Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
06/03/2025, 08:54
General
-
Target
JaffaCakes118_55b98489c397583c041c21f1dce0ec50.exe
-
Size
68KB
-
MD5
55b98489c397583c041c21f1dce0ec50
-
SHA1
b080b820a2ab7d678acfcf8b44529a998398f50b
-
SHA256
6890408c9b2951a708daf57e5cad76ff405981cb0080c5b3345297fdcadf3247
-
SHA512
a4dbf418ef8bfdb85d9e54ad5e8a62e6d282238a3cbeea42c3494d4c7c396b5968956f137eec2f04d4a1c7432ac512a3293d535a34cae5280702b8202f233030
-
SSDEEP
1536:X2NjIKUcbdPm4A/TQBjv9v9SuxtnOCiOYG1Q5:X4cKUOPm4oKjv19SuzOPOY4E
Malware Config
Signatures
-
Gh0st RAT payload 3 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
Drops file in Drivers directory 1 IoCs
-
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
-
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
-
Deletes itself 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Modifies system executable filetype association 2 TTPs 1 IoCs
-
Drops file in System32 directory 3 IoCs
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_55b98489c397583c041c21f1dce0ec50.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_55b98489c397583c041c21f1dce0ec50.exe"1⤵
- Server Software Component: Terminal Services DLL
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s FastUserSwitchingCompatibility1⤵
- Drops file in Drivers directory
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
47KB
MD572b0a1fdfa152ba760bafb6b8623780d
SHA1cf9420091ee7414dc43833cd0780e8595493bf6c
SHA2563329938a048d0347dd2a6007936d873ba766e4b62370e43955b045e7fa17d175
SHA51242fc75b6b9343c21a1ddcbf7612f732025f8a78f889d77cb9b78e8e15315594ddc3e3bf653eb68d46e582bbd44c100415a5c1f9a118fdbbe1ab47edd3966f6c6
-
Filesize
47KB
MD549bc3034b534f0c2ebbf90eb92b88be2
SHA1c002b0c68c9d7c7b3a1e5b5ce004223ddf548a48
SHA25665c9d54b4a3b2a2e24cf6743f7e5b2c9063eba406ffd64224c0ff658b1799641
SHA512b2fb5a8f2c2804722aef32fd099649db53419abb6e922a29f5614943dcbea1d6ef649898718019080462db61aee800175bdb5f0bb3d70846d51d5a68d7d54b7a
-
Filesize
160KB
-
Filesize
4KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
160KB
-
Filesize
132KB
-
Filesize
132KB
-
Filesize
132KB