Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
28-01-2025 06:39
General
-
Target
JaffaCakes118_47ef94a4dfe43e62eb753ded3893ac7b.exe
-
Size
164KB
-
MD5
47ef94a4dfe43e62eb753ded3893ac7b
-
SHA1
8e63865079c11cc0fc284f2d2e9cb94c2ae74af4
-
SHA256
72d8709d71fab8e930c3284c20a3d331e2a83ad6ea5d24d6ebb97040fe3935f4
-
SHA512
3ecfc6a464a8cc1bcb2c0e5847f3eb22e1ab63268483742af11a56725ad639aa35369ef7b3a11bc62ca8a0ee24736c805158ece85ee0469d364369fa956e45bc
-
SSDEEP
3072:nUT6QTlxjLXCKDcMERjtJXVtEhKwBDv0cUyMUeqovO:nU3HyvjTXLiKwBDvtUAeqo
Malware Config
Signatures
-
Gh0st RAT payload 2 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
Deletes itself 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Drops file in Program Files directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: LoadsDriver 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_47ef94a4dfe43e62eb753ded3893ac7b.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_47ef94a4dfe43e62eb753ded3893ac7b.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
117KB
MD5e9d5c476b5ebc8e2965bd58de7086328
SHA119e365404bd5876a2a52c2d76c37424a03184c59
SHA2565d9828582307bf2518739767285b8e102fb74a4e2631136779d008cd0463a467
SHA512ef0ce113d4fdaee736cc765e68ac5bb5a7d4f35506266fe31c84fa5a335fafcef5b0c77590b0cddc7ce7c2df601069032ac40a9c9caef49f52fc4b3552fe6223
-
Filesize
99B
MD557c1271f1a363a96010a3c633bab81cb
SHA1ccec7386fde40645c307d5d22fcd29977bf67801
SHA256492dee1a90342ad8f6f8cfe0f1037b9343f9ef43e89bf9838173170380486d65
SHA512010481baab6182750e6ef308ed7f2c0954f0493275431087de2e05cfe711071f990c62732922def9efa78baf8bf61a3e4fcabead80ca0cff3591aed2a06151db
-
Filesize
16.5MB
MD548d29a2dd70f4fb720a8fb2cdb5258f7
SHA127c75a0c658b7a53e9479724269cce2c40f486b7
SHA2563cead125138cd2f00bce313cbf1b6f31d7120cae2f0d349b9f0b4621d369cadb
SHA512019e50cc0e09d1eb05eebf44d795132e856af27ba5f2035411cafcff4b64391a01f87e1321007f4fb81252262f37c0a25f24f915115ab15c970863c7785c23fd
