Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
05/04/2025, 13:53
General
-
Target
JaffaCakes118_9abd4a0b15ad11f719d8436b543a214f.dll
-
Size
937KB
-
MD5
9abd4a0b15ad11f719d8436b543a214f
-
SHA1
8c2433df153c51fce295e865e21aa3d0bb268b94
-
SHA256
2a34fbd1537024187733fe1ac595ea1e2ab10b33d94b3370d071d223a2135672
-
SHA512
9a638ca3af9f53c8f040914f2238c4ad47426aaf6b16705cf916e61e4a6faf468391be4a2e8b8c247576eb2aa7d9edb413cd47f66c170a65497b6cdc0c35c658
-
SSDEEP
3072:JKIO+FY3VDkdrIPizmawJB9HFkJEa1Q1qIpkuoZW/vkdD:dY3Y0PqgDpqEO4qOWZWnW
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule behavioral1/files/0x01b10000000221a8-3.dat family_gh0strat -
Gh0strat family
-
Loads dropped DLL 1 IoCs
pid Process 1776 svchost.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\FileName.jpg rundll32.exe File opened for modification C:\Windows\FileName.jpg rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe 1776 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 1328 rundll32.exe Token: SeRestorePrivilege 1328 rundll32.exe Token: SeBackupPrivilege 1328 rundll32.exe Token: SeRestorePrivilege 1328 rundll32.exe Token: SeBackupPrivilege 1328 rundll32.exe Token: SeRestorePrivilege 1328 rundll32.exe Token: SeBackupPrivilege 1328 rundll32.exe Token: SeRestorePrivilege 1328 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 728 wrote to memory of 1328 728 rundll32.exe 86 PID 728 wrote to memory of 1328 728 rundll32.exe 86 PID 728 wrote to memory of 1328 728 rundll32.exe 86
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9abd4a0b15ad11f719d8436b543a214f.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:728 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9abd4a0b15ad11f719d8436b543a214f.dll,#12⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1328
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1776
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.5MB
MD5b9b0f282bb8112c7d30bce97494e43f7
SHA1210a8a34767345613e28fbfe9058e8d732289f1d
SHA25652c409cc3a7b658679db21deb55f6ab2fdd1813c0906cec8f5bef4f0464faa0d
SHA512a60e3c7781330a50f64b21634c2bd1e19dd0aae21a629d4de0409aa541c77d2bfed878f37a6b105313708912aaa5e2a37815e7aa9ac347be4ff71e4e76715e24
