Analysis
-
max time kernel
150s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
10/03/2025, 12:09
Behavioral task
behavioral1
Sample
JaffaCakes118_5f0ab3ec5ce851126ec030ec6a3bcc0f.dll
Resource
win7-20240729-en
windows7-x64
General
-
Target
JaffaCakes118_5f0ab3ec5ce851126ec030ec6a3bcc0f.dll
-
Size
64KB
-
MD5
5f0ab3ec5ce851126ec030ec6a3bcc0f
-
SHA1
215db1fa48f2dfd2f0581f3b6677d08e4bba82f6
-
SHA256
2080863d0df95d63f8a33fc362676f1b78634bdd4958a9431ef28ff8d5e4f2ed
-
SHA512
ef4921e30de1c0def53ffee8f66786736ede5bfdc66d4524b8b5447c3312c903d7b77184e0d731525fd6b73fc64abdcbc18a7aa5ddfc5eb538fd92689149e0e4
-
SSDEEP
1536:uTtLcWyeYd4//yEZc1GJf7/QP4uiryc5:uZTvnyEZiGJ7/Qguiryc5
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x000c000000023d21-3.dat family_gh0strat -
Gh0strat family
-
Loads dropped DLL 1 IoCs
pid Process 4004 svchost.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Ivqp\Lblgybhmw.jpg rundll32.exe File created C:\Program Files (x86)\Ivqp\Lblgybhmw.jpg rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe 4004 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 996 rundll32.exe Token: SeRestorePrivilege 996 rundll32.exe Token: SeBackupPrivilege 996 rundll32.exe Token: SeRestorePrivilege 996 rundll32.exe Token: SeBackupPrivilege 996 rundll32.exe Token: SeRestorePrivilege 996 rundll32.exe Token: SeBackupPrivilege 996 rundll32.exe Token: SeRestorePrivilege 996 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4932 wrote to memory of 996 4932 rundll32.exe 87 PID 4932 wrote to memory of 996 4932 rundll32.exe 87 PID 4932 wrote to memory of 996 4932 rundll32.exe 87
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5f0ab3ec5ce851126ec030ec6a3bcc0f.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5f0ab3ec5ce851126ec030ec6a3bcc0f.dll,#12⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:996
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4004
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10.7MB
MD593a10401982e0d98963f844a1e14f746
SHA14df0cdf6fa2ae22e6975bf4a3a45b142c623ad20
SHA256888d572bfffb36ec0a5b373f6bdab2156db22d39eefc73cb1e7bc78be58873c9
SHA512eebef8403dca78c7c06572bf8df9df80143466c5aa05da359341190c15d1394c19066b98831a9a6b0528bd83c199b205a621bf6a68dba36818babb42bdb96f63
