Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03/03/2025, 08:30
Behavioral task
behavioral1
Sample
JaffaCakes118_45f70b678353c2251829d69c1eb3c8f0.dll
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
General
-
Target
JaffaCakes118_45f70b678353c2251829d69c1eb3c8f0.dll
-
Size
117KB
-
MD5
45f70b678353c2251829d69c1eb3c8f0
-
SHA1
ab678312e1008851b6b55b757143f72cfa87f9bf
-
SHA256
73d13ae2382a928538a0b67b0ac7dba0a2a4f08526c066b7afd45c7e7399ac64
-
SHA512
33b402ae474829af99aa0cd7591ff2d83f74765883925447c0695c975ceba1826162917bc3ed120016d0a06d3f7a6f62b5998e65b3952561ac2e76d22a2e3c8e
-
SSDEEP
3072:OT6QTlxjLXCKDcMERjtJXVtEhKw8DI0cUD:O3HyvjTXLiKw8DItU
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral1/files/0x000c00000001686c-3.dat family_gh0strat -
Gh0strat family
-
Loads dropped DLL 1 IoCs
pid Process 1944 svchost.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Nurh\Yhonsrkrt.bmp rundll32.exe File created C:\Program Files (x86)\Nurh\Yhonsrkrt.bmp rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe 1944 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 2076 rundll32.exe Token: SeRestorePrivilege 2076 rundll32.exe Token: SeBackupPrivilege 2076 rundll32.exe Token: SeRestorePrivilege 2076 rundll32.exe Token: SeBackupPrivilege 2076 rundll32.exe Token: SeRestorePrivilege 2076 rundll32.exe Token: SeBackupPrivilege 2076 rundll32.exe Token: SeRestorePrivilege 2076 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2424 wrote to memory of 2076 2424 rundll32.exe 28 PID 2424 wrote to memory of 2076 2424 rundll32.exe 28 PID 2424 wrote to memory of 2076 2424 rundll32.exe 28 PID 2424 wrote to memory of 2076 2424 rundll32.exe 28 PID 2424 wrote to memory of 2076 2424 rundll32.exe 28 PID 2424 wrote to memory of 2076 2424 rundll32.exe 28 PID 2424 wrote to memory of 2076 2424 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_45f70b678353c2251829d69c1eb3c8f0.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_45f70b678353c2251829d69c1eb3c8f0.dll,#12⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2076
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1944
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17.5MB
MD515a66318746eb2bcbf4fccb7fc67ec26
SHA1289b057580514e44cd32c4e689e6ac667af027a5
SHA256b0234ce681664a10a5b2841e951e88bcff1b0322407e7de4ebb9f1b36dd7c14c
SHA512500f25a383bab67e31de000a1001524ffe56a05613681c1b1c89b62668559e723b54d3cf47c1982010ac75bbab75c0a89f13c6467db63add922a71e9e85eaef1
