Analysis
- max time kernel
150s - max time network
131s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
01/01/2025, 05:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
JaffaCakes118_4936e6ddeb4e66e9ced2dbacf34e0350.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
General
- Target JaffaCakes118_4936e6ddeb4e66e9ced2dbacf34e0350.exe
- Size 151KB
- Sample250101-gdbe3synfn
- SHA256 032289c76457c9b462df55812bc0ff1cade19fc5cd636201116f8be886c3b69b
- MD5 4936e6ddeb4e66e9ced2dbacf34e0350
- SHA1 da1fe0d1d14163a46a91030dc498333af1179aa6
- SHA512 7a0fd95a950a45d97dff0f24b111faa64dead8ec85808199c71733a27df5e2d2b5519735b9540e63b74522eba3bb41d7fc0109ff4ab6122b15ef5e13d8c68450
- SSDEEP 3072:CKBvby68uKeqR+dBMWsV9dXr/RgdMEDNrnXUEOnmHjkGirf99:LppQR+L5sjdXVzaVUlnmHjkGirf99
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Gh0st RAT payload 4 IoCs
resource yara_rule behavioral2/memory/1616-1-0x0000000000401000-0x0000000000435000-memory.dmp family_gh0strat behavioral2/files/0x000c000000023b32-4.dat family_gh0strat behavioral2/files/0x000e000000023b96-13.dat family_gh0strat behavioral2/memory/1616-14-0x0000000000400000-0x000000000045AD54-memory.dmp family_gh0strat - Gh0strat family
- Deletes itself 1 IoCs
pid Process 2592 svchost.exe - Loads dropped DLL 2 IoCs
pid Process 1616 JaffaCakes118_4936e6ddeb4e66e9ced2dbacf34e0350.exe 2592 svchost.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Oklm\Tklmnopqr.jpg JaffaCakes118_4936e6ddeb4e66e9ced2dbacf34e0350.exe File created C:\Program Files (x86)\Oklm\Tklmnopqr.jpg JaffaCakes118_4936e6ddeb4e66e9ced2dbacf34e0350.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_4936e6ddeb4e66e9ced2dbacf34e0350.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe 2592 svchost.exe - Suspicious behavior: LoadsDriver 6 IoCs
pid Process 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 660 Process not Found - Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 1616 JaffaCakes118_4936e6ddeb4e66e9ced2dbacf34e0350.exe Token: SeRestorePrivilege 1616 JaffaCakes118_4936e6ddeb4e66e9ced2dbacf34e0350.exe Token: SeBackupPrivilege 1616 JaffaCakes118_4936e6ddeb4e66e9ced2dbacf34e0350.exe Token: SeRestorePrivilege 1616 JaffaCakes118_4936e6ddeb4e66e9ced2dbacf34e0350.exe Token: SeBackupPrivilege 1616 JaffaCakes118_4936e6ddeb4e66e9ced2dbacf34e0350.exe Token: SeRestorePrivilege 1616 JaffaCakes118_4936e6ddeb4e66e9ced2dbacf34e0350.exe Token: SeBackupPrivilege 1616 JaffaCakes118_4936e6ddeb4e66e9ced2dbacf34e0350.exe Token: SeRestorePrivilege 1616 JaffaCakes118_4936e6ddeb4e66e9ced2dbacf34e0350.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4936e6ddeb4e66e9ced2dbacf34e0350.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4936e6ddeb4e66e9ced2dbacf34e0350.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1616
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2592
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\2806300.dll
- Size 133KB
- SHA256 8636420cb509de8f376adf85de7a33e2e98eea2a3809a35e6776dc42944ee61e
- MD5 202d2d5598397da31bb5409d0d4576c1
- SHA1 ef7baf74792d308e55524087fbcff7d6111b9cc9
- SHA512 49980c0a92e6e09f2bce0f9118ab7f7f38cf80c5c65d618af8447633fa7a02cd4238e59ecf201facdfb364ed725e79835820d4959831e43292a52d8a1abe66b7
- SSDEEP 3072:bixrcYyNNBxIf58d6UuSMhXk22T94oz7vEEZzcEkJO:aANBxIxh0u4TSg7vECzc70
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\NT_Path.jpg
- Size 99B
- SHA256 626fe966c67fb365a9509948f4cb7404e0d985930261fea483a4d9dfed07295d
- MD5 8c407562d69d2c7b332a2d671268415e
- SHA1 afc839df96453ed1f4ba5d37d0ac7cb35fd1fb55
- SHA512 e2753c2f4a4f23d56cf56cb1676fc4bb3ec943f5d275c301ce49bc6d92725b9822456c27f4262e11331d7a2a5749b436cb458a1bdd454b5626700a50e57baff8
- MD5 SHA1 SHA512
- Path \??\c:\program files (x86)\oklm\tklmnopqr.jpg
- Size 17.2MB
- SHA256 8c550b5b88b0152f538fe3ea2fbc7fda6549417f2af58a55b6092443445c0fa3
- MD5 5e0421ab93582d8869c3eda2ae192654
- SHA1 69191c4a8d52b629d3072ce1727e608ce7d8d9fa
- SHA512 4a3a67ad69b19e39a10ce33284b73edb8bf0da5ac1e9de7934a5336481a53dfa30d9f83d6d161b77c4c7c69392ec80736f9214c3ed4bf57329bffa6aac99bd23
- SSDEEP 24576:awBxInMvaTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTTt:pS
- MD5 SHA1 SHA512 SSDEEP
