Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
10/03/2025, 03:54
Behavioral task
behavioral1
Sample
JaffaCakes118_5ce96d2f8ff56e862e24cdfdf4bc3d3e.dll
Resource
win7-20250207-en
windows7-x64
General
-
Target
JaffaCakes118_5ce96d2f8ff56e862e24cdfdf4bc3d3e.dll
-
Size
7.0MB
-
MD5
5ce96d2f8ff56e862e24cdfdf4bc3d3e
-
SHA1
c9f29508c669f287429922a3a421031f7c9cd148
-
SHA256
1e9da4f7031eb141544823bd1b480a7118591982be8c6f13102631b3d647f3c2
-
SHA512
12c7cd3b109f81788ae370d3c779891524e173e90a33d9d554294af852bff2142c9f968792ff2c2af4900a2bf57624f89b0359479c2e57c2f4d7afa281a54d87
-
SSDEEP
6144:Wb77x12yoyJE3333333333333333333333333333333333333333333333333339:WbR1i
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x000c000000023c88-3.dat family_gh0strat -
Gh0strat family
-
Loads dropped DLL 1 IoCs
pid Process 1856 svchost.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Bwxy\Gwxyabcde.gif rundll32.exe File created C:\Program Files (x86)\Bwxy\Gwxyabcde.gif rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe 1856 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 868 rundll32.exe Token: SeRestorePrivilege 868 rundll32.exe Token: SeBackupPrivilege 868 rundll32.exe Token: SeRestorePrivilege 868 rundll32.exe Token: SeBackupPrivilege 868 rundll32.exe Token: SeRestorePrivilege 868 rundll32.exe Token: SeBackupPrivilege 868 rundll32.exe Token: SeRestorePrivilege 868 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1984 wrote to memory of 868 1984 rundll32.exe 87 PID 1984 wrote to memory of 868 1984 rundll32.exe 87 PID 1984 wrote to memory of 868 1984 rundll32.exe 87
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5ce96d2f8ff56e862e24cdfdf4bc3d3e.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5ce96d2f8ff56e862e24cdfdf4bc3d3e.dll,#12⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:868
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1856
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20.8MB
MD5b8cbeaa70b21606a225629566f66de7f
SHA11f0ac111c14317b25900f57c7fc04a8254dd533c
SHA256c04078d8bd4c9afbb3b8939af2eff2bffe44f00784d361c5d03a5cd6740c58a1
SHA5127252696f3ad7f17476dd8c9a3024b47ae8c496de68ed03e8e852d8cf9c23df9fdadbe41a79628cb6dae81c098f0d9f4cb458f8fb90367faf174ba29b7677614b
