Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
06/03/2025, 01:47
Behavioral task
behavioral1
Sample
JaffaCakes118_5475e980653cb3e3f42f71af88540d0a.dll
Resource
win7-20240729-en
windows7-x64
General
-
Target
JaffaCakes118_5475e980653cb3e3f42f71af88540d0a.dll
-
Size
112KB
-
MD5
5475e980653cb3e3f42f71af88540d0a
-
SHA1
c9426de2ff527625b4610fcbe676f78212548361
-
SHA256
10ddd44fcafa956b4782baba24c0152d0c98124fdf24c25fe2799fd330a29c62
-
SHA512
5ae3813de63718802882386661bfac5be7d6aa98c80c37078b7d11cb05c259052f82c67c13ee431cd3e388500fdf66d5d98c3b7363217cfa11dc9f0cee2e81ca
-
SSDEEP
3072:9NGB+I0Oy8uIqn9N4rKttHkoIIuZkfiXqCYN:9Qpu8Hqb4wKodkkqXBm
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x000e000000023c39-3.dat family_gh0strat -
Gh0strat family
-
Loads dropped DLL 1 IoCs
pid Process 1200 svchost.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Lhij\Qhijklmno.bmp rundll32.exe File created C:\Program Files (x86)\Lhij\Qhijklmno.bmp rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe 1200 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 2760 rundll32.exe Token: SeRestorePrivilege 2760 rundll32.exe Token: SeBackupPrivilege 2760 rundll32.exe Token: SeRestorePrivilege 2760 rundll32.exe Token: SeBackupPrivilege 2760 rundll32.exe Token: SeRestorePrivilege 2760 rundll32.exe Token: SeBackupPrivilege 2760 rundll32.exe Token: SeRestorePrivilege 2760 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4784 wrote to memory of 2760 4784 rundll32.exe 87 PID 4784 wrote to memory of 2760 4784 rundll32.exe 87 PID 4784 wrote to memory of 2760 4784 rundll32.exe 87
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5475e980653cb3e3f42f71af88540d0a.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5475e980653cb3e3f42f71af88540d0a.dll,#12⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2760
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1200
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8.6MB
MD50d5ed40ef9e0f6adc7b1c751635ad0c4
SHA105b675e11fb4f9721b4423f4f49c0e3af77ec022
SHA256d94fd130da8679ae1826fea58fa1fe8459d4b4296ec72b0292d6b831c7daa45c
SHA512cd525318857d680a6fa6f5647ecda5d8b3f0431f10aa6581118d27aed4b215d4211990bb19fe35215745fb2ec295fbbad26db5965bf75b632e8a3a13f9537edb
