Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
02/03/2025, 10:37
Behavioral task
behavioral1
Sample
JaffaCakes118_3fb1d42bd2b13c080f38ac0cd0039670.dll
Resource
win7-20241010-en
windows7-x64
9 signatures
150 seconds
General
-
Target
JaffaCakes118_3fb1d42bd2b13c080f38ac0cd0039670.dll
-
Size
109KB
-
MD5
3fb1d42bd2b13c080f38ac0cd0039670
-
SHA1
27b672dc7450a0b7a5b104bb86d545d027e03358
-
SHA256
6ee5605b22fade99a4656d28712a83b70abac96b023e9c0e64802ab8ab4938ad
-
SHA512
75c1164ebe7edd8336962b48f9abe2ee5824f9559caf3779e6c451d3c222036a1eba740711fd95a224885e1294f705732b61dd6ba951442f7775bedb4392ed8b
-
SSDEEP
3072:xVvh8Q3aHS4ktdH5lfZbh0tt2/Y4xeTKhYOZLwARv6c:RayjdZ1ZbWi/vxgK7ZLwGv
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral1/files/0x0018000000016fc9-3.dat family_gh0strat -
Gh0strat family
-
Loads dropped DLL 1 IoCs
pid Process 2856 svchost.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Qgya\Ucnitchab.bmp rundll32.exe File created C:\Program Files (x86)\Qgya\Ucnitchab.bmp rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe 2856 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 2424 rundll32.exe Token: SeRestorePrivilege 2424 rundll32.exe Token: SeBackupPrivilege 2424 rundll32.exe Token: SeRestorePrivilege 2424 rundll32.exe Token: SeBackupPrivilege 2424 rundll32.exe Token: SeRestorePrivilege 2424 rundll32.exe Token: SeBackupPrivilege 2424 rundll32.exe Token: SeRestorePrivilege 2424 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2304 wrote to memory of 2424 2304 rundll32.exe 29 PID 2304 wrote to memory of 2424 2304 rundll32.exe 29 PID 2304 wrote to memory of 2424 2304 rundll32.exe 29 PID 2304 wrote to memory of 2424 2304 rundll32.exe 29 PID 2304 wrote to memory of 2424 2304 rundll32.exe 29 PID 2304 wrote to memory of 2424 2304 rundll32.exe 29 PID 2304 wrote to memory of 2424 2304 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3fb1d42bd2b13c080f38ac0cd0039670.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3fb1d42bd2b13c080f38ac0cd0039670.dll,#12⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2424
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2856
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.0MB
MD5f2f8d257927603d6152a02df1eb13b2c
SHA1705323c4edd986575eda5ecee17f4a48b905721f
SHA256bf6bd71f09aabbdefe81c2be1fff71ec92ef2f8f7ddf27e889ee160092aab8d1
SHA512c2b8eba1ce30d09c48d68b268b6028e47f949943706b020672f08b8d3ca3fb6a8c5bfdc5ebab7c1ea7a737d3164ccf1c74c4c51e2672e8104fc66fefa6e7a7d0
