Analysis
-
max time kernel
94s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
19-09-2024 07:46
General
-
Target
eae0f060e9cdbbfcc339be22f8f2dfcc_JaffaCakes118.exe
-
Size
407KB
-
MD5
eae0f060e9cdbbfcc339be22f8f2dfcc
-
SHA1
a06562b70bd216c0a4b0127e1aa3b4c81f12d3e8
-
SHA256
fcc1ceb396524d78f9f38d32491cefbef7115dbf75d33fe9e517f1efa8677231
-
SHA512
257bd1bfe2e996cfc38724dab6bcca192497901604105cc6716cfb612d5856c652a082164158f9e515e77e3be5861797e970075b040b85af9ba4595370ea70a1
-
SSDEEP
6144:qBk/uxfMb0kAKtF2idZecnl20lHRxp3geN+x704wANEHMywbC3FiAHQz:ok/uVIRXF3Z4mxxr+x79w7HLj3FiM6
Malware Config
Signatures
-
Gh0st RAT payload 2 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Drops file in Drivers directory 2 IoCs
-
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\eae0f060e9cdbbfcc339be22f8f2dfcc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\eae0f060e9cdbbfcc339be22f8f2dfcc_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\server.exe2⤵
- Drops file in Drivers directory
- Server Software Component: Terminal Services DLL
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s FastUserSwitchingCompatibility1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
123KB
MD55d8e2b0dd876c51d33ef7dbfa5f32c76
SHA1d805f6b5f89dcc51c01a716c4dab1903487f42a8
SHA25604c4bd5acfbfa701dc907160372cab54ef638e0067590d7e9d959d1ec5780cdc
SHA512b41d6e923d3b1e1f68a03badb7cff2a8f70b07708f1dd18bbcdb6dd0d3192584238829c80373ebcda3c103f659955808c34af7b1ac6a0f73f017df2fc0b5f34b
-
Filesize
88KB
MD5c7587bdf96418cc1aae3d7873b25430d
SHA1ed01eceac2df45889c60a11fcd7460ca6450addf
SHA25678e4cd5523e6981e84148ab862ccb444be1293bbd7e9ec1df68297c077c2b79a
SHA512fec44cd2382daddf662ec707cf2ec44aec7f4c89fa744fb68b31095ffa2a6ae52b04ec1de30da572cdb6694b47e321bf2dff5e25c4f0d804805a3b78cc206aa9
-
Filesize
55B
MD57d9f1a6ad1c9dea7b8c1edc871d153bb
SHA11e3a0ebcb7dea1e1390d6ad20c5e104c2c3959d6
SHA2561b67b7351ffefa2bbdce718d456bce31f2597d89e50ed675c91f488bd2983292
SHA5129ffb3c56785a6af250588f055ab4ca8ccc5fcc98c4045a7826728d1c96de30e567865c577c97d41deeccf04d108f63c04336488840e470167334b2e760e28f2b
-
Filesize
552KB
-
Filesize
336KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
552KB
-
Filesize
336KB