Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
04/03/2025, 02:32
Behavioral task
behavioral1
Sample
JaffaCakes118_4a992073eba7824afd8cd979d673f360.dll
Resource
win7-20250207-en
windows7-x64
General
-
Target
JaffaCakes118_4a992073eba7824afd8cd979d673f360.dll
-
Size
109KB
-
MD5
4a992073eba7824afd8cd979d673f360
-
SHA1
f6a153868354724e4b6304f6a6951e961f7a1339
-
SHA256
aa8cdc1fd576fdb4054ac271dcb0a8ba3ffcc6e92b279200b57750c66c5cdd9c
-
SHA512
0dd13bcd85d1d8648a177ec125f3cb6c4e03dc3a04e8bdd2408239b28cdfd9fdfdca598d9d93c4e98762e529d83419b1af392b1fbae3af5f590f776cb300d8f3
-
SSDEEP
3072:iGTvJajknPoPRxnJjq+3iLUrvQktTw9/LR:n7nPWV3MUokNw9jR
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x000c000000023d52-3.dat family_gh0strat -
Gh0strat family
-
Loads dropped DLL 1 IoCs
pid Process 32 svchost.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Lcxq\Sibsyfheu.gif rundll32.exe File created C:\Program Files (x86)\Lcxq\Sibsyfheu.gif rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe 32 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 5064 rundll32.exe Token: SeRestorePrivilege 5064 rundll32.exe Token: SeBackupPrivilege 5064 rundll32.exe Token: SeRestorePrivilege 5064 rundll32.exe Token: SeBackupPrivilege 5064 rundll32.exe Token: SeRestorePrivilege 5064 rundll32.exe Token: SeBackupPrivilege 5064 rundll32.exe Token: SeRestorePrivilege 5064 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1852 wrote to memory of 5064 1852 rundll32.exe 86 PID 1852 wrote to memory of 5064 1852 rundll32.exe 86 PID 1852 wrote to memory of 5064 1852 rundll32.exe 86
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4a992073eba7824afd8cd979d673f360.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4a992073eba7824afd8cd979d673f360.dll,#12⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5064
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:32
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD5d57c1b9a1bebac199931ab45cdd3afe3
SHA1f68eb0ff7a09dc67da2b2d8d64a712031b3cc14e
SHA256dc49f3fb50f9c49387280327ec77be663fd43450a19c9a789bd1284723563d4c
SHA512e41dc2c34bbbc5afe919f48e5136f1903b7bd37094db97000ffda35604515eacb65114947d0559d374b0f7d97a538cbf9fce7442bb33b4334f26e2249e206bb2
