Analysis
- max time kernel
150s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/10/2026, 00:43
Behavioral task
behavioral1
Sample
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target jaffacakes118_HEUR.Trojan.Win32.Generic.exe
- Size 172KB
- Sample261013-a2wmlaet4n
- SHA256 223a55290ad787ada1962acacd3f068f1e26dd9cd236c53e1fabb4a1b924b07a
- MD5 770576b69dc3c756a29a4d218879df73
- SHA1 30dec8799d88f8ce84db3c606a8daa7c7acd57c8
- SHA512 e0684704acaac2d97d4c50e86319ef7fbee6eba54001c7cf18d1427ea09e6fb79336641ce01e8e361cc2ab0f0405e81e0bd73564994ba62df772b5036139e618
- SSDEEP 3072:Whypk6yxVHQ571V1UuPUdUk+Lxj58qMCSq8qiRPeqov:Whypk6ahQzcd+dKqr0Veqo
- TLSH T1BF047D32FBC481FAE6641530346B7B36593AFD649B494A93A717F9A60C331D0FA22347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Gh0st RAT payload 8 IoCs
resource yara_rule behavioral2/memory/3024-0-0x0000000000400000-0x000000000042B000-memory.dmp family_gh0strat behavioral2/files/0x000700000001b6dd-4.dat family_gh0strat behavioral2/memory/3024-5-0x0000000010000000-0x0000000010023000-memory.dmp family_gh0strat behavioral2/files/0x001000000001c5e4-12.dat family_gh0strat behavioral2/memory/1708-14-0x0000000010000000-0x0000000010023000-memory.dmp family_gh0strat behavioral2/memory/3024-18-0x0000000010000000-0x0000000010023000-memory.dmp family_gh0strat behavioral2/memory/3024-17-0x0000000000400000-0x000000000042B000-memory.dmp family_gh0strat behavioral2/memory/1708-19-0x0000000010000000-0x0000000010023000-memory.dmp family_gh0strat - Deletes itself 1 TTPs 1 IoCs
pid Process 1708 svchost.exe - Loads dropped DLL 2 IoCs
pid Process 3024 jaffacakes118_HEUR.Trojan.Win32.Generic.exe 1708 svchost.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Bcpy\Qcpgighkt.bmp jaffacakes118_HEUR.Trojan.Win32.Generic.exe File opened for modification C:\Program Files (x86)\Bcpy\Qcpgighkt.bmp jaffacakes118_HEUR.Trojan.Win32.Generic.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_HEUR.Trojan.Win32.Generic.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe - Suspicious behavior: LoadsDriver 6 IoCs
pid Process 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 812 Process not Found - Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeBackupPrivilege 3024 jaffacakes118_HEUR.Trojan.Win32.Generic.exe Token: SeRestorePrivilege 3024 jaffacakes118_HEUR.Trojan.Win32.Generic.exe Token: SeBackupPrivilege 3024 jaffacakes118_HEUR.Trojan.Win32.Generic.exe Token: SeRestorePrivilege 3024 jaffacakes118_HEUR.Trojan.Win32.Generic.exe Token: SeBackupPrivilege 3024 jaffacakes118_HEUR.Trojan.Win32.Generic.exe Token: SeRestorePrivilege 3024 jaffacakes118_HEUR.Trojan.Win32.Generic.exe Token: SeBackupPrivilege 3024 jaffacakes118_HEUR.Trojan.Win32.Generic.exe Token: SeRestorePrivilege 3024 jaffacakes118_HEUR.Trojan.Win32.Generic.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_HEUR.Trojan.Win32.Generic.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3024
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1708
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k imgsvc1⤵PID:4288
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\1585700.dll
- Size 124KB
- SHA256 82dca956a1781a9e294907b913901f881d24b0a650e8f423521b22c1cb668bb9
- MD5 9c487f27218438e1d782d9d44a01b598
- SHA1 9ce066471d99751840492a3d8d441efaf0357044
- SHA512 e363a8084a8ffb31ddb6454c909418ac34d661a4d8cfa6008ab5df1715a47955c073c27d0e9de5ba7ebbd1c02fbefb390309233ba8fd474fe726ab6264fcf864
- SSDEEP 3072:npk6yxVHQ571V1UuPUdUk+Lxj58qMCSq8qi:npk6ahQzcd+dKqr0
- TLSH T1DBC38C32EAC840FDFA54253030AEBB3B9A3AF95457495A93671BDDA50833190FB36347
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\NT_Path.jpg
- Size 92B
- SHA256 6b2ffe72c540cad4d5680bf8333b3e69f9869d0ca46525a364d394159abe8b01
- MD5 9b91388bd627a7db2c89ba0d0bfe0ffc
- SHA1 b9ff5464507a642f5eb173209b70971f97c9ecb9
- SHA512 fdb069cecf30044596c010e2576ddbd4a57580a1cb854c5e7e3f19b52f4b18480f6611c68cb4e11b425c6ffc0e7bda61e9e5d6a9339285b7d5d4361dd6964672
- TLSH T135B0120042434B14044098372434EBCCE5508909B9883F304332C684426240A6A80725
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\program files (x86)\bcpy\qcpgighkt.bmp
- Size 260KB
- SHA256 52397850ec5c22d05fb3ca2398074944e41ebce1f213f0177677af87d880ad01
- MD5 a468422e6e60fc3afcd8f8ee01b85493
- SHA1 3f3e08ce9a40b2088db6fb69d0ac29648610a222
- SHA512 e8fcc4870d692425c1c847ca278651b30aa4a72ecba10c328b1e62baa12913111237cefe1dbb00e6e6a8f81e4c3b71fe766d1d5f170ef716c2d76336d77dc5ea
- SSDEEP 3072:npk6yxVHQ571V1UuPUdUk+Lxj58qMCSq8qiC:npk6ahQzcd+dKqr0e
- TLSH T155442967228A45FCDE98A77D104727B2EE212581E364CBB36375D0A61CB308DB17772B
- MD5 SHA1 SHA512 SSDEEP TLSH
