Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
05/03/2025, 23:33
Behavioral task
behavioral1
Sample
JaffaCakes118_5411dc8e4fa9272475e8b8194dac47e0.dll
Resource
win7-20240903-en
windows7-x64
General
-
Target
JaffaCakes118_5411dc8e4fa9272475e8b8194dac47e0.dll
-
Size
118KB
-
MD5
5411dc8e4fa9272475e8b8194dac47e0
-
SHA1
a3663112fb35e4762f9b8de2a283371d29739271
-
SHA256
29b09edba9caed5ffbf66f8fb79e03680ece783b4c1f40f5ef16b882801ed550
-
SHA512
a1653325d5be7e60dd195f158876a496d54385af87f482b9b734b1b3cb35dca774be4bb9a1b00a4a869c4f5690cb1f39b80cd2b8945d6c1923037eec4492f367
-
SSDEEP
3072:eAsU4cQIuP1YTzA42M/we5jma/cSbyRNbyImZzOg63QR:KIa8AfMIem4QRkTzOhAR
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x0010000000023c7c-3.dat family_gh0strat -
Gh0strat family
-
Loads dropped DLL 1 IoCs
pid Process 4888 svchost.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Cddag\Eubdqjaja.pic rundll32.exe File created C:\Program Files (x86)\Cddag\Eubdqjaja.pic rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe 4888 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 4768 rundll32.exe Token: SeRestorePrivilege 4768 rundll32.exe Token: SeBackupPrivilege 4768 rundll32.exe Token: SeRestorePrivilege 4768 rundll32.exe Token: SeBackupPrivilege 4768 rundll32.exe Token: SeRestorePrivilege 4768 rundll32.exe Token: SeBackupPrivilege 4768 rundll32.exe Token: SeRestorePrivilege 4768 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4392 wrote to memory of 4768 4392 rundll32.exe 84 PID 4392 wrote to memory of 4768 4392 rundll32.exe 84 PID 4392 wrote to memory of 4768 4392 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5411dc8e4fa9272475e8b8194dac47e0.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5411dc8e4fa9272475e8b8194dac47e0.dll,#12⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4768
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4888
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11.4MB
MD55ba4adabf6d7a69459cd4e16c2b0b051
SHA1718c71169aabf75471ee0835a1ae38be976983cc
SHA25689e2da6257ba347113822899bfd93015e270adc617804252f860075bb1ccfabc
SHA5121a4fce4a0a82f694368a3459d420dd9c525fa86e88d1060ec15c4c9293301925b8e1c84c10caf8ed85e09dc29917fdc7d2350051010024f7f790b252a442ddc3