Analysis

  • max time kernel
    148s
  • max time network
    139s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    30/10/2024, 00:21

General

  • Target

    7d3ed07df7fa59df87e75d2adcfb5181_JaffaCakes118.exe

  • Size

    134KB

  • MD5

    7d3ed07df7fa59df87e75d2adcfb5181

  • SHA1

    7dee2262bc70b31667e2f96ebbf6943d3fa2c6b1

  • SHA256

    d4b9c9c3d53bb614bba05b7db0e3f2d06c7c328581019c617ecfb7953cecd277

  • SHA512

    e324e3a9b60b39199a8e72b6fbad7364118607588a1bdf1f311180e985bec42bf5739ae5efffc2ab91f5cd9da257972291b75985f3a4181f6fba97556806db05

  • SSDEEP

    3072:MMwZSQpKa3VGVnpUlCz764/9xpEEBqbZuwL5iGHeqovv:M3JVGpxx9b3wZuwL4GHeqo

Score
10/10

Malware Config

Signatures

  • Gh0st RAT payload 5 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

  • Gh0strat family
  • Deletes itself 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7d3ed07df7fa59df87e75d2adcfb5181_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\7d3ed07df7fa59df87e75d2adcfb5181_JaffaCakes118.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:2684
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k imgsvc
    1⤵
    • Deletes itself
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:2692

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\777200.dll

          Filesize

          101KB

          MD5

          0f3d0a39f82e6ea8e7a38e2757e0ba8f

          SHA1

          c751f50c0032a73c54dc9bf2e915d89a789fa0d6

          SHA256

          3cc95a94fefb27841dfda8f8304c3a54fe3c0312b1026c5ef7fc346ce4a39eda

          SHA512

          8152b0e91a1f4d2a8539b19bd41c2964bfda35cdf13d716cdd5fa78fcbea08c4e00972b2926c047a9e2c43fbe8fee750c9be751aff3ff93b13e1340536e0f6d8

        • C:\Windows\FileName.jpg

          Filesize

          111KB

          MD5

          dc77777b48685392e3d6a8bd20fcf98f

          SHA1

          c3d40c4c0fde171e28de4e8550c80b5b5dd0e8ff

          SHA256

          6fee9c68f4db18b378101a867d6322b4604f761a8716f3db4e1e89a4a07309a5

          SHA512

          ae82093034ddc6bb1f5909fb5646242be6f6bdefe9b11044071ce20d0a406e63cb3bfbcc66824268bae04f46b6738de5eef4f0e564966bde0c1e9732ffe7ba4f

        • \??\c:\NT_Path.jpg

          Filesize

          98B

          MD5

          d06706b4fe2418cf3c57d3e0fa69f191

          SHA1

          f9badccd6de886f9cd5e88af62e9291c991f8851

          SHA256

          7d91e04744e8ac984a9b38e0d2c1c1dbd466223868e8e935a24f4b33634429e8

          SHA512

          f246266bbc77cc6cdb172742268edb51c653e0a9fe7a7cef69d2e38a9d945fb93aa15db65e75c2cd52e76ed1e8798b6316d7b13c00cce423964f1b48a2493f24

        • \??\c:\windows\filename.jpg

          Filesize

          19.6MB

          MD5

          6e7ce08b697f15b66487f4614a10a6c7

          SHA1

          09c830a5759b088e86c063b6e55b9b6ea6bb803b

          SHA256

          3f9d134399e85e8c958e5fe7b3f7ffb29cdc5f1aa856f2210aa5bc9911fb4dbd

          SHA512

          6ce27af339c58b8e2bbd051aeacd568e55fdaaa3e7b8c8ccc870ab3152d906c4879a156f304dc66e2a38f8bd0aee33febea56e4913a5d9e9ff424b99c8623fe2

        • memory/2684-9-0x0000000010000000-0x000000001001C000-memory.dmp

          Filesize

          112KB

        • memory/2692-12-0x0000000010000000-0x000000001001C000-memory.dmp

          Filesize

          112KB