Analysis
-
max time kernel
150s -
max time network
22s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
10/03/2025, 12:09
Behavioral task
behavioral1
Sample
JaffaCakes118_5f0ab3ec5ce851126ec030ec6a3bcc0f.dll
Resource
win7-20240729-en
windows7-x64
9 signatures
150 seconds
General
-
Target
JaffaCakes118_5f0ab3ec5ce851126ec030ec6a3bcc0f.dll
-
Size
64KB
-
MD5
5f0ab3ec5ce851126ec030ec6a3bcc0f
-
SHA1
215db1fa48f2dfd2f0581f3b6677d08e4bba82f6
-
SHA256
2080863d0df95d63f8a33fc362676f1b78634bdd4958a9431ef28ff8d5e4f2ed
-
SHA512
ef4921e30de1c0def53ffee8f66786736ede5bfdc66d4524b8b5447c3312c903d7b77184e0d731525fd6b73fc64abdcbc18a7aa5ddfc5eb538fd92689149e0e4
-
SSDEEP
1536:uTtLcWyeYd4//yEZc1GJf7/QP4uiryc5:uZTvnyEZiGJ7/Qguiryc5
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral1/files/0x000c000000016e09-3.dat family_gh0strat -
Gh0strat family
-
Loads dropped DLL 1 IoCs
pid Process 2432 svchost.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Ivqp\Lblgybhmw.jpg rundll32.exe File created C:\Program Files (x86)\Ivqp\Lblgybhmw.jpg rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe 2432 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 2468 rundll32.exe Token: SeRestorePrivilege 2468 rundll32.exe Token: SeBackupPrivilege 2468 rundll32.exe Token: SeRestorePrivilege 2468 rundll32.exe Token: SeBackupPrivilege 2468 rundll32.exe Token: SeRestorePrivilege 2468 rundll32.exe Token: SeBackupPrivilege 2468 rundll32.exe Token: SeRestorePrivilege 2468 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 848 wrote to memory of 2468 848 rundll32.exe 28 PID 848 wrote to memory of 2468 848 rundll32.exe 28 PID 848 wrote to memory of 2468 848 rundll32.exe 28 PID 848 wrote to memory of 2468 848 rundll32.exe 28 PID 848 wrote to memory of 2468 848 rundll32.exe 28 PID 848 wrote to memory of 2468 848 rundll32.exe 28 PID 848 wrote to memory of 2468 848 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5f0ab3ec5ce851126ec030ec6a3bcc0f.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5f0ab3ec5ce851126ec030ec6a3bcc0f.dll,#12⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2468
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2432
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11.4MB
MD5d6ad015ea6ffa398c6b3c128f3404488
SHA1baf11cde4ab77f3618c0674c5349cf82736eb531
SHA2564879a0a3273889a19df68be9b4d9910c890e25bc4ce50bdba84f7aadd6e0e2a4
SHA5123c6c8b30f3a380bf475f5f0dd3cee6f0ac64387cb7e0f97dd5db78c5e69e1852ebc1d0852c9cefd2011c328f6ef5115603204200d2dc92fdc76c04b13294122b
