Analysis
- max time kernel
150s - max time network
131s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/09/2026, 10:44
Behavioral task
behavioral1
Sample
jaffacakes118_97f440db08f34cdbe4ba5c4084713f50c0c521073653b1dc5e81123514fa8b7b.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_97f440db08f34cdbe4ba5c4084713f50c0c521073653b1dc5e81123514fa8b7b.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target jaffacakes118_97f440db08f34cdbe4ba5c4084713f50c0c521073653b1dc5e81123514fa8b7b.exe
- Size 78KB
- Sample260930-ms56wsys6k
- SHA256 97f440db08f34cdbe4ba5c4084713f50c0c521073653b1dc5e81123514fa8b7b
- MD5 8948ca5e40bf2acd3b7d3a74b269ed17
- SHA1 11ac11129615d3a127907a4f05be7dc2ae4e62fc
- SHA512 6fbfd58ed6bade9119405afdde48a5c380a4653cc7abc187b2a988f7c3404c41f355117164892a003c69df351529f141493f069602c22c00202d17814600a04b
- SSDEEP 1536:1PO0GWLrJcd/yfc9SWut0xkKVe9zs03E8jByw/16S:1PO0rLrJi/Ec9S7cVe9w03E8jByS16S
- TLSH T1FC735C41EAC442FEE8B5543C249B6B37DB377D20859D8E47BA18FA650832154FF2238B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Gh0st RAT payload 2 IoCs
resource yara_rule behavioral1/files/0x000c000000024316-2.dat family_gh0strat behavioral1/files/0x000b00000002441a-11.dat family_gh0strat - Deletes itself 1 TTPs 1 IoCs
pid Process 1624 svchost.exe - Loads dropped DLL 2 IoCs
pid Process 4140 jaffacakes118_97f440db08f34cdbe4ba5c4084713f50c0c521073653b1dc5e81123514fa8b7b.exe 1624 svchost.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Lhij\Qhijklmno.bmp jaffacakes118_97f440db08f34cdbe4ba5c4084713f50c0c521073653b1dc5e81123514fa8b7b.exe File created C:\Program Files (x86)\Lhij\Qhijklmno.bmp jaffacakes118_97f440db08f34cdbe4ba5c4084713f50c0c521073653b1dc5e81123514fa8b7b.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_97f440db08f34cdbe4ba5c4084713f50c0c521073653b1dc5e81123514fa8b7b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe 1624 svchost.exe - Suspicious behavior: LoadsDriver 6 IoCs
pid Process 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 656 Process not Found - Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 4140 jaffacakes118_97f440db08f34cdbe4ba5c4084713f50c0c521073653b1dc5e81123514fa8b7b.exe Token: SeRestorePrivilege 4140 jaffacakes118_97f440db08f34cdbe4ba5c4084713f50c0c521073653b1dc5e81123514fa8b7b.exe Token: SeBackupPrivilege 4140 jaffacakes118_97f440db08f34cdbe4ba5c4084713f50c0c521073653b1dc5e81123514fa8b7b.exe Token: SeRestorePrivilege 4140 jaffacakes118_97f440db08f34cdbe4ba5c4084713f50c0c521073653b1dc5e81123514fa8b7b.exe Token: SeBackupPrivilege 4140 jaffacakes118_97f440db08f34cdbe4ba5c4084713f50c0c521073653b1dc5e81123514fa8b7b.exe Token: SeRestorePrivilege 4140 jaffacakes118_97f440db08f34cdbe4ba5c4084713f50c0c521073653b1dc5e81123514fa8b7b.exe Token: SeBackupPrivilege 4140 jaffacakes118_97f440db08f34cdbe4ba5c4084713f50c0c521073653b1dc5e81123514fa8b7b.exe Token: SeRestorePrivilege 4140 jaffacakes118_97f440db08f34cdbe4ba5c4084713f50c0c521073653b1dc5e81123514fa8b7b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_97f440db08f34cdbe4ba5c4084713f50c0c521073653b1dc5e81123514fa8b7b.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_97f440db08f34cdbe4ba5c4084713f50c0c521073653b1dc5e81123514fa8b7b.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4140
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1624
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k imgsvc1⤵PID:852
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\2352200.dll
- Size 69KB
- SHA256 f52bc2004ae979e1e3d8611a9c7c261ace01a3c690bad36d8b5421551f86c31d
- MD5 e649cd8487273bf2e066eea24adaf058
- SHA1 023cee176c3f9aa9143bdc1d193c30d763893f3d
- SHA512 0333b9e03f2bf81d0e5b1c3dc5b7555244f8706b07fc626faefac15e97f91734b7c3096758a5422fcd131e56edec36a438dd005437250fe514299294840f3205
- SSDEEP 1536:qGWLrJcd/yfc9SWut0xkKVe9zs03E8jByw/16:qrLrJi/Ec9S7cVe9w03E8jByS16
- TLSH T1B8635B41FAC542FEE8B9643C24DB7B37DB377524859D8E43BA18CA650822154FB2738B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\WinWall64.bmp
- Size 131B
- SHA256 f7890d91ccf9148e4e5947f35f6f58a7f2be6ad2132807a499dc7bba4db08f8b
- MD5 8882e9ab787545278588a68487bbfdb9
- SHA1 b96874b0607791c2c8c0ad28256cde2900d9d986
- SHA512 ccfc5d9e41e2a4d6cc977aa583d42845fe9a90ba0d9a17ae09bc208be66a4f6a740040d423e67f470b59ed912aebd577c10308f9b0f677b0446da6339dae57d7
- TLSH T13AC02B5433058609188C84234770F22EC0304D46E1512F209134C4C6043004E7140308
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\program files (x86)\lhij\qhijklmno.bmp
- Size 2.1MB
- SHA256 bd0ad086b728c0ede6e1c392133bf348f08fed7ba23db1e26b9ae27742d84291
- MD5 15903b2dded40acad775820f9662163f
- SHA1 9dfba3e91a7500c181eeeecf8db0d10d663897f6
- SHA512 af07a19106daafea352b6166a4a0a482473189422029bf58d47ec83ca4bb72085e3e0728650ec50ed9c2d209b17dce42a4db2062cdf0dc358c86189bf7faf440
- SSDEEP 1536:qGWLrJcd/yfc9SWut0xkKVe9zs03E8jByw/16J:qrLrJi/Ec9S7cVe9w03E8jByS16J
- TLSH T1E9A53CCCD0745F4EB02C69EE3260A26567F73A6062F715F52B96843821F297D4BBBB10
- MD5 SHA1 SHA512 SSDEEP TLSH
