Overview

overview

10

Static

static

10

JaffaCakes...94.exe

windows7-x64

10

JaffaCakes...94.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/01/2025, 04:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_3c15c935cb3587905407eb644ce55294.exe

  • Size

    176KB

  • MD5

    3c15c935cb3587905407eb644ce55294

  • SHA1

    7e5d57cee7da2dd7e60981b6643421faab707972

  • SHA256

    45a47383793a5807fa04369327ec38f8577eafa687779b067a7d37e335f5b3ea

  • SHA512

    f42f3f87cd0189625151590947f2d988e8b54ee48f882899af120fbdba2f0a2535e05ee2a27d214743a865f34b8a33fc4ef28ef017de29f761cb68c76edab9db

  • SSDEEP

    3072:kcYcYKEzcW526y6hs6PhwtqrorsVlkTEIcy1O4F3JhMWIknqX5d+vIjc8UW:kcBYKEz557e2VroYoTU4JOWnS5d+v0cu

Score
10/10
gh0stratdiscoverypersistencerat

Malware Config

Signatures

  • Gh0st RAT payload 1 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat
  • Gh0strat family
    gh0strat
  • Blocklisted process makes network request 1 IoCs
  • Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
    persistence
  • Deletes itself 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3c15c935cb3587905407eb644ce55294.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3c15c935cb3587905407eb644ce55294.exe"
    1⤵
    • Server Software Component: Terminal Services DLL
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:3116
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3932
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "c:\windows\system32\winnie.cmd",EASTNOD Rspdates Apxplicatioan
      2⤵
      • Blocklisted process makes network request
      • Deletes itself
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:224

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\hfsetemp.ini
    Filesize

    365B

    MD5

    6b8e95ce2706ab34239e463b174df3c1

    SHA1

    e3a134ec6f9f1711d966acdb93b016760d1ce7fa

    SHA256

    23f948ac4e91de00d86ac10424cbb347f4ba564aec77926f01588337d9fe81a9

    SHA512

    34a5348edca8958c49e51223213ccc491e0937a9b4846e34ef6b1c28e555ca775350d96632fac6d36e3bb3861eeaa5d65e794e76b69c2ca7d6a6f75bd2d0bbd2

    Download Submit

  • \??\c:\windows\SysWOW64\winnie.cmd
    Filesize

    1.1MB

    MD5

    2a771c5c3ac76b440c47f9356676981d

    SHA1

    642d905e48e4b48ba1b77e363ca3acbc2eaf9220

    SHA256

    8154d5b3e0251317aa1988235465cde55be4123a754bb28893cd5c0edaf0342e

    SHA512

    71ae7c2759cfccce94f17c913b7b39e4c74cb4baab61736890785e9484bef5b3969199a57dc873d924bb4a57db5f058fbeb4294a1f33816fd938e43e3e7e8330

    Download Submit