Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/03/2025, 23:33
Behavioral task
behavioral1
Sample
JaffaCakes118_5411dc8e4fa9272475e8b8194dac47e0.dll
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
General
-
Target
JaffaCakes118_5411dc8e4fa9272475e8b8194dac47e0.dll
-
Size
118KB
-
MD5
5411dc8e4fa9272475e8b8194dac47e0
-
SHA1
a3663112fb35e4762f9b8de2a283371d29739271
-
SHA256
29b09edba9caed5ffbf66f8fb79e03680ece783b4c1f40f5ef16b882801ed550
-
SHA512
a1653325d5be7e60dd195f158876a496d54385af87f482b9b734b1b3cb35dca774be4bb9a1b00a4a869c4f5690cb1f39b80cd2b8945d6c1923037eec4492f367
-
SSDEEP
3072:eAsU4cQIuP1YTzA42M/we5jma/cSbyRNbyImZzOg63QR:KIa8AfMIem4QRkTzOhAR
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral1/files/0x000c00000001660e-3.dat family_gh0strat -
Gh0strat family
-
Loads dropped DLL 1 IoCs
pid Process 2408 svchost.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Cddag\Eubdqjaja.pic rundll32.exe File created C:\Program Files (x86)\Cddag\Eubdqjaja.pic rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe 2408 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 1968 rundll32.exe Token: SeRestorePrivilege 1968 rundll32.exe Token: SeBackupPrivilege 1968 rundll32.exe Token: SeRestorePrivilege 1968 rundll32.exe Token: SeBackupPrivilege 1968 rundll32.exe Token: SeRestorePrivilege 1968 rundll32.exe Token: SeBackupPrivilege 1968 rundll32.exe Token: SeRestorePrivilege 1968 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1912 wrote to memory of 1968 1912 rundll32.exe 28 PID 1912 wrote to memory of 1968 1912 rundll32.exe 28 PID 1912 wrote to memory of 1968 1912 rundll32.exe 28 PID 1912 wrote to memory of 1968 1912 rundll32.exe 28 PID 1912 wrote to memory of 1968 1912 rundll32.exe 28 PID 1912 wrote to memory of 1968 1912 rundll32.exe 28 PID 1912 wrote to memory of 1968 1912 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5411dc8e4fa9272475e8b8194dac47e0.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5411dc8e4fa9272475e8b8194dac47e0.dll,#12⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1968
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2408
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.9MB
MD501870ea79d8bc377fab70afe675894f5
SHA1d9c0ab6795e67b6e639e4fdfc0b290395d12d3e8
SHA2564c17de6ca791f420fdbfb154edefd7c6f229e62dec4e47911a6d3be1c05a1fd3
SHA512655948e7a97ab45a16eb4dc7d36560a9d271d3ccfe5f555deb9550df229931646756e69a0aee99ef0288973bcd143ffa793246123c0b9cfb61e9ecdb8cb6ceae