Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
10/03/2025, 21:14
Behavioral task
behavioral1
Sample
JaffaCakes118_6169bbec07747c68e83fc07157cdb880.dll
Resource
win7-20240903-en
windows7-x64
General
-
Target
JaffaCakes118_6169bbec07747c68e83fc07157cdb880.dll
-
Size
128KB
-
MD5
6169bbec07747c68e83fc07157cdb880
-
SHA1
ae8edd6d9bf2d2e10aac404ceb430ba57c068318
-
SHA256
92fb097990f5077726975b34fd010b1131798a6f73a2927f751a010c320d6887
-
SHA512
9d743a277142929236b63b51070adb5fc99a93ed6c647fa45aec310b62770787db81e5a350a066594b022c1a16d8f8c4ab52b64d7f9c6670806d8d18f7af9dc9
-
SSDEEP
3072:CwZSQpKa3VGVnpUlCz764/9xpEEBqbZuw65iGHeqovv:JJVGpxx9b3wZuw64GHeqo
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral2/files/0x0009000000022b29-3.dat family_gh0strat -
Gh0strat family
-
Loads dropped DLL 1 IoCs
pid Process 632 svchost.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\FileName.jpg rundll32.exe File opened for modification C:\Windows\FileName.jpg rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe 632 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 4764 rundll32.exe Token: SeRestorePrivilege 4764 rundll32.exe Token: SeBackupPrivilege 4764 rundll32.exe Token: SeRestorePrivilege 4764 rundll32.exe Token: SeBackupPrivilege 4764 rundll32.exe Token: SeRestorePrivilege 4764 rundll32.exe Token: SeBackupPrivilege 4764 rundll32.exe Token: SeRestorePrivilege 4764 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4944 wrote to memory of 4764 4944 rundll32.exe 89 PID 4944 wrote to memory of 4764 4944 rundll32.exe 89 PID 4944 wrote to memory of 4764 4944 rundll32.exe 89
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6169bbec07747c68e83fc07157cdb880.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6169bbec07747c68e83fc07157cdb880.dll,#12⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4764
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:632
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
558KB
MD544c7341bcb907448d83c01b6b5aff9cf
SHA1fef937eb1e919dfab6b039cdb369c3579d5395c8
SHA256f4cec5a90fb26ebc3bfbdbad340cb6f880af6c884767585b00a8809c362fab37
SHA51249f519c34afc496b914ec34237db900bd38ef5aecfecde2b044cd446a13e392bbdffc0a808e99d64e73e5d7886d916b438c8c950d72c4b40ec8665a31c8679c3
