Analysis
-
max time kernel
146s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
28-01-2025 06:18
General
-
Target
JaffaCakes118_47bed904c5d80f6d5c94c14454b56018.exe
-
Size
96KB
-
MD5
47bed904c5d80f6d5c94c14454b56018
-
SHA1
f6818e0a15fc5d6162d90adff96094fb231db0ca
-
SHA256
4999fe6aa48881f685dc24d7883007ec661b2b2c88147e7bf4dd0281634cab96
-
SHA512
6e3956175eff21ddfe02b823d13b795b5c2ba844b35e5fac4756279295421144aebfa1f3a374d02615c43b31f595302614b06667c9e39f597708933c477b12f5
-
SSDEEP
1536:SHFusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8prkdrU0OBSBX:SxS4jHS8q/3nTzePCwNUh4E9kLOBS9
Malware Config
Signatures
-
Gh0st RAT payload 4 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 6 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 18 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_47bed904c5d80f6d5c94c14454b56018.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_47bed904c5d80f6d5c94c14454b56018.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\gvuqcjkbke"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_47bed904c5d80f6d5c94c14454b56018.exe" a -sc:\users\admin\appdata\local\temp\jaffacakes118_47bed904c5d80f6d5c94c14454b56018.exe2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24.1MB
MD5125e16f001088e092f4a64caea9f8d30
SHA1522adebdbdc506f12ea58e292b8a9b47e6db78d8
SHA2567093187016416865a73edf38b954cd0515c0e490bdf55be501f25f45ad8a3858
SHA512f72df388a1a7564fdfa2dfec57435b0165cd4e210141704c1e94399b959c4c927c365aedd1c32b97d869d3f91bf322ddd39a5d354454b470c91fcc59fd004ff8
-
Filesize
22.9MB
MD5832049d3fde9107ae73d6dc1289fd8dc
SHA1a62ec9c0a0eba7c2fcd717deb80f9534aaf01f41
SHA256443a4102f133b884f868402c7190f7febccab9eb32a056779789d1356d8dc98a
SHA51242d207774f2804d1233f7a4fc8777563707b55533dd9b18c7b22d25108a25fe866fbd8cd1c0e6d115e499b24da090374f9e12294c6c5a3ea7757325640486e05
-
Filesize
4KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
4KB
-
Filesize
316KB
-
Filesize
312KB