Analysis
-
max time kernel
149s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
02/03/2025, 10:37
Behavioral task
behavioral1
Sample
JaffaCakes118_3fb1d42bd2b13c080f38ac0cd0039670.dll
Resource
win7-20241010-en
windows7-x64
General
-
Target
JaffaCakes118_3fb1d42bd2b13c080f38ac0cd0039670.dll
-
Size
109KB
-
MD5
3fb1d42bd2b13c080f38ac0cd0039670
-
SHA1
27b672dc7450a0b7a5b104bb86d545d027e03358
-
SHA256
6ee5605b22fade99a4656d28712a83b70abac96b023e9c0e64802ab8ab4938ad
-
SHA512
75c1164ebe7edd8336962b48f9abe2ee5824f9559caf3779e6c451d3c222036a1eba740711fd95a224885e1294f705732b61dd6ba951442f7775bedb4392ed8b
-
SSDEEP
3072:xVvh8Q3aHS4ktdH5lfZbh0tt2/Y4xeTKhYOZLwARv6c:RayjdZ1ZbWi/vxgK7ZLwGv
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x000b000000023d0e-3.dat family_gh0strat -
Gh0strat family
-
Loads dropped DLL 1 IoCs
pid Process 3916 svchost.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Qgya\Ucnitchab.bmp rundll32.exe File created C:\Program Files (x86)\Qgya\Ucnitchab.bmp rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe 3916 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 2704 rundll32.exe Token: SeRestorePrivilege 2704 rundll32.exe Token: SeBackupPrivilege 2704 rundll32.exe Token: SeRestorePrivilege 2704 rundll32.exe Token: SeBackupPrivilege 2704 rundll32.exe Token: SeRestorePrivilege 2704 rundll32.exe Token: SeBackupPrivilege 2704 rundll32.exe Token: SeRestorePrivilege 2704 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4768 wrote to memory of 2704 4768 rundll32.exe 84 PID 4768 wrote to memory of 2704 4768 rundll32.exe 84 PID 4768 wrote to memory of 2704 4768 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3fb1d42bd2b13c080f38ac0cd0039670.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3fb1d42bd2b13c080f38ac0cd0039670.dll,#12⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2704
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3916
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5c229e6fbbde120e7983c2deb9ef2ad92
SHA1a74fd8a611ad8368b2fa85df550ac01ffff5083a
SHA256766256ce8b95834a52cd8271c76c0c1870fcf71a1a5c54ca94953d4dd15a0c40
SHA51286a8261709854d49dd7b2d1a5a291c27d1800cffc6f5869df087bbf012be44beebe269ed6fc757697e29d120b77ae2cffbf0023d8280aa100a947d00c523df3f
