Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
02/03/2025, 08:44
Behavioral task
behavioral1
Sample
JaffaCakes118_3f28472720aff06c9f3f449c0d6e0a80.dll
Resource
win7-20241010-en
windows7-x64
General
-
Target
JaffaCakes118_3f28472720aff06c9f3f449c0d6e0a80.dll
-
Size
101KB
-
MD5
3f28472720aff06c9f3f449c0d6e0a80
-
SHA1
6174822dca7693473d2edd8936381f51a3dd5698
-
SHA256
4c51780cc3002ccc4e10ea8af3f7299459bf14a4ade6f79871341c9c3434d017
-
SHA512
2afc9339012daf5a7b88319fefd86ec337eadf56e78ec5a0557ca186c0a768537125338fb870b05a459f86be54990696ec8cfad0ac3cf6a4a5c636dcf453ebe6
-
SSDEEP
3072:CwZSQpKa3VGVnpUlCz764/9xpEEBqbZuww5iG:JJVGpxx9b3wZuww4G
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x000b000000023d3d-3.dat family_gh0strat -
Gh0strat family
-
Loads dropped DLL 1 IoCs
pid Process 5148 svchost.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Jkvc\Ghjjiufas.gif rundll32.exe File created C:\Program Files (x86)\Jkvc\Ghjjiufas.gif rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe 5148 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 6068 rundll32.exe Token: SeRestorePrivilege 6068 rundll32.exe Token: SeBackupPrivilege 6068 rundll32.exe Token: SeRestorePrivilege 6068 rundll32.exe Token: SeBackupPrivilege 6068 rundll32.exe Token: SeRestorePrivilege 6068 rundll32.exe Token: SeBackupPrivilege 6068 rundll32.exe Token: SeRestorePrivilege 6068 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3932 wrote to memory of 6068 3932 rundll32.exe 85 PID 3932 wrote to memory of 6068 3932 rundll32.exe 85 PID 3932 wrote to memory of 6068 3932 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3f28472720aff06c9f3f449c0d6e0a80.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3f28472720aff06c9f3f449c0d6e0a80.dll,#12⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:6068
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5148
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD5d49b2f7358b553de79e2b3ca470acdd8
SHA1953e4e4cccf97154300fbf8a0e11377caa17f383
SHA256058d77252cc2010f643c597e8f384b18c775707ade47332faabd04bae71d764e
SHA512b23f9e2a64d8fb90b366cd4c12f8c76bbaeede90ed50881fd8b0e72017686fa44a204df53f5df70804a756ae14aa930e481a46e4fc317042c4500b807a5a135a
