Analysis
-
max time kernel
150s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28-01-2025 15:31
Behavioral task
behavioral1
Sample
JaffaCakes118_4c6d8c71863b88a3c56a3dd16292936b.dll
Resource
win7-20240903-en
windows7-x64
General
-
Target
JaffaCakes118_4c6d8c71863b88a3c56a3dd16292936b.dll
-
Size
5.0MB
-
MD5
4c6d8c71863b88a3c56a3dd16292936b
-
SHA1
748bc562fc432bc01631eca6e6fd15a3ab235785
-
SHA256
2c9d6575e26a1a7c3c197d0e0ad67f95d2061cbf7d6ecea57a73e48c37173b07
-
SHA512
5f1d83385f3d8394369a84fb73f95afc64f87c30a92a67c1e98d0e8d0f999c68e31eeab8d7ee420eb2cbb1b36aaceb6226f97d685f0c3deb588225cf900411db
-
SSDEEP
3072:HzK5S9ERdbsJd84Qc/whoGmip8ntWkgwFBlSudg222222222222222222222222E:KsJeb1m2kwkgw3oKR
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral1/files/0x000c000000019023-3.dat family_gh0strat -
Gh0strat family
-
Loads dropped DLL 1 IoCs
pid Process 2992 svchost.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Rnop\Myssql.log rundll32.exe File created C:\Program Files (x86)\Rnop\Myssql.log rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe 2992 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 2092 rundll32.exe Token: SeRestorePrivilege 2092 rundll32.exe Token: SeBackupPrivilege 2092 rundll32.exe Token: SeRestorePrivilege 2092 rundll32.exe Token: SeBackupPrivilege 2092 rundll32.exe Token: SeRestorePrivilege 2092 rundll32.exe Token: SeBackupPrivilege 2092 rundll32.exe Token: SeRestorePrivilege 2092 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2400 wrote to memory of 2092 2400 rundll32.exe 30 PID 2400 wrote to memory of 2092 2400 rundll32.exe 30 PID 2400 wrote to memory of 2092 2400 rundll32.exe 30 PID 2400 wrote to memory of 2092 2400 rundll32.exe 30 PID 2400 wrote to memory of 2092 2400 rundll32.exe 30 PID 2400 wrote to memory of 2092 2400 rundll32.exe 30 PID 2400 wrote to memory of 2092 2400 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4c6d8c71863b88a3c56a3dd16292936b.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4c6d8c71863b88a3c56a3dd16292936b.dll,#12⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2092
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2992
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13.0MB
MD573ae7dc5225b02bba805ebed8d525ccc
SHA17513d6b19ad2c80c9a171982f5590602f2827632
SHA2564a8029981ee568bbd19ed1d6898f25e4ab4dc7fd677c60399b4feff7ac8f53bb
SHA512c3cdb084d8a311ad51e9fbc99418e802b5f98a0d85d929b96aea8cd64e5ee764f77b4318a83256c1717b1c2702632d2163c076a3cd06b5e2ca51661e35003981