Analysis
-
max time kernel
94s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
05/03/2025, 20:48
General
-
Target
JaffaCakes118_5392164e0cb5045847c4ee9cff4813f6.exe
-
Size
5.0MB
-
MD5
5392164e0cb5045847c4ee9cff4813f6
-
SHA1
20f55805079a0c35ce493589335fce990c8e708a
-
SHA256
bea5b55cdef955ac7b8a9fead52ddc7f659fa3470c470fd36e769d1b57c5234e
-
SHA512
82f0cf0a85ec7164dbcd442c33e969186e8ddb179707b053fb0ac91f09891bd2196f9e8499cd3ab903a3262f7f334a82916b150b18dab29c84c7d04fd6c4987a
-
SSDEEP
49152:smv3GY5fa22GFbn0iDenAPpv//e2zzoM/IFnLA5:s0W2SLGFD0i0UPe2N/YLA5
Malware Config
Signatures
-
Gh0st RAT payload 6 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL 3 IoCs
-
Drops file in System32 directory 6 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Program crash 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 46 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5392164e0cb5045847c4ee9cff4813f6.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5392164e0cb5045847c4ee9cff4813f6.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\hvmqnjpved"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5392164e0cb5045847c4ee9cff4813f6.exe" a -sc:\users\admin\appdata\local\temp\jaffacakes118_5392164e0cb5045847c4ee9cff4813f6.exe2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Deletes itself
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 10402⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4952 -ip 49521⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 11082⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2944 -ip 29441⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s fastuserswitchingcompatibility1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 608 -s 9402⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 608 -ip 6081⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
22.2MB
MD5f0342f77c8ca8f3e17aadd10045dff9d
SHA16c753bb90fdb77e8283ed4e0fb1a147b97482943
SHA25659c5881cd81999aa6dbf6054fed9a1779a1c61f4558d33e034a981c2e701b48f
SHA512b3664f268a9f1f820cfaf9e3e2054f3546bd920df20ab720476cb0722fa350763d5b0e8b73682b34a9fe5773317f47b6abbc4de052b15a7e2b75e6490f166b2e
-
Filesize
202B
MD5b075d66693df9ded937399c6e83fa23f
SHA1c4eaf9d7129ea036217a988d80de56905fa720b3
SHA256e9084b9e9d2951266158b55157bc2ccc1fa6c55822bf22e712e52916b027d516
SHA51272024fec381a60eee13ba668a3d23fcf71eb830eba43371ad31da1b8cfc6196c1c0d03edd3e18910eb5bd7b6ce6612b58b7e599a14a0e0ce6de290d60ef31140
-
Filesize
303B
MD51fdd5027a41f1e287fae8bca6bbd3168
SHA1312f014c0d273a6f6d8ba44d69f2362b30f27c50
SHA256df005033ac746ab38b62e94099a040964f28daa2f1a267045ee72c1bda588e66
SHA512201ddf1c0a19929ff222581cd1993f2a8a13074ffd749e2aec4e4c35cd192a5686ac465838be287c739e0294765e2fbd5b6d25a8a46021bea4df079b3f9ae498
-
Filesize
24.0MB
MD5554547394eaf529cad721c7a43e6bb5e
SHA12fc9b5651a9c122581e9b8e0e8dc1eda8f2d1a91
SHA256dc40bc5aa88d4e2a43abecadc208bd46e827c89beff529dac7a9681a0dccb925
SHA5122d6d8e7ea1c2a8493749ce5083c458ce2753f1ce998075a2bc76ffaace433901efb3f23924ad2b7250955e41ed5120632755116253672eaadde063b252f80212
-
Filesize
156KB
-
Filesize
4KB
-
Filesize
156KB
-
Filesize
4KB
-
Filesize
5.5MB
-
Filesize
5.5MB
-
Filesize
5.5MB
-
Filesize
5.5MB
-
Filesize
5.5MB
-
Filesize
5.5MB
-
Filesize
5.5MB
-
Filesize
5.5MB
-
Filesize
5.5MB
-
Filesize
5.5MB
-
Filesize
5.5MB
-
Filesize
96KB
-
Filesize
4KB
-
Filesize
5.5MB
-
Filesize
5.5MB
-
Filesize
5.5MB
-
Filesize
5.5MB
-
Filesize
5.5MB
-
Filesize
4KB
-
Filesize
5.5MB
-
Filesize
96KB
-
Filesize
8KB
-
Filesize
1.4MB
-
Filesize
156KB
-
Filesize
4KB