Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
10/03/2025, 17:55
General
-
Target
JaffaCakes118_6094f5dcadc9e0131ef88e136857e8b4.exe
-
Size
94KB
-
MD5
6094f5dcadc9e0131ef88e136857e8b4
-
SHA1
b488ceb6bbf0ec3eb9eac179aba1860ed619dfe8
-
SHA256
52b931c8114b0190c0789eea3eb6714e3faf86a80f1ee295dd958a70ce7f4da2
-
SHA512
15626b4291490a0e8109ac8fc3457844d8129ff5b8d92afcb6605e612c881b4f5bf1af2c7ca9e6ceb488d3686630f39f440e574df22a2bce1e66e96c3cf7c01c
-
SSDEEP
1536:pnJFusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8prGwdn+:pnfS4jHS8q/3nTzePCwNUh4E9G8+
Malware Config
Signatures
-
Gh0st RAT payload 4 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 3 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 6 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 18 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6094f5dcadc9e0131ef88e136857e8b4.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6094f5dcadc9e0131ef88e136857e8b4.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\fsfdkygutl"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6094f5dcadc9e0131ef88e136857e8b4.exe" a -sc:\users\admin\appdata\local\temp\jaffacakes118_6094f5dcadc9e0131ef88e136857e8b4.exe2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20.0MB
MD5046dfc3969a482b4047022ea57a4519c
SHA13ed13c91f028d48a7e00776512a8834da15d4fff
SHA256d0be37e65084b20a4267ef0ff53239dfb5bac1c326f57bd2ba22c0a23c7c9c3f
SHA51200129308423d92b1d7a4cfc1dc77eed2c7e8c8f30462552535a826962159b119905bc919b7b70ae33ec9fef2bf0ef89a4262dd19303d18adb6868780d3936388
-
Filesize
19.7MB
MD51501b963af603ea74ff828df3b14d5b2
SHA1969981f7c926519ff5a4fc66bdcc316960171bad
SHA2568d92dd0476072155f4cab84cc46e6d6308d960651103c01b80f70df7a92cdb46
SHA5123861222c4e8f6f2aae4318ed865fa8e262e64d64ec020357f5fd5038b0c8ee95f3e98e5146749d8ce0f589c0fac76c4c644bda837d496a2574ada3c9fe45f2e4
-
Filesize
4KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
305KB
-
Filesize
305KB
-
Filesize
4KB
-
Filesize
156KB
-
Filesize
156KB
-
Filesize
305KB
-
Filesize
305KB
-
Filesize
4KB