Analysis
-
max time kernel
147s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
19-09-2024 05:45
Behavioral task
behavioral1
Sample
eab1f2cce4b90a663cd15c4baf8b669c_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
eab1f2cce4b90a663cd15c4baf8b669c_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
eab1f2cce4b90a663cd15c4baf8b669c_JaffaCakes118.exe
-
Size
115KB
-
MD5
eab1f2cce4b90a663cd15c4baf8b669c
-
SHA1
729081966507d6b9cf47c34f43640943f82ab603
-
SHA256
73d8f94b4c0b7eb04a2f92f27188c2e8d9d4d4d2893e5d0eee7aa7a4701d1ccd
-
SHA512
b616e597bf659c39a4d14a33a1df609ee90987031f807a9469ba18658e51b988b8c9d845ab81afbb6c10bedc39873ca26fa196f0f1afaf08e65670f0da8b6c32
-
SSDEEP
1536:+V7dQNkfaVcwKC6W0cgaWoKfMpUNZpB34zgOBkTYSzUA:IBfp/W0TMMMpUn5OBkTL
Score
10/10
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral1/memory/784-10-0x0000000000400000-0x0000000000422000-memory.dmp family_gh0strat -
Executes dropped EXE 1 IoCs
pid Process 2280 Sogou.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\KRIS = "C:\\Windows\\Sogou.exe" eab1f2cce4b90a663cd15c4baf8b669c_JaffaCakes118.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\svchest.ini Sogou.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Sogou.exe eab1f2cce4b90a663cd15c4baf8b669c_JaffaCakes118.exe File opened for modification C:\Windows\Sogou.exe eab1f2cce4b90a663cd15c4baf8b669c_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eab1f2cce4b90a663cd15c4baf8b669c_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sogou.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe -
Kills process with taskkill 2 IoCs
pid Process 2624 taskkill.exe 2636 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 51 IoCs
pid Process 2280 Sogou.exe 2280 Sogou.exe 2280 Sogou.exe 2280 Sogou.exe 2280 Sogou.exe 2280 Sogou.exe 2280 Sogou.exe 2280 Sogou.exe 2280 Sogou.exe 2280 Sogou.exe 2280 Sogou.exe 2280 Sogou.exe 2280 Sogou.exe 2280 Sogou.exe 2280 Sogou.exe 2280 Sogou.exe 2280 Sogou.exe 2280 Sogou.exe 2280 Sogou.exe 2280 Sogou.exe 2280 Sogou.exe 2280 Sogou.exe 2280 Sogou.exe 2280 Sogou.exe 2280 Sogou.exe 2280 Sogou.exe 2280 Sogou.exe 2280 Sogou.exe 2280 Sogou.exe 2280 Sogou.exe 2280 Sogou.exe 2280 Sogou.exe 2280 Sogou.exe 2280 Sogou.exe 2280 Sogou.exe 2280 Sogou.exe 2280 Sogou.exe 2280 Sogou.exe 2280 Sogou.exe 2280 Sogou.exe 2280 Sogou.exe 2280 Sogou.exe 2280 Sogou.exe 2280 Sogou.exe 2280 Sogou.exe 2280 Sogou.exe 2280 Sogou.exe 2280 Sogou.exe 2280 Sogou.exe 2280 Sogou.exe 2280 Sogou.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 784 eab1f2cce4b90a663cd15c4baf8b669c_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2624 taskkill.exe Token: SeDebugPrivilege 2636 taskkill.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 784 wrote to memory of 2624 784 eab1f2cce4b90a663cd15c4baf8b669c_JaffaCakes118.exe 31 PID 784 wrote to memory of 2624 784 eab1f2cce4b90a663cd15c4baf8b669c_JaffaCakes118.exe 31 PID 784 wrote to memory of 2624 784 eab1f2cce4b90a663cd15c4baf8b669c_JaffaCakes118.exe 31 PID 784 wrote to memory of 2624 784 eab1f2cce4b90a663cd15c4baf8b669c_JaffaCakes118.exe 31 PID 784 wrote to memory of 2624 784 eab1f2cce4b90a663cd15c4baf8b669c_JaffaCakes118.exe 31 PID 784 wrote to memory of 2624 784 eab1f2cce4b90a663cd15c4baf8b669c_JaffaCakes118.exe 31 PID 784 wrote to memory of 2624 784 eab1f2cce4b90a663cd15c4baf8b669c_JaffaCakes118.exe 31 PID 784 wrote to memory of 2280 784 eab1f2cce4b90a663cd15c4baf8b669c_JaffaCakes118.exe 34 PID 784 wrote to memory of 2280 784 eab1f2cce4b90a663cd15c4baf8b669c_JaffaCakes118.exe 34 PID 784 wrote to memory of 2280 784 eab1f2cce4b90a663cd15c4baf8b669c_JaffaCakes118.exe 34 PID 784 wrote to memory of 2280 784 eab1f2cce4b90a663cd15c4baf8b669c_JaffaCakes118.exe 34 PID 784 wrote to memory of 2280 784 eab1f2cce4b90a663cd15c4baf8b669c_JaffaCakes118.exe 34 PID 784 wrote to memory of 2280 784 eab1f2cce4b90a663cd15c4baf8b669c_JaffaCakes118.exe 34 PID 784 wrote to memory of 2280 784 eab1f2cce4b90a663cd15c4baf8b669c_JaffaCakes118.exe 34 PID 2280 wrote to memory of 2636 2280 Sogou.exe 35 PID 2280 wrote to memory of 2636 2280 Sogou.exe 35 PID 2280 wrote to memory of 2636 2280 Sogou.exe 35 PID 2280 wrote to memory of 2636 2280 Sogou.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\eab1f2cce4b90a663cd15c4baf8b669c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\eab1f2cce4b90a663cd15c4baf8b669c_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:784 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Ksafetray.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2624
-
-
C:\Windows\Sogou.exeC:\Windows\Sogou.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Ksafetray.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2636
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
95B
MD5ada4897bfbfa9a03bd04383a74792d56
SHA1bc4566e4d74131737579b3d9448bb114e0a448c5
SHA25694dc135d99694ceb531c0552565e694886e4f181e3f08e9c1e6ece566dcaf378
SHA5122c2daf6818ba4205402fc7d1d3878cfba87d79ed533688293d0c391416db2c2f80af25d5193de50795495846c0b15cf09e9ae5d108b9d098f6af7b694acc1f04