Analysis
-
max time kernel
145s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
19-09-2024 15:21
Static task
static1
Behavioral task
behavioral1
Sample
eb9e74f678a94aba17d162e5a17032a9_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
eb9e74f678a94aba17d162e5a17032a9_JaffaCakes118.exe
-
Size
96KB
-
MD5
eb9e74f678a94aba17d162e5a17032a9
-
SHA1
ad70db34db4581d143cd8e95abfec2d97f08dcc0
-
SHA256
9a5450e1baba6555a610a63581db6b90d767eb894c3fb70d183bd4c90a987a86
-
SHA512
c10d948270183eb9b3968aca98fbf8dc3bfe709c57ba4906831c275a009d5f150f80d44abff7513b8320d4f13987afe76e041484648b854b70dea0e239f9862e
-
SSDEEP
1536:YXFusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8prsrXK146nhI:YhS4jHS8q/3nTzePCwNUh4E9sT6nhI
Malware Config
Signatures
-
Gh0st RAT payload 3 IoCs
resource yara_rule behavioral1/files/0x0009000000016e1d-20.dat family_gh0strat behavioral1/memory/2656-22-0x0000000000400000-0x000000000044E2BC-memory.dmp family_gh0strat behavioral1/memory/2848-26-0x0000000020000000-0x0000000020027000-memory.dmp family_gh0strat -
Deletes itself 1 IoCs
pid Process 2656 hncrnfktpv -
Executes dropped EXE 1 IoCs
pid Process 2656 hncrnfktpv -
Loads dropped DLL 3 IoCs
pid Process 2364 eb9e74f678a94aba17d162e5a17032a9_JaffaCakes118.exe 2364 eb9e74f678a94aba17d162e5a17032a9_JaffaCakes118.exe 2848 svchost.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 svchost.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\pafamtndvp svchost.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hncrnfktpv Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eb9e74f678a94aba17d162e5a17032a9_JaffaCakes118.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe -
Modifies data under HKEY_USERS 6 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum\Version = "7" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie svchost.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2656 hncrnfktpv 2848 svchost.exe 2848 svchost.exe 2848 svchost.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeRestorePrivilege 2656 hncrnfktpv Token: SeBackupPrivilege 2656 hncrnfktpv Token: SeBackupPrivilege 2656 hncrnfktpv Token: SeRestorePrivilege 2656 hncrnfktpv Token: SeBackupPrivilege 2848 svchost.exe Token: SeBackupPrivilege 2848 svchost.exe Token: SeSecurityPrivilege 2848 svchost.exe Token: SeRestorePrivilege 2848 svchost.exe Token: SeSecurityPrivilege 2848 svchost.exe Token: SeBackupPrivilege 2848 svchost.exe Token: SeBackupPrivilege 2848 svchost.exe Token: SeSecurityPrivilege 2848 svchost.exe Token: SeBackupPrivilege 2848 svchost.exe Token: SeBackupPrivilege 2848 svchost.exe Token: SeSecurityPrivilege 2848 svchost.exe Token: SeBackupPrivilege 2848 svchost.exe Token: SeRestorePrivilege 2848 svchost.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2364 wrote to memory of 2656 2364 eb9e74f678a94aba17d162e5a17032a9_JaffaCakes118.exe 30 PID 2364 wrote to memory of 2656 2364 eb9e74f678a94aba17d162e5a17032a9_JaffaCakes118.exe 30 PID 2364 wrote to memory of 2656 2364 eb9e74f678a94aba17d162e5a17032a9_JaffaCakes118.exe 30 PID 2364 wrote to memory of 2656 2364 eb9e74f678a94aba17d162e5a17032a9_JaffaCakes118.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb9e74f678a94aba17d162e5a17032a9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\eb9e74f678a94aba17d162e5a17032a9_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\users\admin\appdata\local\hncrnfktpv"C:\Users\Admin\AppData\Local\Temp\eb9e74f678a94aba17d162e5a17032a9_JaffaCakes118.exe" a -sc:\users\admin\appdata\local\temp\eb9e74f678a94aba17d162e5a17032a9_jaffacakes118.exe2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2656
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2848
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
23.4MB
MD5f07e901d5e8ae2b6dd92b6adbd413d7d
SHA140d72afd61eda5591e6e1ecd25614f5884594302
SHA256ff2bf2422bd77853bed1f9c85c0f5f132aeb38c13ea8bbd40a1a6e5c12b1bb03
SHA512bdc23b69c554953b03b08a0cb3d5afd3d82af37769551147035b6335b25b2d54d6e870383a60267a7cfb1df518fcde6f684d97ba68740f7ba29da0a625921ad9
-
Filesize
24.1MB
MD575421fcbda4e1bcdeec908139d523b8b
SHA1b14165cf2ac9d37abcc1d19b87a2cd56561e4418
SHA2569cce4136041b64cf058352438801204756b5239f9821cf38a590cb563b41c560
SHA512d4e9e3c26d90b116ac308e6fd0c9a5ee225cb5245bf84f53b63ceccf93b011d6956381deca94b1f24b575dada35eeed0e1a67f42a29544b634d01ae13f1716df