Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27-01-2025 12:04
Behavioral task
behavioral1
Sample
JaffaCakes118_3f61b1f4c5613935765d8ac3ba30a39d.dll
Resource
win7-20240903-en
windows7-x64
8 signatures
150 seconds
General
-
Target
JaffaCakes118_3f61b1f4c5613935765d8ac3ba30a39d.dll
-
Size
1010KB
-
MD5
3f61b1f4c5613935765d8ac3ba30a39d
-
SHA1
ca5e01736fc3cbdd63de2dd75e2577ab9244073f
-
SHA256
2cbbecd990781a2b691f665668b659cf79bf5b7a79d8bc675b6e4de9d9f53d9a
-
SHA512
eac6d8deec37249307c9ae808408b79beafd2ea4e0b07c9572a6a675d89765a6ea37774a54f2377ea4644d1ef15be14ee46cf733873804f779b48b77329aaaf9
-
SSDEEP
3072:OT6QTlxjLXCKDcMERjtJXVtEhKwBDb0cUi8:O3HyvjTXLiKwBDbtUL
Malware Config
Signatures
-
Gh0st RAT payload 2 IoCs
resource yara_rule behavioral1/files/0x000c000000012102-3.dat family_gh0strat behavioral1/memory/2716-4-0x0000000010000000-0x0000000010021000-memory.dmp family_gh0strat -
Gh0strat family
-
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.psd rundll32.exe File created C:\Windows\Microsoft.psd rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe 2716 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 2836 rundll32.exe Token: SeRestorePrivilege 2836 rundll32.exe Token: SeBackupPrivilege 2836 rundll32.exe Token: SeRestorePrivilege 2836 rundll32.exe Token: SeBackupPrivilege 2836 rundll32.exe Token: SeRestorePrivilege 2836 rundll32.exe Token: SeBackupPrivilege 2836 rundll32.exe Token: SeRestorePrivilege 2836 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2820 wrote to memory of 2836 2820 rundll32.exe 30 PID 2820 wrote to memory of 2836 2820 rundll32.exe 30 PID 2820 wrote to memory of 2836 2820 rundll32.exe 30 PID 2820 wrote to memory of 2836 2820 rundll32.exe 30 PID 2820 wrote to memory of 2836 2820 rundll32.exe 30 PID 2820 wrote to memory of 2836 2820 rundll32.exe 30 PID 2820 wrote to memory of 2836 2820 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3f61b1f4c5613935765d8ac3ba30a39d.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3f61b1f4c5613935765d8ac3ba30a39d.dll,#12⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2836
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2716
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.1MB
MD52bb02fae40247b80d6f16dd0c00c2b66
SHA16fac4545f9d706f10f2e43781a5208d0fa00eed1
SHA256f185a6d714bb5937868053ab4774a9e28557064ad467665a26ef45a1e2e85b7c
SHA512cc08d2abd659a6c066caebf49bd26e67c307c3d4383a9c51a2e6e49080215e253071f9e2be08efbb1075666b7d9dfb4b3c029c57dbc5be83bdb9d63004c9bf54