Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04/03/2025, 12:05
Behavioral task
behavioral1
Sample
JaffaCakes118_4d3e56221f100e855d5d7f06933a7ce0.dll
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
General
-
Target
JaffaCakes118_4d3e56221f100e855d5d7f06933a7ce0.dll
-
Size
124KB
-
MD5
4d3e56221f100e855d5d7f06933a7ce0
-
SHA1
bf3876974c2ca55f69520be5e4c63694272524e6
-
SHA256
6c83012626a72ebf6197dd2e4a14b1419a956b4269e0b01a9786d9ca3a46749c
-
SHA512
06b29bf78f346460641887da412dc3ac6694c82ea22e0bdaaf91634d944435c8297466a9a9bb94ba86590c1258357be99b2a4d136349c819c2c277d003f85885
-
SSDEEP
3072:Bzk9z4Uh+yQAbAbu9NWtMpebimeN7kgMwDi/:uDTQAbNMbxg7kVwD
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral1/files/0x000e000000012033-3.dat family_gh0strat -
Gh0strat family
-
Loads dropped DLL 1 IoCs
pid Process 2060 svchost.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\llssrv.jpg rundll32.exe File opened for modification C:\Program Files (x86)\Common Files\llssrv.jpg rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe 2060 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 2504 rundll32.exe Token: SeRestorePrivilege 2504 rundll32.exe Token: SeBackupPrivilege 2504 rundll32.exe Token: SeRestorePrivilege 2504 rundll32.exe Token: SeBackupPrivilege 2504 rundll32.exe Token: SeRestorePrivilege 2504 rundll32.exe Token: SeBackupPrivilege 2504 rundll32.exe Token: SeRestorePrivilege 2504 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2328 wrote to memory of 2504 2328 rundll32.exe 30 PID 2328 wrote to memory of 2504 2328 rundll32.exe 30 PID 2328 wrote to memory of 2504 2328 rundll32.exe 30 PID 2328 wrote to memory of 2504 2328 rundll32.exe 30 PID 2328 wrote to memory of 2504 2328 rundll32.exe 30 PID 2328 wrote to memory of 2504 2328 rundll32.exe 30 PID 2328 wrote to memory of 2504 2328 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4d3e56221f100e855d5d7f06933a7ce0.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4d3e56221f100e855d5d7f06933a7ce0.dll,#12⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2504
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2060
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD54cbf0d4b77a3a1b2fe4eca6072a9c3cc
SHA1aab4d05c26d4b6f7d5b8b26374570ba3b11a9622
SHA25665e44627466a63462118a7d8d5406dc2aef23018ed93b8f7ebb61747dfe7abbb
SHA5126b08f26d705882b135cef6f5674c6eaa894732217330efd713314e64e1a37ea30a5e67b925b973bf7e37feb498404b902b6aea65570ab4297b3158626ede5e35
