Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20250207-en -
resource tags
arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system -
submitted
04/03/2025, 02:32
Behavioral task
behavioral1
Sample
JaffaCakes118_4a992073eba7824afd8cd979d673f360.dll
Resource
win7-20250207-en
windows7-x64
9 signatures
150 seconds
General
-
Target
JaffaCakes118_4a992073eba7824afd8cd979d673f360.dll
-
Size
109KB
-
MD5
4a992073eba7824afd8cd979d673f360
-
SHA1
f6a153868354724e4b6304f6a6951e961f7a1339
-
SHA256
aa8cdc1fd576fdb4054ac271dcb0a8ba3ffcc6e92b279200b57750c66c5cdd9c
-
SHA512
0dd13bcd85d1d8648a177ec125f3cb6c4e03dc3a04e8bdd2408239b28cdfd9fdfdca598d9d93c4e98762e529d83419b1af392b1fbae3af5f590f776cb300d8f3
-
SSDEEP
3072:iGTvJajknPoPRxnJjq+3iLUrvQktTw9/LR:n7nPWV3MUokNw9jR
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral1/files/0x000c000000014723-3.dat family_gh0strat -
Gh0strat family
-
Loads dropped DLL 1 IoCs
pid Process 2864 svchost.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Lcxq\Sibsyfheu.gif rundll32.exe File created C:\Program Files (x86)\Lcxq\Sibsyfheu.gif rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe 2864 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 2720 rundll32.exe Token: SeRestorePrivilege 2720 rundll32.exe Token: SeBackupPrivilege 2720 rundll32.exe Token: SeRestorePrivilege 2720 rundll32.exe Token: SeBackupPrivilege 2720 rundll32.exe Token: SeRestorePrivilege 2720 rundll32.exe Token: SeBackupPrivilege 2720 rundll32.exe Token: SeRestorePrivilege 2720 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 272 wrote to memory of 2720 272 rundll32.exe 30 PID 272 wrote to memory of 2720 272 rundll32.exe 30 PID 272 wrote to memory of 2720 272 rundll32.exe 30 PID 272 wrote to memory of 2720 272 rundll32.exe 30 PID 272 wrote to memory of 2720 272 rundll32.exe 30 PID 272 wrote to memory of 2720 272 rundll32.exe 30 PID 272 wrote to memory of 2720 272 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4a992073eba7824afd8cd979d673f360.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:272 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4a992073eba7824afd8cd979d673f360.dll,#12⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2720
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2864
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10.3MB
MD5eef735b775da7e0bb40c92a6e2e5efed
SHA13f79a0134f25f8f8afa4ffd7c9c73bd4e6009b00
SHA2561d0ee7a42aa4fb8bbc10148a1f3bf472265786682f8b2e737cc6f91468c9e779
SHA51233778f92ad17137a9b5a3591947e57587714bee201c4140ede8ff75358978934966a2782c97c3883be35e51a50bb7a047fd7dafe378452f663804d241f0a4e36
