Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
02/03/2025, 08:11
Behavioral task
behavioral1
Sample
JaffaCakes118_3efa91bc13e14127fa1e41e9f3518920.dll
Resource
win7-20240903-en
windows7-x64
General
-
Target
JaffaCakes118_3efa91bc13e14127fa1e41e9f3518920.dll
-
Size
131KB
-
MD5
3efa91bc13e14127fa1e41e9f3518920
-
SHA1
17dd29911f20e7234d70d41bedaebbd73e83bb28
-
SHA256
74e11fee1abbf5921e05c42bf0719ceff1e762881ca743ff248e87f5c8c069ad
-
SHA512
ec62b4b42d9fdd59348fd3f2834c34d6ded59e48c64b87aae6c85c2d2441ead3c0594705305e9307a07e94fd0c00c65a09015c7c75d8b49e8a9a3346d9ed6945
-
SSDEEP
3072:PWLeYPiFfs8qr+Nw7h+Feu4g8qbACPAKJrV3MIDo47:Bs8qVTohAM1laIEc
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x000f000000023c4d-3.dat family_gh0strat -
Gh0strat family
-
Loads dropped DLL 1 IoCs
pid Process 5732 svchost.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Lhij\Qhijklmno.bmp rundll32.exe File created C:\Program Files (x86)\Lhij\Qhijklmno.bmp rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe 5732 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 4348 rundll32.exe Token: SeRestorePrivilege 4348 rundll32.exe Token: SeBackupPrivilege 4348 rundll32.exe Token: SeRestorePrivilege 4348 rundll32.exe Token: SeBackupPrivilege 4348 rundll32.exe Token: SeRestorePrivilege 4348 rundll32.exe Token: SeBackupPrivilege 4348 rundll32.exe Token: SeRestorePrivilege 4348 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5668 wrote to memory of 4348 5668 rundll32.exe 87 PID 5668 wrote to memory of 4348 5668 rundll32.exe 87 PID 5668 wrote to memory of 4348 5668 rundll32.exe 87
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3efa91bc13e14127fa1e41e9f3518920.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:5668 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3efa91bc13e14127fa1e41e9f3518920.dll,#12⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4348
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5732
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
18.7MB
MD5d3afec82540ca357f35ec02878a2f071
SHA137e46b0adf3c93c9e0a1eb6f4daa8e760324c4a8
SHA256f154c291222aa7ffe257faf3e3d4484cd756a1e59017460bcc95334651e7ef83
SHA5127aff6f82a1e76223479b33963ee2a238d38c338410ed5a17c4f2e66715c529a40e7f63411af7a56b0b7065c60fadf206c99fc308c0b39aa6b9baabd4ee4e157e
