Analysis
-
max time kernel
150s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
10/03/2025, 21:14
Behavioral task
behavioral1
Sample
JaffaCakes118_6169bbec07747c68e83fc07157cdb880.dll
Resource
win7-20240903-en
windows7-x64
General
-
Target
JaffaCakes118_6169bbec07747c68e83fc07157cdb880.dll
-
Size
128KB
-
MD5
6169bbec07747c68e83fc07157cdb880
-
SHA1
ae8edd6d9bf2d2e10aac404ceb430ba57c068318
-
SHA256
92fb097990f5077726975b34fd010b1131798a6f73a2927f751a010c320d6887
-
SHA512
9d743a277142929236b63b51070adb5fc99a93ed6c647fa45aec310b62770787db81e5a350a066594b022c1a16d8f8c4ab52b64d7f9c6670806d8d18f7af9dc9
-
SSDEEP
3072:CwZSQpKa3VGVnpUlCz764/9xpEEBqbZuw65iGHeqovv:JJVGpxx9b3wZuw64GHeqo
Malware Config
Signatures
-
Gh0st RAT payload 2 IoCs
resource yara_rule behavioral1/files/0x000f000000012259-3.dat family_gh0strat behavioral1/memory/2788-4-0x0000000010000000-0x000000001001C000-memory.dmp family_gh0strat -
Gh0strat family
-
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\FileName.jpg rundll32.exe File created C:\Windows\FileName.jpg rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe 2788 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 2660 rundll32.exe Token: SeRestorePrivilege 2660 rundll32.exe Token: SeBackupPrivilege 2660 rundll32.exe Token: SeRestorePrivilege 2660 rundll32.exe Token: SeBackupPrivilege 2660 rundll32.exe Token: SeRestorePrivilege 2660 rundll32.exe Token: SeBackupPrivilege 2660 rundll32.exe Token: SeRestorePrivilege 2660 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1508 wrote to memory of 2660 1508 rundll32.exe 31 PID 1508 wrote to memory of 2660 1508 rundll32.exe 31 PID 1508 wrote to memory of 2660 1508 rundll32.exe 31 PID 1508 wrote to memory of 2660 1508 rundll32.exe 31 PID 1508 wrote to memory of 2660 1508 rundll32.exe 31 PID 1508 wrote to memory of 2660 1508 rundll32.exe 31 PID 1508 wrote to memory of 2660 1508 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6169bbec07747c68e83fc07157cdb880.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6169bbec07747c68e83fc07157cdb880.dll,#12⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2660
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2788
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11.0MB
MD5b37ce1a4af04ac451b5c54c21d83d5d9
SHA14ddb8a2a706196c6494d000797bfbba6156019c2
SHA2563b6fa66dc6529d861d6ccd709618e272f0358c88547cca697146e87c9c5532e2
SHA512f4f699dcd825c2793c5532b1163b30910a138462d293c81209013c9be9759a20d29d9ac2c498b074117d5bee1981a367b7b1f2deee24bb60c17b920ae211dec0
