Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13/10/2024, 20:22
Behavioral task
behavioral1
Sample
41e562a465bd7f3aa2a28b9bfeec6310_JaffaCakes118.dll
Resource
win7-20240903-en
windows7-x64
8 signatures
150 seconds
General
-
Target
41e562a465bd7f3aa2a28b9bfeec6310_JaffaCakes118.dll
-
Size
120KB
-
MD5
41e562a465bd7f3aa2a28b9bfeec6310
-
SHA1
cc588e7e89894d6b7210bc1e8ed9787d8bcc968a
-
SHA256
b9f0a21284de6df0a9f5bad27565a29b87d950b26c8cef18f0680057259dd254
-
SHA512
f399dd20318f7d1f3e03fe64c8f4fe23a4fa6d74fe9bc217f8c20c21ab1834ae5532c8d83e68fbdc4437c87d1d3da871c4a8d8c8bba0229b3d22c7d3bd1e116a
-
SSDEEP
3072:L05Wp/isNSFWruu2ttBB0NoYusskvifulSg:45lsMIruuQfSNtCkaWs
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral1/files/0x000c0000000164db-3.dat family_gh0strat -
Loads dropped DLL 1 IoCs
pid Process 2556 svchost.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Lhij\Qhijklmno.bmp rundll32.exe File created C:\Program Files (x86)\Lhij\Qhijklmno.bmp rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe 2556 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 2400 rundll32.exe Token: SeRestorePrivilege 2400 rundll32.exe Token: SeBackupPrivilege 2400 rundll32.exe Token: SeRestorePrivilege 2400 rundll32.exe Token: SeBackupPrivilege 2400 rundll32.exe Token: SeRestorePrivilege 2400 rundll32.exe Token: SeBackupPrivilege 2400 rundll32.exe Token: SeRestorePrivilege 2400 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2092 wrote to memory of 2400 2092 rundll32.exe 30 PID 2092 wrote to memory of 2400 2092 rundll32.exe 30 PID 2092 wrote to memory of 2400 2092 rundll32.exe 30 PID 2092 wrote to memory of 2400 2092 rundll32.exe 30 PID 2092 wrote to memory of 2400 2092 rundll32.exe 30 PID 2092 wrote to memory of 2400 2092 rundll32.exe 30 PID 2092 wrote to memory of 2400 2092 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\41e562a465bd7f3aa2a28b9bfeec6310_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\41e562a465bd7f3aa2a28b9bfeec6310_JaffaCakes118.dll,#12⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2400
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2556
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9.3MB
MD5c41e2eaa062d9c903c23e8c7ce132d58
SHA1625b4ce233ba5d772a29d279d4635b6cee78ee54
SHA2568362b6464285be8b5ca1dcbf7fdb1fb3ffea4d9934f68bbb2c7db5d57c0bdde4
SHA5124555b0e2ffc5c9fb5368002f6696934a5835f0dfd8663bf3568dace89ceb5f884025b7718ffc62b2813453e42ea72d46c777c1e5d1b15e0aec83631722ea8ac5
