Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
05/03/2025, 16:38
Behavioral task
behavioral1
Sample
JaffaCakes118_52d229c8266359536039c284eab3f5f7.dll
Resource
win7-20241010-en
windows7-x64
General
-
Target
JaffaCakes118_52d229c8266359536039c284eab3f5f7.dll
-
Size
101KB
-
MD5
52d229c8266359536039c284eab3f5f7
-
SHA1
cff01abb6be05942915c37cbfc01b3c16e3d0641
-
SHA256
9fc16d9513f70fd9341927442e151583c0d95b6866203e684ce3c9e8114fa934
-
SHA512
a83768e27e2e37354a6956bf3dfed494e5a82636234f99c73910e995500ac4fa312afa43554fb6d0022faf332b73737689ee8b926a25cdaa463640ddbe7463c8
-
SSDEEP
3072:CwZSQpKa3VGVnpUlCz764/9xpEEBqbZuwe5iG:JJVGpxx9b3wZuwe4G
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x000f000000023c6a-3.dat family_gh0strat -
Gh0strat family
-
Loads dropped DLL 1 IoCs
pid Process 4852 svchost.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Vjwm\Gvwynhrbp.gif rundll32.exe File created C:\Program Files (x86)\Vjwm\Gvwynhrbp.gif rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe 4852 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 3820 rundll32.exe Token: SeRestorePrivilege 3820 rundll32.exe Token: SeBackupPrivilege 3820 rundll32.exe Token: SeRestorePrivilege 3820 rundll32.exe Token: SeBackupPrivilege 3820 rundll32.exe Token: SeRestorePrivilege 3820 rundll32.exe Token: SeBackupPrivilege 3820 rundll32.exe Token: SeRestorePrivilege 3820 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 436 wrote to memory of 3820 436 rundll32.exe 84 PID 436 wrote to memory of 3820 436 rundll32.exe 84 PID 436 wrote to memory of 3820 436 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_52d229c8266359536039c284eab3f5f7.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_52d229c8266359536039c284eab3f5f7.dll,#12⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3820
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4852
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
18.0MB
MD543243e2cb21cbffbc1a5e96e239e1f93
SHA1a87162ea04744248135e076f6aaa09814c84fad0
SHA256d4f017317d85ab2564dde88c1b87195ea1133de72ae3f07f83e1a652b3f13170
SHA51272db92aad03fe64e0b9c9f3bf69bad7dde87b3f53f623bfbdb4de14ff120b0c1b919ba31f36992891ffe6a8d4cd6152278801aa6b49e4e19370fa9d072b06faa
