Analysis
-
max time kernel
148s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
05/03/2025, 07:32
General
-
Target
JaffaCakes118_51210ca6a630e9861f566af0209fb45f.exe
-
Size
96KB
-
MD5
51210ca6a630e9861f566af0209fb45f
-
SHA1
7db4bb1299dd15c9eea49b394102aa9e8232411c
-
SHA256
f059e8e88b0242263305e172331821bc051ac83e62af6c856c06ae9af11d6b39
-
SHA512
1a34631636d5eb6987f18651195cf81b5fce2ad9f5644a626865fac9003071d6abdde7f814570b348c108da532682cb85fb44fbc57a35e2891b65fa73f8fed05
-
SSDEEP
3072:9hS4jHS8q/3nTzePCwNUh4E9UFt63Q2/6:9c428q/nTzePCwG7UFo3y
Malware Config
Signatures
-
Gh0st RAT payload 4 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 6 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 18 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_51210ca6a630e9861f566af0209fb45f.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_51210ca6a630e9861f566af0209fb45f.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\htwlllvclv"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_51210ca6a630e9861f566af0209fb45f.exe" a -sc:\users\admin\appdata\local\temp\jaffacakes118_51210ca6a630e9861f566af0209fb45f.exe2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20.1MB
MD55a36ba874b4c16fa2dfbc4cbfb2d872b
SHA138d2acd35e3d86de376dcb8755349ab97891c9a4
SHA256b8f91ec056f5982fe370105268db974e0add1cb631ca29a2a33190b0d48c3ef6
SHA5124c4c85ab8186add1e13905ccff75a76548e8e6af5b71f04025207a8c7fae25daeb9405dce6276390c4fad8a3bb07dd30ff00b9fb68c894fe76415cd14f9a775b
-
Filesize
19.1MB
MD56df5bb3c5d21410f2db104fff6300d23
SHA197f7540a608326409f5e14b1ee939c2f08aa0477
SHA2563983644953b2872e3d2b121c4976505a84dcbb8d7bf6b9a08da42a5cf8912332
SHA51207ba4a2f4e074e61505fa753f4f951abb4cccf8d76c3e79c65835cac7274f56b4d4220aad30ae9626afa0ac17bb68fa5662d6df59a31fcb947d8c98ec242ba4a
-
Filesize
4KB
-
Filesize
312KB
-
Filesize
316KB
-
Filesize
312KB
-
Filesize
316KB
-
Filesize
312KB
-
Filesize
312KB
-
Filesize
4KB
-
Filesize
156KB
-
Filesize
156KB