Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
02/03/2025, 17:33
Behavioral task
behavioral1
Sample
JaffaCakes118_4198cf671d1497f56ca89a577689e33f.dll
Resource
win7-20241010-en
windows7-x64
General
-
Target
JaffaCakes118_4198cf671d1497f56ca89a577689e33f.dll
-
Size
116KB
-
MD5
4198cf671d1497f56ca89a577689e33f
-
SHA1
ad4aeb7ee8c7f92652404fef22f16efbf3ccf5e2
-
SHA256
256662ec43cbcccbbdfd6e058e818901b35abc2f41c119a0ed22437d26eb15d0
-
SHA512
c7fcd45e22629b22f9ba026c4859e4a0ea15c09fcb1ccd86eae886cb5e4e2b436ee458967d9103ab40ae02eab56fcb1a78a75d8e5580b9c23b9e7c0d7f88b9f7
-
SSDEEP
3072:HMco6SpOkAcf032rZRDeK76oZif1F/V/U9FYd:La9jlx/BZifH9UG
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x000e000000023c82-2.dat family_gh0strat -
Gh0strat family
-
Loads dropped DLL 1 IoCs
pid Process 4536 svchost.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\WinRAR.jpg rundll32.exe File opened for modification C:\Program Files (x86)\WinRAR.jpg rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe 4536 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 60 rundll32.exe Token: SeRestorePrivilege 60 rundll32.exe Token: SeBackupPrivilege 60 rundll32.exe Token: SeRestorePrivilege 60 rundll32.exe Token: SeBackupPrivilege 60 rundll32.exe Token: SeRestorePrivilege 60 rundll32.exe Token: SeBackupPrivilege 60 rundll32.exe Token: SeRestorePrivilege 60 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2176 wrote to memory of 60 2176 rundll32.exe 89 PID 2176 wrote to memory of 60 2176 rundll32.exe 89 PID 2176 wrote to memory of 60 2176 rundll32.exe 89
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4198cf671d1497f56ca89a577689e33f.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4198cf671d1497f56ca89a577689e33f.dll,#12⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:60
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4536
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
116KB
MD54198cf671d1497f56ca89a577689e33f
SHA1ad4aeb7ee8c7f92652404fef22f16efbf3ccf5e2
SHA256256662ec43cbcccbbdfd6e058e818901b35abc2f41c119a0ed22437d26eb15d0
SHA512c7fcd45e22629b22f9ba026c4859e4a0ea15c09fcb1ccd86eae886cb5e4e2b436ee458967d9103ab40ae02eab56fcb1a78a75d8e5580b9c23b9e7c0d7f88b9f7
