchost.exe 2340 svchost.exe 2340 svchost.exe 2340 svchost.exe 2340 svchost.exe 2340 svchost.exe 2340 svchost.exe 2340 svchost.exe 2340 svchost.exe 2340 svchost.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2532 e2550344fd15408fb2d43a230f4c1ff7_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2380 taskkill.exe Token: SeDebugPrivilege 2848 taskkill.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2532 wrote to memory of 2380 2532 e2550344fd15408fb2d43a230f4c1ff7_JaffaCakes118.exe 30 PID 2532 wrote to memory of 2380 2532 e2550344fd15408fb2d43a230f4c1ff7_JaffaCakes118.exe 30 PID 2532 wrote to memory of 2380 2532 e2550344fd15408fb2d43a230f4c1ff7_JaffaCakes118.exe 30 PID 2532 wrote to memory of 2380 2532 e2550344fd15408fb2d43a230f4c1ff7_JaffaCakes118.exe 30 PID 2532 wrote to memory of 2380 2532 e2550344fd15408fb2d43a230f4c1ff7_JaffaCakes118.exe 30 PID 2532 wrote to memory of 2380 2532 e2550344fd15408fb2d43a230f4c1ff7_JaffaCakes118.exe 30 PID 2532 wrote to memory of 2380 2532 e2550344fd15408fb2d43a230f4c1ff7_JaffaCakes118.exe 30 PID 2532 wrote to memory of 2340 2532 e2550344fd15408fb2d43a230f4c1ff7_JaffaCakes118.exe 33 PID 2532 wrote to memory of 2340 2532 e2550344fd15408fb2d43a230f4c1ff7_JaffaCakes118.exe 33 PID 2532 wrote to memory of 2340 2532 e2550344fd15408fb2d43a230f4c1ff7_JaffaCakes118.exe 33 PID 2532 wrote to memory of 2340 2532 e2550344fd15408fb2d43a230f4c1ff7_JaffaCakes118.exe 33 PID 2532 wrote to memory of 2340 2532 e2550344fd15408fb2d43a230f4c1ff7_JaffaCakes118.exe 33 PID 2532 wrote to memory of 2340 2532 e2550344fd15408fb2d43a230f4c1ff7_JaffaCakes118.exe 33 PID 2532 wrote to memory of 2340 2532 e2550344fd15408fb2d43a230f4c1ff7_JaffaCakes118.exe 33 PID 2340 wrote to memory of 2848 2340 svchost.exe 34 PID 2340 wrote to memory of 2848 2340 svchost.exe 34 PID 2340 wrote to memory of 2848 2340 svchost.exe 34 PID 2340 wrote to memory of 2848 2340 svchost.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2550344fd15408fb2d43a230f4c1ff7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e2550344fd15408fb2d43a230f4c1ff7_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Ksafetray.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2380
-
-
C:\Windows\svchost.exeC:\Windows\svchost.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Ksafetray.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2848
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97B
MD55a7d6cf04073e01489fb3adec3a77b3c
SHA1791b5c0d375286677cf57a6ee2d9bda9c214df62
SHA256d8dc40b969bec9cf1498bff75da01c2f4d563fd5c0de7ce0d6f6f7a566cf551e
SHA5127b4e92e8232a87fcc6c5f8ebc191d53bd99fc9d023b145d5c4c38b96c00c5f4cfad724c36a5402474f8d50490da87acb893bdd2363fa5cc045686cb4ff28b97b