Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
-
submitted
29-01-2025 11:56
General
-
Target
JaffaCakes118_5691e040c8bb50093f146229152880fe.exe
-
Size
71KB
-
MD5
5691e040c8bb50093f146229152880fe
-
SHA1
27dcf548c92ffcc7b3dccb83675bcaca76b0ee93
-
SHA256
6c00557333d5bbc08622ebd66cef57accd5dbbd18976e9ea25c927e82e557427
-
SHA512
94d30666f3ab5ef2c39947f0ab25d30de7460b2d0ee1db19c82c2db52e09307c2a827a3f369d8257fc99ef4c3f3f50baf096e26792dbbc59ead58fc857bfda97
-
SSDEEP
1536:jWZpTtLcWyeYd4//yEZc1GJf7/QP4uirys5e:+pZTvnyEZiGJ7/Qguirys5e
Malware Config
Signatures
-
Gh0st RAT payload 2 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
Deletes itself 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Drops file in Program Files directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: LoadsDriver 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5691e040c8bb50093f146229152880fe.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5691e040c8bb50093f146229152880fe.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5571edeb79b44719cbac2a1553f9cd37b
SHA14711dfcdc32af57122041bfa9f8fa0127c11d6ec
SHA256ecf5e930b93344bd96d124212d7010d04205d01d3776acadf58e8512c1ec32c9
SHA512eec707c3c66cac1e1b88d56aa75f9a186c723242a1460692069e09cee6943995466081a8db95e6c44cc7419a608d665238b2f59fdf057ffa06028e8d681664a5
-
Filesize
98B
MD5f816d8bcc81792dfadff27d5f90929d7
SHA1e391ade9290ad9f635eddb0a4465f51536845c1c
SHA256838acb9a66e235a5ba24cd021ba8ea37c947cd27e39b41de2d78419e6b54e2e3
SHA5125badc0c24680b5f99f17696b3f3d9f4b0a8ff37e3982a7e0e416fd70acaf021065145f86ed673ebdfa675e77c2670edab1ba4895afb130cc07a29f156f60e0bf
-
Filesize
7.7MB
MD580a8b94bfeb01171a4c9ad1f9d28516c
SHA11d105383796e8182978098a4b1628def7f056dfa
SHA256362f2232c9cb0e5d1f8012f9faf7f556c05134cd4bb1e27ddaf82748e9f33a35
SHA51277115cb3e88cf4556e1ac900d11a3bfd87df3acdd6bf05a5c251e08eb0398952b05b61520df3342115c3a27205cf9e92128b5c4a4985319743cf15baf355c5e2
