Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
03/03/2025, 08:30
Behavioral task
behavioral1
Sample
JaffaCakes118_45f70b678353c2251829d69c1eb3c8f0.dll
Resource
win7-20240903-en
windows7-x64
General
-
Target
JaffaCakes118_45f70b678353c2251829d69c1eb3c8f0.dll
-
Size
117KB
-
MD5
45f70b678353c2251829d69c1eb3c8f0
-
SHA1
ab678312e1008851b6b55b757143f72cfa87f9bf
-
SHA256
73d13ae2382a928538a0b67b0ac7dba0a2a4f08526c066b7afd45c7e7399ac64
-
SHA512
33b402ae474829af99aa0cd7591ff2d83f74765883925447c0695c975ceba1826162917bc3ed120016d0a06d3f7a6f62b5998e65b3952561ac2e76d22a2e3c8e
-
SSDEEP
3072:OT6QTlxjLXCKDcMERjtJXVtEhKw8DI0cUD:O3HyvjTXLiKw8DItU
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x0010000000023bd6-3.dat family_gh0strat -
Gh0strat family
-
Loads dropped DLL 1 IoCs
pid Process 388 svchost.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Nurh\Yhonsrkrt.bmp rundll32.exe File created C:\Program Files (x86)\Nurh\Yhonsrkrt.bmp rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe 388 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 412 rundll32.exe Token: SeRestorePrivilege 412 rundll32.exe Token: SeBackupPrivilege 412 rundll32.exe Token: SeRestorePrivilege 412 rundll32.exe Token: SeBackupPrivilege 412 rundll32.exe Token: SeRestorePrivilege 412 rundll32.exe Token: SeBackupPrivilege 412 rundll32.exe Token: SeRestorePrivilege 412 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1152 wrote to memory of 412 1152 rundll32.exe 86 PID 1152 wrote to memory of 412 1152 rundll32.exe 86 PID 1152 wrote to memory of 412 1152 rundll32.exe 86
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_45f70b678353c2251829d69c1eb3c8f0.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_45f70b678353c2251829d69c1eb3c8f0.dll,#12⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:412
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:388
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17.7MB
MD50a06757f68cb487ca5302fc6f318b7b1
SHA163e794f5b691d4f7f42b97c42f7bfe976af91951
SHA2562fef00ab8779979ec8892965823034eb25a3cdd44a895a14de8504e9a98dcdd0
SHA5125500f6794be3c669f3e2d682e5ad60735aeaed8d355b4610296026ba9257cd1b83f1f102c88417a6825c3d2de56f939f1d0cf8fd550f81ac53af2e956751d606
