Analysis
-
max time kernel
149s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
05/03/2025, 08:51
Behavioral task
behavioral1
Sample
JaffaCakes118_51655e64c32eb518a71cda583c8b6e1b.dll
Resource
win7-20241010-en
windows7-x64
General
-
Target
JaffaCakes118_51655e64c32eb518a71cda583c8b6e1b.dll
-
Size
2.4MB
-
MD5
51655e64c32eb518a71cda583c8b6e1b
-
SHA1
2ca4a8af7462f1f3af74cb853eb18174a6dcbf8f
-
SHA256
5edd0cabfc9f6edf79463845bd18a2f90baa1c14a35123c052d232418a4c5ce7
-
SHA512
aba5000aed0ec92a4d460af24337c9827e08da6f12d92a74d85758621cb2e6d0995b2985ad671005ab369bd9e22926b9ffb6d126a03abbf338539c68d2cf1199
-
SSDEEP
24576:+j8qQXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXv:4u
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x0010000000023bd5-3.dat family_gh0strat -
Gh0strat family
-
Loads dropped DLL 1 IoCs
pid Process 4892 svchost.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Xqhv\Arbxuwjso.bmp rundll32.exe File created C:\Program Files (x86)\Xqhv\Arbxuwjso.bmp rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe 4892 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 4496 rundll32.exe Token: SeRestorePrivilege 4496 rundll32.exe Token: SeBackupPrivilege 4496 rundll32.exe Token: SeRestorePrivilege 4496 rundll32.exe Token: SeBackupPrivilege 4496 rundll32.exe Token: SeRestorePrivilege 4496 rundll32.exe Token: SeBackupPrivilege 4496 rundll32.exe Token: SeRestorePrivilege 4496 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5064 wrote to memory of 4496 5064 rundll32.exe 86 PID 5064 wrote to memory of 4496 5064 rundll32.exe 86 PID 5064 wrote to memory of 4496 5064 rundll32.exe 86
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_51655e64c32eb518a71cda583c8b6e1b.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_51655e64c32eb518a71cda583c8b6e1b.dll,#12⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4496
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4892
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD55910e026d14b319b4e1a1bc57f8ccdc6
SHA15325579b98ce25b0b4a130f0b4e36756821932de
SHA2565da4824df512bf8655a05bc2b24ccbf4f0be391a5d274331cb895f41b244f98a
SHA512e8b196519830cae9b87f627ed3979c9d43ef9c0af774bff72ba9f8c95730856989c29e196cd576bbe2eec23c7b8dfdf550bbe8d3f830b02756c07f0c2d73e9ce
