Analysis
-
max time kernel
127s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
28-01-2025 01:37
General
-
Target
JaffaCakes118_458988d16621bc0e15192e4b4bc44d6c.exe
-
Size
208KB
-
MD5
458988d16621bc0e15192e4b4bc44d6c
-
SHA1
5b627caf57d77e7b44608bd7c59684ce1d69f44a
-
SHA256
2b7da4dd0e3d7028d72b86f8d98a827569b0d74a973f38df3eda927b3ea0ab3b
-
SHA512
2f56a9f176068dfb88ce7f54200df94043976c90c967653e259d1ce241f240251391af2664aecb8e5d842faf068135920df22e5b7a1ff193065eadd3a11cdd2b
-
SSDEEP
3072:tfhicY1twWBWHWVKhqvEzO/V1VrNYQkCA+HFSWvF3TBftWBunob2j:125WHA9DNYtEHhvF3TBlVnobm
Malware Config
Signatures
-
Gh0st RAT payload 4 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory 2 IoCs
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_458988d16621bc0e15192e4b4bc44d6c.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_458988d16621bc0e15192e4b4bc44d6c.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\svchost.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20.2MB
MD56559b9abf5de358a496a3a512b7cf082
SHA16e1fc6a2da0a995b521e3e58368354e8be7edacc
SHA2567b180691a5f5925a187c0591608d8f7a4c1479150fa17d44b164b17c081505a1
SHA512b216f657bb867b0654696023591eb3a2301cf1a3b9831f56ce15306f27197a63e597cd12ad15ff93fa6d370027923c5fdcc508df81d68aae94cb85c16a1e3b14
-
Filesize
20.1MB
MD514acd3763693658b17153fa6a383c4b3
SHA170c28010922f2204eeff0f5f250a8fb08a85114d
SHA256b3c223b0451c9dc335032ca54dcbd31e2aa5552c375c91debe802f11330a37cb
SHA512dbe6e86949165cf0cd6a134a4b630fdd01c0d622834097146482df1bc98ea04cfa65f4c3768024c0b552282f6e46f163b91bb255cb4b130731ec522bf8f26f4e
-
Filesize
156KB
-
Filesize
4KB
-
Filesize
156KB