Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
04/03/2025, 09:04
General
-
Target
JaffaCakes118_4c6e1fa4e30d8ab765d17994b07d27c9.exe
-
Size
162KB
-
MD5
4c6e1fa4e30d8ab765d17994b07d27c9
-
SHA1
f68d52dd52c9125682ae8c41e37c5df38f5bf16a
-
SHA256
2adc7d8a9e6444bf3bd1c2158a6a33fdf86f0431427ab82999cc30e869493950
-
SHA512
ef38fa8074df9a51ca8348031e1d2d7bd8c45a5a72cefbe4a36f79db41bb01ed3f4b734a73365ad4a1b8d197eaa7d8bc015a8036ce07f61b60bf7b31e7cddb95
-
SSDEEP
3072:ZsYhccIJBsCEAcUtX2r6RDeb46oZifcW/V/JiYd/eqovXn9:CYuqesmxqWZift9Jhteqol
Malware Config
Signatures
-
Gh0st RAT payload 2 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
Deletes itself 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Drops file in Program Files directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: LoadsDriver 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4c6e1fa4e30d8ab765d17994b07d27c9.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4c6e1fa4e30d8ab765d17994b07d27c9.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
116KB
MD541938eb225f1d31c323314b6ee10330e
SHA1e585fb5415da7b9fc8a2ab2906aaab3f113cd429
SHA25626366e4ce82c98aa59bcba4bc1823638be422d354a41e5496c80ce073b3d10c4
SHA5128b9a42e56cc5f28b59e8e3fc73b2ecb248b1b750081cbb0826e0e0d5a3cca7840b3e4c7acf6de0c97bfb40318a7cc4824e46e3ec92c6d509de5452bfeb329d85
-
Filesize
99B
MD5a46a278e10ef0dba0fbe2f518699d168
SHA175725d6d0520164516e842466078bb45d4ab142f
SHA2565e98578109acdcc1ae7ec8f1aa2f091deffd7679536660d8506b3ed70dfe1d7f
SHA51299e7e154789245b9944725d488a4d5b71bf5e0639d262a883f40e0ea1faa81f5f26ced34f9f0b216c86e6d42a6f58d3e88b75ab5bb79f08e0bc4dbf8da2bca01
-
Filesize
14.4MB
MD5c25e3be75a8b1539edcc9dbc1b3f360b
SHA1d45f0c739b19c669bddabbfb7dcf8702880de80c
SHA25610d2fcf67472054c3cab42d73dad4ad343e5c923863e41716e47545908e12a05
SHA512ae00a3165b28bf790a0b3606906efe93dfc796a936cf192f2497ea665ce5b5edee377e3b1eb0dd2af82edea417a78d578f6b08d17a0f944db08ed73d09b50f86
