Analysis
-
max time kernel
150s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
03/03/2025, 17:49
Behavioral task
behavioral1
Sample
JaffaCakes118_484721c3727b8f2fde9632aae58babdf.dll
Resource
win7-20241010-en
windows7-x64
General
-
Target
JaffaCakes118_484721c3727b8f2fde9632aae58babdf.dll
-
Size
8.8MB
-
MD5
484721c3727b8f2fde9632aae58babdf
-
SHA1
ecafaa980c3d90baa1a398ddcfc3fbe26d5daea1
-
SHA256
449eb8e8720a4e4a54965cf49a639fe1343bdeeaa14e97d6c9950de9b3ae9e8f
-
SHA512
19bbdf117f0811302e1f87dd6ef8fd13e5355294e29752be6e649a541b2c5fe9dd5f3bfb09a2e8c8460b0532606cd09c5318a8a0f75f45b65d6a3605392537bb
-
SSDEEP
3072:BvBKS+26Y8zoz4EfZRzUKR/F4pEIbybZuwYc1UqhEEEEEEEEEEEEEEEEEEEEEEEP:N8tA1fYmFEX2ZuwFCT
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x0010000000023be6-3.dat family_gh0strat -
Gh0strat family
-
Loads dropped DLL 1 IoCs
pid Process 2416 svchost.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe 2416 svchost.exe -
Suspicious use of AdjustPrivilegeToken 14 IoCs
description pid Process Token: SeBackupPrivilege 4552 rundll32.exe Token: SeRestorePrivilege 4552 rundll32.exe Token: SeBackupPrivilege 4552 rundll32.exe Token: SeRestorePrivilege 4552 rundll32.exe Token: SeBackupPrivilege 4552 rundll32.exe Token: SeRestorePrivilege 4552 rundll32.exe Token: SeBackupPrivilege 4552 rundll32.exe Token: SeRestorePrivilege 4552 rundll32.exe Token: SeBackupPrivilege 2416 svchost.exe Token: SeRestorePrivilege 2416 svchost.exe Token: SeBackupPrivilege 2416 svchost.exe Token: SeRestorePrivilege 2416 svchost.exe Token: SeBackupPrivilege 2416 svchost.exe Token: SeRestorePrivilege 2416 svchost.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 232 wrote to memory of 4552 232 rundll32.exe 85 PID 232 wrote to memory of 4552 232 rundll32.exe 85 PID 232 wrote to memory of 4552 232 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_484721c3727b8f2fde9632aae58babdf.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:232 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_484721c3727b8f2fde9632aae58babdf.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4552
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2416
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14.4MB
MD54bcdeaff2f41e0da8d4d7dd0a8bbcf4c
SHA1e50f12c83745df84000f5afdf6cc2a0a57649fb0
SHA2564bfdbe2963d4f9a996c3a407359475da49e85efb9ea27698c46e68bba48e78f8
SHA5126311ad71d496ed94216e43859eacd43bd8c8e8a6c98d677980e7fd8a2f2f94b19d65acf04ca791d3428f7dcf09f7106d574a90971ee39ea9639fbbf310c5276d
