Analysis
-
max time kernel
70s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
05/03/2025, 01:55
General
-
Target
JaffaCakes118_4ff7fb51b1cff9b8ebacefce76033a30.exe
-
Size
137KB
-
MD5
4ff7fb51b1cff9b8ebacefce76033a30
-
SHA1
7fa91811ff8f5af97516dfb6a1ea61f607c04534
-
SHA256
b4ca4ce4db26316e737e322102531e502b257344528f6b68cf97b19d92f2f511
-
SHA512
deb63daef0f896675f903727f5c0273ae4452b6f4142cd4b4d8153f76a34ccda5ec71a799044c7e017f84430df1d9e4299ff73504baff4fc573b7d2ac655852b
-
SSDEEP
3072:WQhZkOLfuDg0PtOqzKONqsEykRLSDuoBy5AlBu2K2rtNtJAb0:EOFStZzKqqsE6JB3gr2rFp
Malware Config
Signatures
-
Gh0st RAT payload 4 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4ff7fb51b1cff9b8ebacefce76033a30.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_4ff7fb51b1cff9b8ebacefce76033a30.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4804 -s 6042⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4804 -ip 48041⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
236KB
-
Filesize
236KB