Analysis
-
max time kernel
149s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
04/03/2025, 09:04
General
-
Target
JaffaCakes118_4c6e1fa4e30d8ab765d17994b07d27c9.exe
-
Size
162KB
-
MD5
4c6e1fa4e30d8ab765d17994b07d27c9
-
SHA1
f68d52dd52c9125682ae8c41e37c5df38f5bf16a
-
SHA256
2adc7d8a9e6444bf3bd1c2158a6a33fdf86f0431427ab82999cc30e869493950
-
SHA512
ef38fa8074df9a51ca8348031e1d2d7bd8c45a5a72cefbe4a36f79db41bb01ed3f4b734a73365ad4a1b8d197eaa7d8bc015a8036ce07f61b60bf7b31e7cddb95
-
SSDEEP
3072:ZsYhccIJBsCEAcUtX2r6RDeb46oZifcW/V/JiYd/eqovXn9:CYuqesmxqWZift9Jhteqol
Malware Config
Signatures
-
Gh0st RAT payload 3 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
Deletes itself 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Drops file in Program Files directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4c6e1fa4e30d8ab765d17994b07d27c9.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4c6e1fa4e30d8ab765d17994b07d27c9.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
116KB
MD541938eb225f1d31c323314b6ee10330e
SHA1e585fb5415da7b9fc8a2ab2906aaab3f113cd429
SHA25626366e4ce82c98aa59bcba4bc1823638be422d354a41e5496c80ce073b3d10c4
SHA5128b9a42e56cc5f28b59e8e3fc73b2ecb248b1b750081cbb0826e0e0d5a3cca7840b3e4c7acf6de0c97bfb40318a7cc4824e46e3ec92c6d509de5452bfeb329d85
-
Filesize
10.7MB
MD56923d307cff6fbec58d6cf99e625932a
SHA1b591719e64a314838887aefe14ab256036654141
SHA256f8f3a9ec417a1e6e858a143603adc4f2d96ff4b10beeba0bb5311547892ca6c6
SHA51265e5f47463266ffdc6b286da6d1fb8d82ab3dc516c38bb9f424288ca101d50f4b198c077ab5ca1b94584a7a2fe6f1a0b78dd181622b84debae62d407a5b13bf2
-
Filesize
98B
MD5fbb32978cf262199b73bff01eb84a97c
SHA14995108e1f49a09c11a1afc28ebf871770ee31fb
SHA2561d3b645042aad5e25f18abdafe47ddef4dadffe3a6723112cf2fb9f6f6576470
SHA51260437d180c6aefa34eb5cfabc51fa49aff7b51a552460d89b7b7609db9bb8da63930683e3d2fe0ed94054c4599e42cb75fdfc0fe7f46ae6763c772d939521924
-
Filesize
116KB
