Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02/03/2025, 08:11
Behavioral task
behavioral1
Sample
JaffaCakes118_3efa91bc13e14127fa1e41e9f3518920.dll
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
General
-
Target
JaffaCakes118_3efa91bc13e14127fa1e41e9f3518920.dll
-
Size
131KB
-
MD5
3efa91bc13e14127fa1e41e9f3518920
-
SHA1
17dd29911f20e7234d70d41bedaebbd73e83bb28
-
SHA256
74e11fee1abbf5921e05c42bf0719ceff1e762881ca743ff248e87f5c8c069ad
-
SHA512
ec62b4b42d9fdd59348fd3f2834c34d6ded59e48c64b87aae6c85c2d2441ead3c0594705305e9307a07e94fd0c00c65a09015c7c75d8b49e8a9a3346d9ed6945
-
SSDEEP
3072:PWLeYPiFfs8qr+Nw7h+Feu4g8qbACPAKJrV3MIDo47:Bs8qVTohAM1laIEc
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral1/files/0x000c000000016645-3.dat family_gh0strat -
Gh0strat family
-
Loads dropped DLL 1 IoCs
pid Process 2676 svchost.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Lhij\Qhijklmno.bmp rundll32.exe File created C:\Program Files (x86)\Lhij\Qhijklmno.bmp rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 2252 rundll32.exe Token: SeRestorePrivilege 2252 rundll32.exe Token: SeBackupPrivilege 2252 rundll32.exe Token: SeRestorePrivilege 2252 rundll32.exe Token: SeBackupPrivilege 2252 rundll32.exe Token: SeRestorePrivilege 2252 rundll32.exe Token: SeBackupPrivilege 2252 rundll32.exe Token: SeRestorePrivilege 2252 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2116 wrote to memory of 2252 2116 rundll32.exe 30 PID 2116 wrote to memory of 2252 2116 rundll32.exe 30 PID 2116 wrote to memory of 2252 2116 rundll32.exe 30 PID 2116 wrote to memory of 2252 2116 rundll32.exe 30 PID 2116 wrote to memory of 2252 2116 rundll32.exe 30 PID 2116 wrote to memory of 2252 2116 rundll32.exe 30 PID 2116 wrote to memory of 2252 2116 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3efa91bc13e14127fa1e41e9f3518920.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3efa91bc13e14127fa1e41e9f3518920.dll,#12⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2252
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2676
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9.1MB
MD58ee37bbacc449a7f1989acf77c832f34
SHA1fe13899e46dcbdd5ff68e1ca5240f69664a58a0f
SHA256c5546b60cd102fe51a244e19aa64a5246227eb733e177aac67d3b2db841e6ab0
SHA512909443977f297f5a18160ec7410059265e72e12d6a2aeb49085071fd17a06f7d025ebc2b1016c5790e4b3da40c95f8581de1f151f9dc0863fee6b670c3b7a983
