gh0strat | 2e23527092214412682e1a357a5fe51f63ef36012dfdd579b95290bc861aefeb

General

Target

JaffaCakes118_4caae72ac0b1d2a5180b007f8fd770c2.exe
Size

175KB
MD5

4caae72ac0b1d2a5180b007f8fd770c2
SHA1

da2b497207fe11182b82f703165c88ac5e0e6097
SHA256

2e23527092214412682e1a357a5fe51f63ef36012dfdd579b95290bc861aefeb
SHA512

7c3a3f0d7840b906ddca9c37ca99daa4dcca8a791ebb8bd0e1e1aa74516b01151945e87090e249cdc1ebc7bc1ff8886414d1a448a523394d0e7ecbc044f699d6
SSDEEP

3072:+0SpUMepbCwVK2xCMS7lgjp8hRaqp3yVoUlfVvRvFdaXRjdUsO/j7fjHt8JGC:iUMIb9jxOgjWhRaU34VRhFdaXHXO/j7x

Score

10^/10

gh0strat bootkit discovery persistence rat vmprotect

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
behavioral1/files/0x0034000000016d64-15.dat	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\fastuserswitchingcompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\ntfastuserswitchingcompatibility.dll"	setup.exe

Executes dropped EXE 1 IoCs

pid	Process
2800	setup.exe

Loads dropped DLL 5 IoCs

pid	Process
2260	JaffaCakes118_4caae72ac0b1d2a5180b007f8fd770c2.exe
2800	setup.exe
2800	setup.exe
2800	setup.exe
2920	svchost.exe

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/2260-4-0x0000000001000000-0x0000000001057000-memory.dmp	vmprotect
behavioral1/memory/2260-0-0x0000000001000000-0x0000000001057000-memory.dmp	vmprotect
behavioral1/memory/2260-17-0x0000000001000000-0x0000000001057000-memory.dmp	vmprotect
behavioral1/memory/2260-18-0x0000000001000000-0x0000000001057000-memory.dmp	vmprotect

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	JaffaCakes118_4caae72ac0b1d2a5180b007f8fd770c2.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	svchost.exe

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\ntsrservice.dll	setup.exe
File opened for modification	C:\Windows\SysWOW64\ntfastuserswitchingcompatibility.dll	setup.exe
File opened for modification	C:\Windows\SysWOW64\d2f5ca0e.del	setup.exe
File opened for modification	C:\Windows\SysWOW64\ntirmon.dll	setup.exe
File opened for modification	C:\Windows\SysWOW64\9b56e972.del	setup.exe
File opened for modification	C:\Windows\SysWOW64\ntnla.dll	setup.exe
File opened for modification	C:\Windows\SysWOW64\ntwmdmpmsp.dll	setup.exe
File opened for modification	C:\Windows\SysWOW64\a4363793.del	setup.exe
File opened for modification	C:\Windows\SysWOW64\ntias.dll	setup.exe
File opened for modification	C:\Windows\SysWOW64\4ef54a5d.del	setup.exe
File opened for modification	C:\Windows\SysWOW64\bda338ff.del	setup.exe
File opened for modification	C:\Windows\SysWOW64\4ac26bd1.del	setup.exe
File opened for modification	C:\Windows\SysWOW64\729d73e9.del	setup.exe
File opened for modification	C:\Windows\SysWOW64\ntpcaudit.dll	setup.exe
File opened for modification	C:\Windows\SysWOW64\ab5e7ac5.del	setup.exe
File opened for modification	C:\Windows\SysWOW64\nthelpsvc.dll	setup.exe
File opened for modification	C:\Windows\SysWOW64\ntntmssvc.dll	setup.exe
File opened for modification	C:\Windows\SysWOW64\35172304.del	setup.exe
File opened for modification	C:\Windows\SysWOW64\a8c20fb6.del	setup.exe
File opened for modification	C:\Windows\SysWOW64\ntlogonhours.dll	setup.exe
File opened for modification	C:\Windows\SysWOW64\b198415e.del	setup.exe
File opened for modification	C:\Windows\SysWOW64\81771310.del	setup.exe
File opened for modification	C:\Windows\SysWOW64\dad53dd.del	setup.exe
File opened for modification	C:\Windows\SysWOW64\ntnwcworkstation.dll	setup.exe
File opened for modification	C:\Windows\SysWOW64\ntwmi.dll	setup.exe
File opened for modification	C:\Windows\SysWOW64\ntuploadmgr.dll	setup.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_4caae72ac0b1d2a5180b007f8fd770c2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum\Version = "7"	svchost.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2800	setup.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeBackupPrivilege	2920	svchost.exe
Token: SeSecurityPrivilege	2920	svchost.exe
Token: SeSecurityPrivilege	2920	svchost.exe
Token: SeBackupPrivilege	2920	svchost.exe
Token: SeSecurityPrivilege	2920	svchost.exe
Token: SeBackupPrivilege	2920	svchost.exe
Token: SeSecurityPrivilege	2920	svchost.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 2800	2260	JaffaCakes118_4caae72ac0b1d2a5180b007f8fd770c2.exe	30
PID 2260 wrote to memory of 2800	2260	JaffaCakes118_4caae72ac0b1d2a5180b007f8fd770c2.exe	30
PID 2260 wrote to memory of 2800	2260	JaffaCakes118_4caae72ac0b1d2a5180b007f8fd770c2.exe	30
PID 2260 wrote to memory of 2800	2260	JaffaCakes118_4caae72ac0b1d2a5180b007f8fd770c2.exe	30
PID 2260 wrote to memory of 2800	2260	JaffaCakes118_4caae72ac0b1d2a5180b007f8fd770c2.exe	30
PID 2260 wrote to memory of 2800	2260	JaffaCakes118_4caae72ac0b1d2a5180b007f8fd770c2.exe	30
PID 2260 wrote to memory of 2800	2260	JaffaCakes118_4caae72ac0b1d2a5180b007f8fd770c2.exe	30

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4caae72ac0b1d2a5180b007f8fd770c2.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4caae72ac0b1d2a5180b007f8fd770c2.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setup.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\setup.exe
  2⤵
  - Server Software Component: Terminal Services DLL
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2800

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Server Software Component

1

T1505

Terminal Services DLL

1

T1505.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\SysWOW64\ntfastuserswitchingcompatibility.dll

Filesize
148KB

MD5
93c11972fd68942cbdf19e3ca1457329

SHA1
58e1bdb94d5b3fe602cd21abbc785e461a63c807

SHA256
f3d853f703039dc0f8384ac61cddfc1b477e2c5adcaf9b101e94b08dc352aa4b

SHA512
e56b05201783a2c3175ae7ad78c0a8c45cefea509189b708bb6ac337a17baa97e1ec0fca160fe5d555c3ed15a333f6f05200787d89b7b2499088272ae9c6c3d6

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\setup.exe

Filesize
175KB

MD5
8dbf1339e331381344e61628d4eb849c

SHA1
47ea8449f313dae8a07a27e2aba5224b4c86044b

SHA256
343b7c35986bc5841a4fd6eb0434f491a119325a26d90041ededd93dbba3be2a

SHA512
1c7be790882c6c80297dea471667f35c43e0a80e11e7381ef6089b1d3244c4ac9c8b162f55fd682ac5c5382319dfc0fde55062059e098efa9c4365ff9b017563

Download Submit
memory/2260-4-0x0000000001000000-0x0000000001057000-memory.dmp

Filesize
348KB

Download
memory/2260-0-0x0000000001000000-0x0000000001057000-memory.dmp

Filesize
348KB

Download
memory/2260-17-0x0000000001000000-0x0000000001057000-memory.dmp

Filesize
348KB

Download
memory/2260-18-0x0000000001000000-0x0000000001057000-memory.dmp

Filesize
348KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads