Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
09/03/2025, 16:46
Behavioral task
behavioral1
Sample
JaffaCakes118_5a330471173f0889219d981352d551f0.dll
Resource
win7-20241010-en
windows7-x64
General
-
Target
JaffaCakes118_5a330471173f0889219d981352d551f0.dll
-
Size
101KB
-
MD5
5a330471173f0889219d981352d551f0
-
SHA1
629452e5bf31c9ad4c8d15e97d98f452a4fdb9ba
-
SHA256
c8954ee4dbc93e7b788605b2ee19eae2056c5d694b785065578f182f4c2d0432
-
SHA512
10a07f923098a1a9a3e11c54f5d9d9d96fe79dfb0ef8bc64b2c856fc5eb2f4e8644cfb28a0f0221e8ff5d570da023cd0669ab61e1770005193c566a88670e859
-
SSDEEP
3072:CwZSQpKa3VGVnpUlCz764/9xpEEBqbZuwr5iG:JJVGpxx9b3wZuwr4G
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x0010000000023b8c-3.dat family_gh0strat -
Gh0strat family
-
Loads dropped DLL 1 IoCs
pid Process 1528 svchost.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\FileName.jpg rundll32.exe File created C:\Windows\FileName.jpg rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 3708 rundll32.exe Token: SeRestorePrivilege 3708 rundll32.exe Token: SeBackupPrivilege 3708 rundll32.exe Token: SeRestorePrivilege 3708 rundll32.exe Token: SeBackupPrivilege 3708 rundll32.exe Token: SeRestorePrivilege 3708 rundll32.exe Token: SeBackupPrivilege 3708 rundll32.exe Token: SeRestorePrivilege 3708 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1480 wrote to memory of 3708 1480 rundll32.exe 85 PID 1480 wrote to memory of 3708 1480 rundll32.exe 85 PID 1480 wrote to memory of 3708 1480 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5a330471173f0889219d981352d551f0.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5a330471173f0889219d981352d551f0.dll,#12⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3708
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1528
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.8MB
MD5caa18ab9d522e3a681086865b7cc7998
SHA1971e6586602808558e968fd98bbaafb39a17fca4
SHA2561e75608bc2d03ee880afd4d3d0c17371462de1c61478291bc813868e6b7085ad
SHA512efb4a3359d35ff5db7f71a613100327716b169453d95379ea12d00cd0b37b2eb4305557ff19c55d2756568fa06290e3fe2241a17b57c681de457023cc3c14de3
