Analysis
-
max time kernel
149s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
29-01-2025 14:25
Behavioral task
behavioral1
Sample
JaffaCakes118_57e51de4615793bdd7674d962a9a5812.dll
Resource
win7-20240708-en
windows7-x64
General
-
Target
JaffaCakes118_57e51de4615793bdd7674d962a9a5812.dll
-
Size
110KB
-
MD5
57e51de4615793bdd7674d962a9a5812
-
SHA1
e7e0a1bdf261d0597e7416cb71e03a56ab7aef56
-
SHA256
03ec199e0ff1a061b31fa29727488d0915d4f2ee49b9295cf83431e4454dc1dc
-
SHA512
45827e69c7ffcfd050184e13cf00e027e7194130e205cf9ed55e54a755d1640016695bfba7b2e59f3e578e72a5548d2f76a01e23db0af68feb08a146f9298ee2
-
SSDEEP
3072:xVvh8Q3aHS4ktdH5lfZbh0tt2/Y4xeIKhYOZLwAx6cCZ:RayjdZ1ZbWi/vxrK7ZLw0g
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x000c000000023bfe-3.dat family_gh0strat -
Gh0strat family
-
Loads dropped DLL 1 IoCs
pid Process 4636 svchost.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Qgiu\Qyiykxpwy.bmp rundll32.exe File opened for modification C:\Program Files (x86)\Qgiu\Qyiykxpwy.bmp rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe 4636 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 1252 rundll32.exe Token: SeRestorePrivilege 1252 rundll32.exe Token: SeBackupPrivilege 1252 rundll32.exe Token: SeRestorePrivilege 1252 rundll32.exe Token: SeBackupPrivilege 1252 rundll32.exe Token: SeRestorePrivilege 1252 rundll32.exe Token: SeBackupPrivilege 1252 rundll32.exe Token: SeRestorePrivilege 1252 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1172 wrote to memory of 1252 1172 rundll32.exe 82 PID 1172 wrote to memory of 1252 1172 rundll32.exe 82 PID 1172 wrote to memory of 1252 1172 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_57e51de4615793bdd7674d962a9a5812.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_57e51de4615793bdd7674d962a9a5812.dll,#12⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1252
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4636
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19.0MB
MD517cb35cc6e480fce997c0484d48c6125
SHA10a7eba98f13a3fda31a15ce77247d125486ba93e
SHA256faaed6906657bd4b8928d8fc80b6708af8fd1557c30a71b96113e1f7fefc7a44
SHA5125b1b89b2a0fe50309534363dbdb055ee5acb1b6716dd74ca6c0e3db8b4dad4d78f07780f4d0305fd1643e6732c3c339b89dc477c861528cc7189a141fbe028ef
