Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
05/04/2025, 12:22
General
-
Target
JaffaCakes118_9a8dbfb535152524e07fe247f7ef02dc.dll
-
Size
109KB
-
MD5
9a8dbfb535152524e07fe247f7ef02dc
-
SHA1
75e9adc7505e6956801c9d70778e0b2bcedbe549
-
SHA256
3b95a8e695bd98d3d621b4d99773a32945005b7800c2156547b21c65f3a7f957
-
SHA512
d73f32939f6e9ff2dd23d791d86a2b9d2ddc2b3e0d42fee9fd7c7f115ed7d70bdf64e6f5ec2afceb7fdbebab3d6f7e4aa17159f80bcfacbd0dcbf5687638efb0
-
SSDEEP
3072:xVvh8Q3aHS4ktdH5lfZbh0tt2/Y4xeIKhYOZLwA56c:RayjdZ1ZbWi/vxrK7ZLw0
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral1/files/0x000c00000002423d-3.dat family_gh0strat -
Gh0strat family
-
Loads dropped DLL 1 IoCs
pid Process 3672 svchost.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Gchf\Hbxjfkbvp.jpg rundll32.exe File created C:\Program Files (x86)\Gchf\Hbxjfkbvp.jpg rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe 3672 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 1624 rundll32.exe Token: SeRestorePrivilege 1624 rundll32.exe Token: SeBackupPrivilege 1624 rundll32.exe Token: SeRestorePrivilege 1624 rundll32.exe Token: SeBackupPrivilege 1624 rundll32.exe Token: SeRestorePrivilege 1624 rundll32.exe Token: SeBackupPrivilege 1624 rundll32.exe Token: SeRestorePrivilege 1624 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1620 wrote to memory of 1624 1620 rundll32.exe 86 PID 1620 wrote to memory of 1624 1620 rundll32.exe 86 PID 1620 wrote to memory of 1624 1620 rundll32.exe 86
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9a8dbfb535152524e07fe247f7ef02dc.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9a8dbfb535152524e07fe247f7ef02dc.dll,#12⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1624
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3672
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17.5MB
MD5bedcd076f83f5609791b1569f3d47267
SHA175a1796141b3b1d75cd36c08f8c255bd7b820d8b
SHA256dad5a575f3dc92f12acc0deab804b30ec1f26adb9da737a7603ee5febe1b9c72
SHA512ebd7ee98971049dd3eb4eed79e08de70eb37e3ec5e83505d53f0388c9f211dc308e2a75a2a0f3efc671ae3453672c2393fef65a1c186bdf753fd655e5af6714e
