Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28-09-2024 15:35
Behavioral task
behavioral1
Sample
fc9b0b8b711e44ce0d4f91b0cedb1c76_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fc9b0b8b711e44ce0d4f91b0cedb1c76_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
fc9b0b8b711e44ce0d4f91b0cedb1c76_JaffaCakes118.exe
-
Size
68KB
-
MD5
fc9b0b8b711e44ce0d4f91b0cedb1c76
-
SHA1
7efc7fec7c6f04dd6cf00344f7d0781aa6858536
-
SHA256
b1912fe759ce5a90de1e18e62b39e416ed4fde549ae0b10bee4173f4bbb09c36
-
SHA512
1e0c4dc4cc865eccb20d1a92922fed7f923fe6225a21553f5a25f7a836db755b48285baad0d4da17a7a689790930ead38a491871c55fa21c6e4e497ea875c774
-
SSDEEP
1536:Jn/hoh1mHzLJksPEOajozLElnqiO2d7/Zu:Jn/swTLJkQ7zAV3d7/k
Malware Config
Extracted
gh0strat
chende8.f3322.org
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral1/files/0x000b000000012233-4.dat family_gh0strat -
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SRDSL\Parameters\ServiceDll = "C:\\Program Files (x86)\\Google\\259509987.dll" fc9b0b8b711e44ce0d4f91b0cedb1c76_JaffaCakes118.exe -
Deletes itself 1 IoCs
pid Process 2056 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2956 SRDSL.exe -
Loads dropped DLL 7 IoCs
pid Process 792 fc9b0b8b711e44ce0d4f91b0cedb1c76_JaffaCakes118.exe 2868 svchost.exe 2868 svchost.exe 2956 SRDSL.exe 2956 SRDSL.exe 2956 SRDSL.exe 2956 SRDSL.exe -
Creates a Windows Service
-
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\SRDSL.exe svchost.exe File opened for modification C:\Windows\SysWOW64\SRDSL.exe svchost.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\Google\259509987.dll fc9b0b8b711e44ce0d4f91b0cedb1c76_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fc9b0b8b711e44ce0d4f91b0cedb1c76_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SRDSL.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2800 PING.EXE 2056 cmd.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2800 PING.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 792 fc9b0b8b711e44ce0d4f91b0cedb1c76_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 792 fc9b0b8b711e44ce0d4f91b0cedb1c76_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 792 fc9b0b8b711e44ce0d4f91b0cedb1c76_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 792 wrote to memory of 2056 792 fc9b0b8b711e44ce0d4f91b0cedb1c76_JaffaCakes118.exe 32 PID 792 wrote to memory of 2056 792 fc9b0b8b711e44ce0d4f91b0cedb1c76_JaffaCakes118.exe 32 PID 792 wrote to memory of 2056 792 fc9b0b8b711e44ce0d4f91b0cedb1c76_JaffaCakes118.exe 32 PID 792 wrote to memory of 2056 792 fc9b0b8b711e44ce0d4f91b0cedb1c76_JaffaCakes118.exe 32 PID 2056 wrote to memory of 2800 2056 cmd.exe 34 PID 2056 wrote to memory of 2800 2056 cmd.exe 34 PID 2056 wrote to memory of 2800 2056 cmd.exe 34 PID 2056 wrote to memory of 2800 2056 cmd.exe 34 PID 2868 wrote to memory of 2956 2868 svchost.exe 35 PID 2868 wrote to memory of 2956 2868 svchost.exe 35 PID 2868 wrote to memory of 2956 2868 svchost.exe 35 PID 2868 wrote to memory of 2956 2868 svchost.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc9b0b8b711e44ce0d4f91b0cedb1c76_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fc9b0b8b711e44ce0d4f91b0cedb1c76_JaffaCakes118.exe"1⤵
- Server Software Component: Terminal Services DLL
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:792 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 1 && del /f/q "C:\Users\Admin\AppData\Local\Temp\fc9b0b8b711e44ce0d4f91b0cedb1c76_JaffaCakes118.exe"2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2800
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "SRDSL"1⤵PID:2204
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "SRDSL"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\SysWOW64\SRDSL.exeC:\Windows\system32\SRDSL.exe "c:\program files (x86)\google\259509987.dll",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2956
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37KB
MD5c506bbb3f9b4a0efbb4164941f21dd41
SHA1beff44f3c83721c6360f9277c5faa9a39e5f0f95
SHA2563c912cf79a0ba3df7dadb7fe4a415c80d875ef19881f569dd61b3ce390f8d0bc
SHA5129394a9311d067cde2409de9bd364256a72100ee327f6902f0a2ee70f26f4e71625866f0c7699708e92199bc680e45f17be2d2867ddfebf925aca1b77baa2eff8
-
Filesize
43KB
MD551138beea3e2c21ec44d0932c71762a8
SHA18939cf35447b22dd2c6e6f443446acc1bf986d58
SHA2565ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
SHA512794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d