Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
06/03/2025, 01:47
Behavioral task
behavioral1
Sample
JaffaCakes118_5475e980653cb3e3f42f71af88540d0a.dll
Resource
win7-20240729-en
windows7-x64
9 signatures
150 seconds
General
-
Target
JaffaCakes118_5475e980653cb3e3f42f71af88540d0a.dll
-
Size
112KB
-
MD5
5475e980653cb3e3f42f71af88540d0a
-
SHA1
c9426de2ff527625b4610fcbe676f78212548361
-
SHA256
10ddd44fcafa956b4782baba24c0152d0c98124fdf24c25fe2799fd330a29c62
-
SHA512
5ae3813de63718802882386661bfac5be7d6aa98c80c37078b7d11cb05c259052f82c67c13ee431cd3e388500fdf66d5d98c3b7363217cfa11dc9f0cee2e81ca
-
SSDEEP
3072:9NGB+I0Oy8uIqn9N4rKttHkoIIuZkfiXqCYN:9Qpu8Hqb4wKodkkqXBm
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral1/files/0x000b000000016d29-3.dat family_gh0strat -
Gh0strat family
-
Loads dropped DLL 1 IoCs
pid Process 2828 svchost.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Lhij\Qhijklmno.bmp rundll32.exe File created C:\Program Files (x86)\Lhij\Qhijklmno.bmp rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 2748 rundll32.exe Token: SeRestorePrivilege 2748 rundll32.exe Token: SeBackupPrivilege 2748 rundll32.exe Token: SeRestorePrivilege 2748 rundll32.exe Token: SeBackupPrivilege 2748 rundll32.exe Token: SeRestorePrivilege 2748 rundll32.exe Token: SeBackupPrivilege 2748 rundll32.exe Token: SeRestorePrivilege 2748 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2668 wrote to memory of 2748 2668 rundll32.exe 31 PID 2668 wrote to memory of 2748 2668 rundll32.exe 31 PID 2668 wrote to memory of 2748 2668 rundll32.exe 31 PID 2668 wrote to memory of 2748 2668 rundll32.exe 31 PID 2668 wrote to memory of 2748 2668 rundll32.exe 31 PID 2668 wrote to memory of 2748 2668 rundll32.exe 31 PID 2668 wrote to memory of 2748 2668 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5475e980653cb3e3f42f71af88540d0a.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5475e980653cb3e3f42f71af88540d0a.dll,#12⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2748
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2828
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13.6MB
MD5dbf6b013aab4fc322fa72bbf6cd6c2a3
SHA1b56965b78a99416de06d99a8cbb0142c52fba8c9
SHA2568f37650c805aedc544f456cbde49f27fe1e2f43f8e433c2336cf5f56ba63ff41
SHA5121ca11aa7cbae44cfeb0786eacbd3531906943649ad15c853790703d9d085ac122a21d82d352f3d1b585eed159e5a2264f2dbbcf8cbf621ddfe81f8572104d6b7
