Analysis
-
max time kernel
150s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
06/03/2025, 06:35
Behavioral task
behavioral1
Sample
JaffaCakes118_55515dbd2fefd9edf404722ec33494a0.dll
Resource
win7-20240903-en
windows7-x64
General
-
Target
JaffaCakes118_55515dbd2fefd9edf404722ec33494a0.dll
-
Size
101KB
-
MD5
55515dbd2fefd9edf404722ec33494a0
-
SHA1
374c1648075b87542fc80d246b97373403871f4b
-
SHA256
590076d76a19053b2ac5c666b1c3a26752ce7a3101e8f4321f0d597ae509cd9a
-
SHA512
fe842862a0a481cdaa4cf1d93741228679e2be1383900d6ae2b17258e4e85a19e736497671a7cdc21f3d62b85685e1bb55afbf869139d38c401ca748a31eb286
-
SSDEEP
3072:CwZSQpKa3VGVnpUlCz764/9xpEEBqbZuwT5iG:JJVGpxx9b3wZuwT4G
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x001d00000001ed6c-3.dat family_gh0strat -
Gh0strat family
-
Loads dropped DLL 1 IoCs
pid Process 2352 svchost.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\FileName.jpg rundll32.exe File created C:\Windows\FileName.jpg rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe 2352 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 2860 rundll32.exe Token: SeRestorePrivilege 2860 rundll32.exe Token: SeBackupPrivilege 2860 rundll32.exe Token: SeRestorePrivilege 2860 rundll32.exe Token: SeBackupPrivilege 2860 rundll32.exe Token: SeRestorePrivilege 2860 rundll32.exe Token: SeBackupPrivilege 2860 rundll32.exe Token: SeRestorePrivilege 2860 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2084 wrote to memory of 2860 2084 rundll32.exe 86 PID 2084 wrote to memory of 2860 2084 rundll32.exe 86 PID 2084 wrote to memory of 2860 2084 rundll32.exe 86
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_55515dbd2fefd9edf404722ec33494a0.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_55515dbd2fefd9edf404722ec33494a0.dll,#12⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2860
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2352
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11.0MB
MD5cce861867084c0e06cfbb39c85e7a886
SHA127305e3e459b607e08eb89a09c3d2549d654d449
SHA2564767db261d806f70acc443021ac1d477eec11083d7d8a92acda5bfb4ee4b4ebb
SHA51258097540d4022e75b262c5a0d42cf1f68fb2ff79521a2e328b38fba26b24d978e2ab89cc266e4aeeb990b238772a7ea842f6a8307629412e0a92ec637a56bcc1
