Analysis
-
max time kernel
147s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
28-01-2025 02:53
General
-
Target
JaffaCakes118_46280eefbefd76a067ecbd4b84e63660.exe
-
Size
96KB
-
MD5
46280eefbefd76a067ecbd4b84e63660
-
SHA1
fb7f2410d3d9d7904b0cdbeff1449872c9ccf6ea
-
SHA256
103b0be89b5cfa24aab33b83361f6bde7c30a2e9fa19625e502ed37da88626a5
-
SHA512
314cd25356152166fb013c31174d5e853529789e1343cbc7b67fd4a6f62d174354ba5315bfc20ab89cb9876973a2d47b0e635e06b6bae0d20074af0158fc6697
-
SSDEEP
1536:oKFusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8pryTNH9VtWrZe:oQS4jHS8q/3nTzePCwNUh4E9yxdoZe
Malware Config
Signatures
-
Gh0st RAT payload 4 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 6 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 18 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_46280eefbefd76a067ecbd4b84e63660.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_46280eefbefd76a067ecbd4b84e63660.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\isellekcfu"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_46280eefbefd76a067ecbd4b84e63660.exe" a -sc:\users\admin\appdata\local\temp\jaffacakes118_46280eefbefd76a067ecbd4b84e63660.exe2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21.1MB
MD548d81bdda86b02b3966143aaa002e8ab
SHA13980b95997fe27bb24cfab96f03912c76eb4e92d
SHA2564ac8d8c28acb7536a2d59375697a09466fa56b7d3a7d04378de772d55e763703
SHA5127d1283f2d56fbc6f4a646b6e3d271481f872e452b2733d3d6fb395bdc62278fe38953c111371296f8505dcab459979432c03e664c6a07f32dd224bb10a81a7ad
-
Filesize
19.5MB
MD50f3375a0ce828fef9db7d07030bb1b56
SHA1c4c9e1cb12b06442a78788fd9fdd0e835b2aead2
SHA2560ce138b4a2a0f86c27c943a9526fe69ba745668a150e92a93ee5e4451adaf4b8
SHA51217b15eade52e480a860fd2e1f2f6188199b711604eab401f19bc3dc829d61ea9fbfacdd205ca77fe6b8bc4cc9843462accdd79a1ae172e0fa9ac8f800abe8395
-
Filesize
312KB
-
Filesize
4KB
-
Filesize
312KB
-
Filesize
4KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
316KB
-
Filesize
312KB
-
Filesize
316KB
-
Filesize
4KB
-
Filesize
312KB