Overview

overview

10

Static

static

10

JaffaCakes...c6.exe

windows7-x64

10

JaffaCakes...c6.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    93s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/03/2025, 07:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_4be029b09b8e3fe3abccfaa224c41ec6.exe

  • Size

    10.2MB

  • MD5

    4be029b09b8e3fe3abccfaa224c41ec6

  • SHA1

    e0ce1cbf170ad06367e1f1481755be06c578bfc6

  • SHA256

    3a9a6d4bbfbc7bd43f8e9b9962c06a3fe851b06d95cf4d9830e4febe8211e42a

  • SHA512

    3a80c7b791bdc66c39041b5dcc686f47a58051ab1a429b0cfd3d864816a59d98442585ab450002ef9b859d9b5d01f74ec3c0c2cb6579762af975d54d0bff1167

  • SSDEEP

    3072:SQhOv9nd/M9Wzh0kHbPzYrIy97rsQUt06M8VqWtDG8vdbOeZCNVowgnCJ2BsJln:SQYv9nO9SXHbP0sy9kF07iRvdbvIUChn

Score
10/10
gh0stratdiscoveryrat

Malware Config

Signatures

  • Gh0st RAT payload 3 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat
  • Gh0strat family
    gh0strat
  • Deletes itself 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Drops file in System32 directory 1 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4be029b09b8e3fe3abccfaa224c41ec6.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4be029b09b8e3fe3abccfaa224c41ec6.exe"
    1⤵
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1084
    • C:\system
      C:\system C:\PROGRA~1\Realtek\EDITOR~1.DLL hime
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:3828
    • C:\system
      C:\system C:\PROGRA~1\WIFE7F~1\CONTRO~1.CPL comdl2
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:860
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 860 -s 1356
        3⤵
        • Program crash
        PID:4920
    • C:\system
      C:\system C:\PROGRA~1\Realtek\EDITOR~1.DLL comdl2
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:5044
  • C:\Windows\System32\svchost.exe
    C:\Windows\\System32\\svchost.exe -k netsvcs -s FastUserSwitchingCompatibility
    1⤵
      PID:5080
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 860 -ip 860
      1⤵
        PID:1524

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\PROGRA~1\WIFE7F~1\CONTRO~1.CPL
        Filesize

        30.1MB

        MD5

        37d9791df2ba01c58479658d00087788

        SHA1

        c99fcade315f7b2319e64155e0bea94d2001620e

        SHA256

        71a2b0f57beacaf48f4813e3ac243f98fbb3e0149245bcd3bf3d65b80427ef1f

        SHA512

        5e34fac3e3c95aa44e10c577a67b626c7c610433505040cedccb935e9feb6c007556d61b204ef9e1678312b5f520a974b40af8dfeea090ae0e4fb1a42b411530

        Download Submit

      • C:\Windows\SysWOW64\bak8011252.log
        Filesize

        84B

        MD5

        8dd11cc6d674c054f444456841febd7c

        SHA1

        e9adbfd45044f03034ba51e531e2d4f3581e3f0a

        SHA256

        5a9842ceec957fe8aaaf7b93233b1fe42fe3ff11b3690171af9b1d1f8d5c65aa

        SHA512

        ea8ee1d34d5f62554826632217b2c63bad135491e8e7054cb4c78de9023ca3d2a44fc305ea7770249bba711d29228c9bacffd5fbe1df0eb6ce50bc0bff7d5675

        Download Submit

      • C:\system
        Filesize

        60KB

        MD5

        889b99c52a60dd49227c5e485a016679

        SHA1

        8fa889e456aa646a4d0a4349977430ce5fa5e2d7

        SHA256

        6cbe0e1f046b13b29bfa26f8b368281d2dda7eb9b718651d5856f22cc3e02910

        SHA512

        08933106eaf338dd119c45cbf1f83e723aff77cc0f8d3fc84e36253b1eb31557a54211d1d5d1cb58958188e32064d451f6c66a24b3963cccd3de07299ab90641

        Download Submit

      • memory/1084-0-0x0000000000400000-0x0000000000435000-memory.dmp

        Filesize

        212KB

        Download

      • memory/1084-23-0x0000000000400000-0x0000000000435000-memory.dmp

        Filesize

        212KB

        Download