Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/03/2025, 06:35
Behavioral task
behavioral1
Sample
JaffaCakes118_55515dbd2fefd9edf404722ec33494a0.dll
Resource
win7-20240903-en
windows7-x64
8 signatures
150 seconds
General
-
Target
JaffaCakes118_55515dbd2fefd9edf404722ec33494a0.dll
-
Size
101KB
-
MD5
55515dbd2fefd9edf404722ec33494a0
-
SHA1
374c1648075b87542fc80d246b97373403871f4b
-
SHA256
590076d76a19053b2ac5c666b1c3a26752ce7a3101e8f4321f0d597ae509cd9a
-
SHA512
fe842862a0a481cdaa4cf1d93741228679e2be1383900d6ae2b17258e4e85a19e736497671a7cdc21f3d62b85685e1bb55afbf869139d38c401ca748a31eb286
-
SSDEEP
3072:CwZSQpKa3VGVnpUlCz764/9xpEEBqbZuwT5iG:JJVGpxx9b3wZuwT4G
Malware Config
Signatures
-
Gh0st RAT payload 2 IoCs
resource yara_rule behavioral1/files/0x000b000000012117-3.dat family_gh0strat behavioral1/memory/2788-4-0x0000000010000000-0x000000001001C000-memory.dmp family_gh0strat -
Gh0strat family
-
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\FileName.jpg rundll32.exe File created C:\Windows\FileName.jpg rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 2416 rundll32.exe Token: SeRestorePrivilege 2416 rundll32.exe Token: SeBackupPrivilege 2416 rundll32.exe Token: SeRestorePrivilege 2416 rundll32.exe Token: SeBackupPrivilege 2416 rundll32.exe Token: SeRestorePrivilege 2416 rundll32.exe Token: SeBackupPrivilege 2416 rundll32.exe Token: SeRestorePrivilege 2416 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3060 wrote to memory of 2416 3060 rundll32.exe 30 PID 3060 wrote to memory of 2416 3060 rundll32.exe 30 PID 3060 wrote to memory of 2416 3060 rundll32.exe 30 PID 3060 wrote to memory of 2416 3060 rundll32.exe 30 PID 3060 wrote to memory of 2416 3060 rundll32.exe 30 PID 3060 wrote to memory of 2416 3060 rundll32.exe 30 PID 3060 wrote to memory of 2416 3060 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_55515dbd2fefd9edf404722ec33494a0.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_55515dbd2fefd9edf404722ec33494a0.dll,#12⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2416
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2788
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8.7MB
MD55bea3f6745376d8f45ae613fe7542584
SHA1b9e969f9485f184245b66e3412c7eef266b3aca1
SHA2563140d784c0a5cb5a92e1abc2296627cc8c8cbf78b611e44c28afe0e3f22a54a9
SHA512789b072f0d6112d203d9fd4a97020caf4cc6a18e043730c460ad7ac6dae2be401f3d60ee3b4c22261913d4e3e874360d7e0e67bee92e24100dc2587a4fdeec5f
