Analysis
- max time kernel
150s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 11:21
Behavioral task
behavioral1
Sample
jaffacakes118_05a654eb9f17e4dc41bee97a205763712aa9a6ac13933ced0e59edee76481882.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_05a654eb9f17e4dc41bee97a205763712aa9a6ac13933ced0e59edee76481882.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target jaffacakes118_05a654eb9f17e4dc41bee97a205763712aa9a6ac13933ced0e59edee76481882.exe
- Size 79KB
- Sample260930-nge11aea45
- SHA256 05a654eb9f17e4dc41bee97a205763712aa9a6ac13933ced0e59edee76481882
- MD5 6d89564a69083c3bfbc7eed3fcc9ef70
- SHA1 5e547d95e5bcc22e406122fe7f5ddccf39b77ec8
- SHA512 d4711674a8794a23a5553d871e19831e61d299d680777013d9c6d833ff792e5b43dbfbcd805acc12ba91d76e0bc23940d3c3c23c536e9e857935a4a4525ede7f
- SSDEEP 1536:eMS1xWwMvpco/Qfc9SHvt+xaA0MZFs0++fjByY/WP:bS18rvpP/qc9SlaoMZO0++fjByKWP
- TLSH T124834C41EAC442FEE9B5543C649B6B37DB37B924868D8E47BE14F9651832210FF2234B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Gh0st RAT payload 2 IoCs
resource yara_rule behavioral2/files/0x000a00000001b2cb-2.dat family_gh0strat behavioral2/files/0x001100000001c4d0-9.dat family_gh0strat - Deletes itself 1 TTPs 1 IoCs
pid Process 4620 svchost.exe - Loads dropped DLL 2 IoCs
pid Process 3568 jaffacakes118_05a654eb9f17e4dc41bee97a205763712aa9a6ac13933ced0e59edee76481882.exe 4620 svchost.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Rnop\Wnopqrstu.gif jaffacakes118_05a654eb9f17e4dc41bee97a205763712aa9a6ac13933ced0e59edee76481882.exe File created C:\Program Files (x86)\Rnop\Wnopqrstu.gif jaffacakes118_05a654eb9f17e4dc41bee97a205763712aa9a6ac13933ced0e59edee76481882.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_05a654eb9f17e4dc41bee97a205763712aa9a6ac13933ced0e59edee76481882.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe 4620 svchost.exe - Suspicious behavior: LoadsDriver 6 IoCs
pid Process 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 816 Process not Found - Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 3568 jaffacakes118_05a654eb9f17e4dc41bee97a205763712aa9a6ac13933ced0e59edee76481882.exe Token: SeRestorePrivilege 3568 jaffacakes118_05a654eb9f17e4dc41bee97a205763712aa9a6ac13933ced0e59edee76481882.exe Token: SeBackupPrivilege 3568 jaffacakes118_05a654eb9f17e4dc41bee97a205763712aa9a6ac13933ced0e59edee76481882.exe Token: SeRestorePrivilege 3568 jaffacakes118_05a654eb9f17e4dc41bee97a205763712aa9a6ac13933ced0e59edee76481882.exe Token: SeBackupPrivilege 3568 jaffacakes118_05a654eb9f17e4dc41bee97a205763712aa9a6ac13933ced0e59edee76481882.exe Token: SeRestorePrivilege 3568 jaffacakes118_05a654eb9f17e4dc41bee97a205763712aa9a6ac13933ced0e59edee76481882.exe Token: SeBackupPrivilege 3568 jaffacakes118_05a654eb9f17e4dc41bee97a205763712aa9a6ac13933ced0e59edee76481882.exe Token: SeRestorePrivilege 3568 jaffacakes118_05a654eb9f17e4dc41bee97a205763712aa9a6ac13933ced0e59edee76481882.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_05a654eb9f17e4dc41bee97a205763712aa9a6ac13933ced0e59edee76481882.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_05a654eb9f17e4dc41bee97a205763712aa9a6ac13933ced0e59edee76481882.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3568
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4620
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k imgsvc1⤵PID:824
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\2268700.dll
- Size 69KB
- SHA256 94e71dab0161918a95d40b041a35e4ad3979e8f895fb3254452e250d9dd6ec50
- MD5 266deb8d2bff578ad2cdf49b90dc653e
- SHA1 b67d6d4f4d7094ab9dcefea4a6bd4b1e45fab25e
- SHA512 9e05c4bd7ff4e35f563646043db891c9eebba268ad51a336e3e1c032dbe198e98f671ce409f7d0f6d99e9b9f993a5b58412dfd9c374669b9cade034e72ef0762
- SSDEEP 1536:SxWwMvpco/Qfc9SHvt+xaA0MZFs0++fjByY/W:S8rvpP/qc9SlaoMZO0++fjByKW
- TLSH T155634B41EAC942FEE8B5543C649B7B37CB377524868D8E43BE18CA751812214FB2338B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\WinWall64.bmp
- Size 131B
- SHA256 d65e0d26a2d4d67d61d370fa1bef897dc30de6de4251816e57aaf5d76c836e1c
- MD5 aaaede7e01f2e1593e344c7671087020
- SHA1 488603c0f629f0660afd9003548901f1192392c0
- SHA512 8d5cfe20e84ede684822a91b72c62687c364664264b9270b44014c6b50847680d43d5766df79f825fc10f80f0ff21e5b9d9c311dfdeab3d4c1119e75c93d2303
- TLSH T181C02B7900019206428A48AB00784D08D110CD0425086F644F30849132810A86D833C5
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\program files (x86)\rnop\wnopqrstu.gif
- Size 5.3MB
- SHA256 1eebe88a1c7fc071103ad46dddef65e31c77460a881379be48ea637281badb4e
- MD5 a93a0d281b3d6c324024b411969830d6
- SHA1 cdbc9ca6e4a51a16ff46844697cd8c39039e8cee
- SHA512 daea32dcd741360c4a31eacd3ee27ede8ebda34575d0a17a597792c6b3f97fcfb361820d7151ccb66d0fc850cecc6c6ec5b078d3001cecf9fce757418fa5102d
- SSDEEP 3072:S8rvpP/qc9SlaoMZO0++fjByKWzVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVt:l7pqUWJ0++fFyK0
- TLSH T13E468D8BBE8E3E604333E4367EFCB46E55E16501C9B645F1F2E51BE6000C89E71692E6
- MD5 SHA1 SHA512 SSDEEP TLSH
