Analysis
-
max time kernel
150s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03/03/2025, 04:44
Behavioral task
behavioral1
Sample
JaffaCakes118_44d1e4721af52216393b183f468e4090.dll
Resource
win7-20240903-en
windows7-x64
8 signatures
150 seconds
General
-
Target
JaffaCakes118_44d1e4721af52216393b183f468e4090.dll
-
Size
101KB
-
MD5
44d1e4721af52216393b183f468e4090
-
SHA1
0bf27d3af9faf3b48ae97982535b52df17df10c5
-
SHA256
d20cf360812688382a9b89a8be832aec9e0a87f6cba2e68d34ca7beec8c37c66
-
SHA512
67b368328e3edd8229a2b140a0693200aae3ba86ce31a2116aa3b62b0cfb257a3a64f0706efed0aac6b5ef4d99842b93e519559b0ff60ac4e8dcdb0dd611e542
-
SSDEEP
3072:CwZSQpKa3VGVnpUlCz764/9xpEEBqbZuwL5iG:JJVGpxx9b3wZuwL4G
Malware Config
Signatures
-
Gh0st RAT payload 2 IoCs
resource yara_rule behavioral1/files/0x000c0000000120f9-3.dat family_gh0strat behavioral1/memory/1192-4-0x0000000010000000-0x000000001001C000-memory.dmp family_gh0strat -
Gh0strat family
-
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\FileName.jpg rundll32.exe File created C:\Windows\FileName.jpg rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe 1192 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 2976 rundll32.exe Token: SeRestorePrivilege 2976 rundll32.exe Token: SeBackupPrivilege 2976 rundll32.exe Token: SeRestorePrivilege 2976 rundll32.exe Token: SeBackupPrivilege 2976 rundll32.exe Token: SeRestorePrivilege 2976 rundll32.exe Token: SeBackupPrivilege 2976 rundll32.exe Token: SeRestorePrivilege 2976 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2100 wrote to memory of 2976 2100 rundll32.exe 30 PID 2100 wrote to memory of 2976 2100 rundll32.exe 30 PID 2100 wrote to memory of 2976 2100 rundll32.exe 30 PID 2100 wrote to memory of 2976 2100 rundll32.exe 30 PID 2100 wrote to memory of 2976 2100 rundll32.exe 30 PID 2100 wrote to memory of 2976 2100 rundll32.exe 30 PID 2100 wrote to memory of 2976 2100 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_44d1e4721af52216393b183f468e4090.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_44d1e4721af52216393b183f468e4090.dll,#12⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2976
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1192
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
15.4MB
MD5f08f5acc4f642f35b66c129b0bd976e6
SHA16a37d224ac00bbe54762ffae9585d26a61d43bd6
SHA2560f4c57ec93d52fd23269b647941fe90ff6b5d0d7f653a0754e8fab4a46d0f7e9
SHA512ac5cf6d3eeb2f066b9ca55e78f2d20343dbab772a49c0b92c94654c5c3aee558f267b5bb29be79922367c347e01e0508249a1e988445efe322dc707ec72feb92
