Analysis
- max time kernel
150s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 10:44
Behavioral task
behavioral1
Sample
jaffacakes118_97f440db08f34cdbe4ba5c4084713f50c0c521073653b1dc5e81123514fa8b7b.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_97f440db08f34cdbe4ba5c4084713f50c0c521073653b1dc5e81123514fa8b7b.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target jaffacakes118_97f440db08f34cdbe4ba5c4084713f50c0c521073653b1dc5e81123514fa8b7b.exe
- Size 78KB
- Sample260930-ms56wsys6k
- SHA256 97f440db08f34cdbe4ba5c4084713f50c0c521073653b1dc5e81123514fa8b7b
- MD5 8948ca5e40bf2acd3b7d3a74b269ed17
- SHA1 11ac11129615d3a127907a4f05be7dc2ae4e62fc
- SHA512 6fbfd58ed6bade9119405afdde48a5c380a4653cc7abc187b2a988f7c3404c41f355117164892a003c69df351529f141493f069602c22c00202d17814600a04b
- SSDEEP 1536:1PO0GWLrJcd/yfc9SWut0xkKVe9zs03E8jByw/16S:1PO0rLrJi/Ec9S7cVe9w03E8jByS16S
- TLSH T1FC735C41EAC442FEE8B5543C249B6B37DB377D20859D8E47BA18FA650832154FF2238B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Gh0st RAT payload 2 IoCs
resource yara_rule behavioral2/files/0x000a000000019cb8-2.dat family_gh0strat behavioral2/files/0x001100000001c569-9.dat family_gh0strat - Deletes itself 1 TTPs 1 IoCs
pid Process 4252 svchost.exe - Loads dropped DLL 2 IoCs
pid Process 3364 jaffacakes118_97f440db08f34cdbe4ba5c4084713f50c0c521073653b1dc5e81123514fa8b7b.exe 4252 svchost.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Lhij\Qhijklmno.bmp jaffacakes118_97f440db08f34cdbe4ba5c4084713f50c0c521073653b1dc5e81123514fa8b7b.exe File created C:\Program Files (x86)\Lhij\Qhijklmno.bmp jaffacakes118_97f440db08f34cdbe4ba5c4084713f50c0c521073653b1dc5e81123514fa8b7b.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_97f440db08f34cdbe4ba5c4084713f50c0c521073653b1dc5e81123514fa8b7b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe 4252 svchost.exe - Suspicious behavior: LoadsDriver 6 IoCs
pid Process 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 808 Process not Found - Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 3364 jaffacakes118_97f440db08f34cdbe4ba5c4084713f50c0c521073653b1dc5e81123514fa8b7b.exe Token: SeRestorePrivilege 3364 jaffacakes118_97f440db08f34cdbe4ba5c4084713f50c0c521073653b1dc5e81123514fa8b7b.exe Token: SeBackupPrivilege 3364 jaffacakes118_97f440db08f34cdbe4ba5c4084713f50c0c521073653b1dc5e81123514fa8b7b.exe Token: SeRestorePrivilege 3364 jaffacakes118_97f440db08f34cdbe4ba5c4084713f50c0c521073653b1dc5e81123514fa8b7b.exe Token: SeBackupPrivilege 3364 jaffacakes118_97f440db08f34cdbe4ba5c4084713f50c0c521073653b1dc5e81123514fa8b7b.exe Token: SeRestorePrivilege 3364 jaffacakes118_97f440db08f34cdbe4ba5c4084713f50c0c521073653b1dc5e81123514fa8b7b.exe Token: SeBackupPrivilege 3364 jaffacakes118_97f440db08f34cdbe4ba5c4084713f50c0c521073653b1dc5e81123514fa8b7b.exe Token: SeRestorePrivilege 3364 jaffacakes118_97f440db08f34cdbe4ba5c4084713f50c0c521073653b1dc5e81123514fa8b7b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_97f440db08f34cdbe4ba5c4084713f50c0c521073653b1dc5e81123514fa8b7b.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_97f440db08f34cdbe4ba5c4084713f50c0c521073653b1dc5e81123514fa8b7b.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3364
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4252
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k imgsvc1⤵PID:1776
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\2397100.dll
- Size 69KB
- SHA256 f52bc2004ae979e1e3d8611a9c7c261ace01a3c690bad36d8b5421551f86c31d
- MD5 e649cd8487273bf2e066eea24adaf058
- SHA1 023cee176c3f9aa9143bdc1d193c30d763893f3d
- SHA512 0333b9e03f2bf81d0e5b1c3dc5b7555244f8706b07fc626faefac15e97f91734b7c3096758a5422fcd131e56edec36a438dd005437250fe514299294840f3205
- SSDEEP 1536:qGWLrJcd/yfc9SWut0xkKVe9zs03E8jByw/16:qrLrJi/Ec9S7cVe9w03E8jByS16
- TLSH T1B8635B41FAC542FEE8B9643C24DB7B37DB377524859D8E43BA18CA650822154FB2738B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\WinWall64.bmp
- Size 131B
- SHA256 b35eec2ef8da0a416a9601bdc5cae8060f2d5b4217fee0ad98b29be94490ab2a
- MD5 d1f3a9490371b01041e48a177f93006a
- SHA1 ca3ce08400a3a99a1edac38c0e8c6331efa4fb9e
- SHA512 14022eaed62e5861ab7988a5d7c720970451278413a4aa42bcb9bb4a2ea300afd73b288acced85b24e0cdf47d8999a1ae4958d4aeb79e51d7962fc899ec1caae
- TLSH T1EDC02B803205860A084C84238770F23EC0304947E1512F20A138C0C61D3004D7251708
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\program files (x86)\lhij\qhijklmno.bmp
- Size 7.2MB
- SHA256 792d7006974a3c9665099bf278deae8d818e254869dac68cef19f09e184c46af
- MD5 6bdb7df1221ae35408a29b0acf922f2c
- SHA1 db5ca6a767a546cc98085ba9238fe67e36fe5ba8
- SHA512 9297b247587209b38a989190194a08d894ce57f43e2b3c668350684c5dfc7c810ffaca60387b813e0a237a8776c4daeb3e534504571394ec4ad8b8f2a7cd0c1c
- SSDEEP 6144:+viEUT903E8FyS8zyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyx:62TywI
- TLSH T1ED76AEC0D9626E5D14AD2CB7FDA98D2F3B09437383BA5EFB4091238AE1F6908D757019
- MD5 SHA1 SHA512 SSDEEP TLSH
