Analysis

  • max time kernel
    147s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    15/10/2024, 23:11

General

  • Target

    4a6ee7aa6ca06a659c4ff203a49aaee1_JaffaCakes118.exe

  • Size

    95KB

  • MD5

    4a6ee7aa6ca06a659c4ff203a49aaee1

  • SHA1

    8c7ccb9bb38e677dff882f2215550221c42c42b3

  • SHA256

    fb96749e82468a71f853f561482faac7201aed43021ce97f6dcdd6a6e5b4e9ee

  • SHA512

    c94053b3952016f4fd1c4195641ef7c6ccf34f266ae1df516a7d765bbd48433a726f1d2bca41fc88f0ad502b54e0afa89be4cb7042222d42e0246229146a514b

  • SSDEEP

    1536:NPFusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8pr4KobKbCkun6fQ:NZS4jHS8q/3nTzePCwNUh4E9toyCku6I

Malware Config

Signatures

  • Gh0st RAT payload 2 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in System32 directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4a6ee7aa6ca06a659c4ff203a49aaee1_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\4a6ee7aa6ca06a659c4ff203a49aaee1_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2372
    • \??\c:\users\admin\appdata\local\hwsubgqnoj
      "C:\Users\Admin\AppData\Local\Temp\4a6ee7aa6ca06a659c4ff203a49aaee1_JaffaCakes118.exe" a -sc:\users\admin\appdata\local\temp\4a6ee7aa6ca06a659c4ff203a49aaee1_jaffacakes118.exe
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2780
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    1⤵
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2548

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \??\c:\programdata\application data\storm\update\%sessionname%\nnemo.cc3

          Filesize

          23.0MB

          MD5

          64c57d6d0ab5fc4c8586e9719c6a34c9

          SHA1

          3b48cb0fa64f0b568101b4323c682a7b1f26c646

          SHA256

          e9df848a2997f07451059c46486e1a280e831b4656e4fe0112a8538ea51977b5

          SHA512

          9750fe1785ce1d4301580f1f15d7bde0eb516b7f1f74197bacb90cb9ce588ff53c3a70e477912e065d9380af65dd96856c69a12e6d5875777f69d4ba00e33d9f

        • \Users\Admin\AppData\Local\hwsubgqnoj

          Filesize

          24.7MB

          MD5

          38365b1e6f35a7b3a8b7363d99aa3c07

          SHA1

          c6f2e54b8c86b1114211abeeb49b61cc02840977

          SHA256

          e41659b1545b9cd3dddcaea82b275d80c83df08ec2138aa53ef275ce550d8319

          SHA512

          c76c40784701247401f5b1f62ebb46bac92ff682f41cb48afddff972154e62f8ced5770e5768422814064a212288bd084005b1ed829e7cf04f9c33e7a997d2ad

        • memory/2372-2-0x0000000000030000-0x0000000000031000-memory.dmp

          Filesize

          4KB

        • memory/2372-1-0x0000000000400000-0x000000000044E5F0-memory.dmp

          Filesize

          313KB

        • memory/2372-11-0x0000000000400000-0x000000000044E5F0-memory.dmp

          Filesize

          313KB

        • memory/2372-22-0x0000000000400000-0x000000000044E5F0-memory.dmp

          Filesize

          313KB

        • memory/2548-21-0x0000000000180000-0x0000000000181000-memory.dmp

          Filesize

          4KB

        • memory/2780-15-0x0000000000030000-0x0000000000031000-memory.dmp

          Filesize

          4KB

        • memory/2780-14-0x0000000000400000-0x000000000044E5F0-memory.dmp

          Filesize

          313KB

        • memory/2780-20-0x0000000000400000-0x000000000044E5F0-memory.dmp

          Filesize

          313KB