Overview

overview

10

Static

static

10

JaffaCakes...dc.exe

windows7-x64

10

JaffaCakes...dc.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-01-2025 08:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_4916ebcb1d4fc22bb0a9d8f0114b5edc.exe

  • Size

    176KB

  • MD5

    4916ebcb1d4fc22bb0a9d8f0114b5edc

  • SHA1

    916cde50f58a8b94be7c29ae16965f5b194657c6

  • SHA256

    20c016f775260c8348004416a0757c716d76ce80328e98614fa52e699e232bc1

  • SHA512

    4b70d59ce3ba4f056059afbb365ea655cd7ed5616ca665cfd7fbdfbaf354c8aca384cbb20a8cad3600cf2ea64810c464ffe36132988bb37003e4a81cb1baa158

  • SSDEEP

    3072:RcYcYKEzcW526y6hs6PhwtqrorsVlkTEIcy1O4F3JhMWIknqX5d+vIjc8UW:RcBYKEz557e2VroYoTU4JOWnS5d+v0cu

Score
10/10
gh0stratdiscoverypersistencerat

Malware Config

Signatures

  • Gh0st RAT payload 1 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat
  • Gh0strat family
    gh0strat
  • Blocklisted process makes network request 1 IoCs
  • Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
    persistence
  • Deletes itself 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4916ebcb1d4fc22bb0a9d8f0114b5edc.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4916ebcb1d4fc22bb0a9d8f0114b5edc.exe"
    1⤵
    • Server Software Component: Terminal Services DLL
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:4804
  • C:\Windows\SysWOW64\svchost.exe
    C:\Windows\SysWOW64\svchost.exe -k netsvcs
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4404
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "c:\windows\system32\winnie.cmd",EASTNOD Rspdates Apxplicatioan
      2⤵
      • Blocklisted process makes network request
      • Deletes itself
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:980

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\hfsetemp.ini
    Filesize

    365B

    MD5

    0c6fb48ec14cf0535df55de346aad98a

    SHA1

    3ded5fa6488a3fbc0ae8ffa8269732d17cbfb82c

    SHA256

    b59f28f8e20f0eb15cae824246fd105d3e5a912fb94355e096efdce3165c29f8

    SHA512

    2fbad828180479c22a9f9496f322c4763c225724081c956cad9b9ba0da71121db664071093a1074ed9c18db926717c0cafcfe6e82e4eb9009bdb271238464909

    Download Submit

  • \??\c:\windows\SysWOW64\winnie.cmd
    Filesize

    1.1MB

    MD5

    479b99ec5eb6c213b41084b7e3b36d64

    SHA1

    143cd9e5d58d7a89e4769958e46c19c5cc59b997

    SHA256

    b347d0988f89c0251409532b39bb8fcf914d7abbc9195cc9cf6db029571bd535

    SHA512

    f84ae446f0e1d80be12ab7560fb2b19bf39efc05c070b26f03ab15b3976c616cfe8e11e3e720ae98e92f291408c37cc34ba94ebe586785a26b2a71b4a94654d6

    Download Submit