Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
05/03/2025, 08:51
Behavioral task
behavioral1
Sample
JaffaCakes118_51655e64c32eb518a71cda583c8b6e1b.dll
Resource
win7-20241010-en
windows7-x64
General
-
Target
JaffaCakes118_51655e64c32eb518a71cda583c8b6e1b.dll
-
Size
2.4MB
-
MD5
51655e64c32eb518a71cda583c8b6e1b
-
SHA1
2ca4a8af7462f1f3af74cb853eb18174a6dcbf8f
-
SHA256
5edd0cabfc9f6edf79463845bd18a2f90baa1c14a35123c052d232418a4c5ce7
-
SHA512
aba5000aed0ec92a4d460af24337c9827e08da6f12d92a74d85758621cb2e6d0995b2985ad671005ab369bd9e22926b9ffb6d126a03abbf338539c68d2cf1199
-
SSDEEP
24576:+j8qQXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXv:4u
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral1/files/0x000a000000019490-3.dat family_gh0strat -
Gh0strat family
-
Loads dropped DLL 1 IoCs
pid Process 684 svchost.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Xqhv\Arbxuwjso.bmp rundll32.exe File opened for modification C:\Program Files (x86)\Xqhv\Arbxuwjso.bmp rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe 684 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 768 rundll32.exe Token: SeRestorePrivilege 768 rundll32.exe Token: SeBackupPrivilege 768 rundll32.exe Token: SeRestorePrivilege 768 rundll32.exe Token: SeBackupPrivilege 768 rundll32.exe Token: SeRestorePrivilege 768 rundll32.exe Token: SeBackupPrivilege 768 rundll32.exe Token: SeRestorePrivilege 768 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2344 wrote to memory of 768 2344 rundll32.exe 31 PID 2344 wrote to memory of 768 2344 rundll32.exe 31 PID 2344 wrote to memory of 768 2344 rundll32.exe 31 PID 2344 wrote to memory of 768 2344 rundll32.exe 31 PID 2344 wrote to memory of 768 2344 rundll32.exe 31 PID 2344 wrote to memory of 768 2344 rundll32.exe 31 PID 2344 wrote to memory of 768 2344 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_51655e64c32eb518a71cda583c8b6e1b.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_51655e64c32eb518a71cda583c8b6e1b.dll,#12⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:768
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:684
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8.6MB
MD5cef57e95cf2dd16caf66874cd922b07f
SHA1bb06b20bd14212956a6155736c572fce6e75a9cd
SHA256b90c2f75bacadeae8e0c1f669a34f044614f2097357540413719b299aa68970a
SHA512eea8d58ad27e191a9e5055664bbd8b71063aba9388ff27787712084e0b854c799dd20c49d2185c601668d5d17dbd030e67258fb2bccfb59306b02b2d08ecce34
