Analysis
-
max time kernel
147s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20250207-en -
resource tags
-
submitted
04/03/2025, 16:23
General
-
Target
JaffaCakes118_4e68a2a9d5a9da39f109375c1aba46a1.exe
-
Size
94KB
-
MD5
4e68a2a9d5a9da39f109375c1aba46a1
-
SHA1
b21d23bad0cf6bf7a6670ddcbc2cfdf82d9cb9cf
-
SHA256
0ffcf362ba01ad54b1050a6524f8af5abbf509b070cea29e5cbcc2057a872453
-
SHA512
b236a97fcab45b3b353444870b3f2094ab9708475f01569e46c6db3f20c656946ead8c0ff076eab6c84f606ac2f8f864ff5d91fac10882fecb67d6d6d4c80218
-
SSDEEP
1536:f9/qFusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8prsTAIatN:f9/wS4jHS8q/3nTzePCwNUh4E9sK
Malware Config
Signatures
-
Gh0st RAT payload 4 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 6 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 18 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4e68a2a9d5a9da39f109375c1aba46a1.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4e68a2a9d5a9da39f109375c1aba46a1.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\htwlllvclv"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4e68a2a9d5a9da39f109375c1aba46a1.exe" a -sc:\users\admin\appdata\local\temp\jaffacakes118_4e68a2a9d5a9da39f109375c1aba46a1.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
22.1MB
MD5d0a91838cfe3bbebe164732f4b2a3279
SHA1b88b7f56d0936bf7fcaba6941d8a3949de3cf2bf
SHA2564ad6345a26062fa2baa2b7c463dd50d0c74d39d679ca81608d2e066b8d1619ed
SHA5120fa34c9c86d4f4ffc674729346d5d09f7933629715baa692bf72307e8301df2fc61a90ebebcdf67b7df10b2659559c10de62e6112c1b9c00a08ad53deede33b0
-
Filesize
19.1MB
MD5c70eab436bd9f05dd179e7f16a58386e
SHA14ec8611e5855117bce2a4b1277e6059a68cbf52a
SHA25665f87ced77fcb891c7303a9294c45597f7eb0aaa8ad36608cb1341381dd4f213
SHA51239c9116d5bd5da001ad044d174dead77bfc17855a8615c97681e2cc25ea5c728604e67933a2a64bcaf113708e21cd88f321d116cf902c5a2f4b3ca1fe1725967
-
Filesize
305KB
-
Filesize
305KB
-
Filesize
4KB
-
Filesize
305KB
-
Filesize
308KB
-
Filesize
4KB
-
Filesize
308KB
-
Filesize
305KB
-
Filesize
4KB
-
Filesize
156KB
-
Filesize
156KB