Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
28-01-2025 15:31
Behavioral task
behavioral1
Sample
JaffaCakes118_4c6d8c71863b88a3c56a3dd16292936b.dll
Resource
win7-20240903-en
windows7-x64
General
-
Target
JaffaCakes118_4c6d8c71863b88a3c56a3dd16292936b.dll
-
Size
5.0MB
-
MD5
4c6d8c71863b88a3c56a3dd16292936b
-
SHA1
748bc562fc432bc01631eca6e6fd15a3ab235785
-
SHA256
2c9d6575e26a1a7c3c197d0e0ad67f95d2061cbf7d6ecea57a73e48c37173b07
-
SHA512
5f1d83385f3d8394369a84fb73f95afc64f87c30a92a67c1e98d0e8d0f999c68e31eeab8d7ee420eb2cbb1b36aaceb6226f97d685f0c3deb588225cf900411db
-
SSDEEP
3072:HzK5S9ERdbsJd84Qc/whoGmip8ntWkgwFBlSudg222222222222222222222222E:KsJeb1m2kwkgw3oKR
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x000b000000023cc4-3.dat family_gh0strat -
Gh0strat family
-
Loads dropped DLL 1 IoCs
pid Process 4328 svchost.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Rnop\Myssql.log rundll32.exe File created C:\Program Files (x86)\Rnop\Myssql.log rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe 4328 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 1924 rundll32.exe Token: SeRestorePrivilege 1924 rundll32.exe Token: SeBackupPrivilege 1924 rundll32.exe Token: SeRestorePrivilege 1924 rundll32.exe Token: SeBackupPrivilege 1924 rundll32.exe Token: SeRestorePrivilege 1924 rundll32.exe Token: SeBackupPrivilege 1924 rundll32.exe Token: SeRestorePrivilege 1924 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1596 wrote to memory of 1924 1596 rundll32.exe 83 PID 1596 wrote to memory of 1924 1596 rundll32.exe 83 PID 1596 wrote to memory of 1924 1596 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4c6d8c71863b88a3c56a3dd16292936b.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4c6d8c71863b88a3c56a3dd16292936b.dll,#12⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1924
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4328
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
23.9MB
MD54a8aa6e8a0c981705ce9c733692fd4ca
SHA12bef5124e3c77466f5140bfdd7031c82b6b145a5
SHA2560103ae1de4a7bcf3eed58de2ee77ff5fd767d1412bb15c2567b7e5f26a49ef77
SHA512617596b8224140acdfd207b857969be524a31f9258722dd0b82585b2e5a30bea3bdf313d5a33323ae99d0ee05607c7ce7256b37b1d44c30b92c01ee51495ea10