Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
01-04-2024 07:10
Static task
static1
Behavioral task
behavioral1
Sample
6b5228408867c1a250c177ce49489273_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
6b5228408867c1a250c177ce49489273_JaffaCakes118.exe
-
Size
850KB
-
MD5
6b5228408867c1a250c177ce49489273
-
SHA1
a1ad3579cb3666025008484d288b23c5907db80a
-
SHA256
166c477928d3f10104edbb3a44e7922567c70a8bf58f51a76fa971fd2ad8194c
-
SHA512
66843e1a618b9908448124bdc6c9b930c5435fa2929186ea613c859d3b4b243e35d4a5b96beb6af348740793159d5ee1d17493142d05f8bd75133365a3d74aed
-
SSDEEP
24576:OnukqBdH2BuGCZg/vBcOAJaaktmSqvv/IOuAT:m4KBBCgvAJHktmS8vQOuA
Malware Config
Extracted
darkcomet
Guest16
6.tcp.ngrok.io:10371
DC_MUTEX-VHZPBK5
-
gencode
iXnzmGbAY8jT
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
6b5228408867c1a250c177ce49489273_JaffaCakes118.exedescription pid process target process PID 844 set thread context of 2892 844 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
6b5228408867c1a250c177ce49489273_JaffaCakes118.exepid process 844 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe 844 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
6b5228408867c1a250c177ce49489273_JaffaCakes118.exe6b5228408867c1a250c177ce49489273_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 844 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 2892 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe Token: SeSecurityPrivilege 2892 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2892 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe Token: SeLoadDriverPrivilege 2892 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe Token: SeSystemProfilePrivilege 2892 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe Token: SeSystemtimePrivilege 2892 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 2892 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2892 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 2892 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe Token: SeBackupPrivilege 2892 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe Token: SeRestorePrivilege 2892 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe Token: SeShutdownPrivilege 2892 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe Token: SeDebugPrivilege 2892 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 2892 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 2892 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 2892 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe Token: SeUndockPrivilege 2892 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe Token: SeManageVolumePrivilege 2892 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe Token: SeImpersonatePrivilege 2892 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 2892 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe Token: 33 2892 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe Token: 34 2892 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe Token: 35 2892 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
6b5228408867c1a250c177ce49489273_JaffaCakes118.exepid process 2892 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 44 IoCs
Processes:
6b5228408867c1a250c177ce49489273_JaffaCakes118.exe6b5228408867c1a250c177ce49489273_JaffaCakes118.execmd.exedescription pid process target process PID 844 wrote to memory of 2892 844 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe PID 844 wrote to memory of 2892 844 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe PID 844 wrote to memory of 2892 844 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe PID 844 wrote to memory of 2892 844 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe PID 844 wrote to memory of 2892 844 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe PID 844 wrote to memory of 2892 844 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe PID 844 wrote to memory of 2892 844 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe PID 844 wrote to memory of 2892 844 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe PID 844 wrote to memory of 2892 844 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe PID 844 wrote to memory of 2892 844 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe PID 844 wrote to memory of 2892 844 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe PID 844 wrote to memory of 2892 844 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe PID 844 wrote to memory of 2892 844 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe PID 2892 wrote to memory of 2504 2892 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe cmd.exe PID 2892 wrote to memory of 2504 2892 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe cmd.exe PID 2892 wrote to memory of 2504 2892 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe cmd.exe PID 2892 wrote to memory of 2504 2892 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe cmd.exe PID 2892 wrote to memory of 2616 2892 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe notepad.exe PID 2892 wrote to memory of 2616 2892 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe notepad.exe PID 2892 wrote to memory of 2616 2892 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe notepad.exe PID 2892 wrote to memory of 2616 2892 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe notepad.exe PID 2892 wrote to memory of 2616 2892 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe notepad.exe PID 2892 wrote to memory of 2616 2892 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe notepad.exe PID 2892 wrote to memory of 2616 2892 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe notepad.exe PID 2892 wrote to memory of 2616 2892 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe notepad.exe PID 2892 wrote to memory of 2616 2892 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe notepad.exe PID 2892 wrote to memory of 2616 2892 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe notepad.exe PID 2892 wrote to memory of 2616 2892 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe notepad.exe PID 2892 wrote to memory of 2616 2892 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe notepad.exe PID 2892 wrote to memory of 2616 2892 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe notepad.exe PID 2892 wrote to memory of 2616 2892 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe notepad.exe PID 2892 wrote to memory of 2616 2892 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe notepad.exe PID 2892 wrote to memory of 2616 2892 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe notepad.exe PID 2892 wrote to memory of 2616 2892 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe notepad.exe PID 2892 wrote to memory of 2616 2892 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe notepad.exe PID 2892 wrote to memory of 2616 2892 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe notepad.exe PID 2892 wrote to memory of 2616 2892 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe notepad.exe PID 2892 wrote to memory of 2616 2892 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe notepad.exe PID 2892 wrote to memory of 2616 2892 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe notepad.exe PID 2892 wrote to memory of 2616 2892 6b5228408867c1a250c177ce49489273_JaffaCakes118.exe notepad.exe PID 2504 wrote to memory of 2452 2504 cmd.exe attrib.exe PID 2504 wrote to memory of 2452 2504 cmd.exe attrib.exe PID 2504 wrote to memory of 2452 2504 cmd.exe attrib.exe PID 2504 wrote to memory of 2452 2504 cmd.exe attrib.exe -
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6b5228408867c1a250c177ce49489273_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6b5228408867c1a250c177ce49489273_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6b5228408867c1a250c177ce49489273_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6b5228408867c1a250c177ce49489273_JaffaCakes118.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\6b5228408867c1a250c177ce49489273_JaffaCakes118.exe" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\6b5228408867c1a250c177ce49489273_JaffaCakes118.exe" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/844-0-0x0000000001160000-0x000000000123C000-memory.dmpFilesize
880KB
-
memory/844-1-0x0000000073FE0000-0x00000000746CE000-memory.dmpFilesize
6.9MB
-
memory/844-2-0x0000000000280000-0x0000000000286000-memory.dmpFilesize
24KB
-
memory/844-3-0x0000000000530000-0x0000000000570000-memory.dmpFilesize
256KB
-
memory/844-4-0x00000000002A0000-0x00000000002AA000-memory.dmpFilesize
40KB
-
memory/844-20-0x0000000073FE0000-0x00000000746CE000-memory.dmpFilesize
6.9MB
-
memory/2616-54-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/2616-24-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB
-
memory/2892-13-0x0000000000400000-0x00000000004CD000-memory.dmpFilesize
820KB
-
memory/2892-58-0x0000000000400000-0x00000000004CD000-memory.dmpFilesize
820KB
-
memory/2892-11-0x0000000000400000-0x00000000004CD000-memory.dmpFilesize
820KB
-
memory/2892-14-0x0000000000400000-0x00000000004CD000-memory.dmpFilesize
820KB
-
memory/2892-15-0x0000000000400000-0x00000000004CD000-memory.dmpFilesize
820KB
-
memory/2892-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2892-18-0x0000000000400000-0x00000000004CD000-memory.dmpFilesize
820KB
-
memory/2892-19-0x0000000000400000-0x00000000004CD000-memory.dmpFilesize
820KB
-
memory/2892-7-0x0000000000400000-0x00000000004CD000-memory.dmpFilesize
820KB
-
memory/2892-21-0x0000000000400000-0x00000000004CD000-memory.dmpFilesize
820KB
-
memory/2892-22-0x0000000000400000-0x00000000004CD000-memory.dmpFilesize
820KB
-
memory/2892-23-0x0000000000110000-0x0000000000111000-memory.dmpFilesize
4KB
-
memory/2892-6-0x0000000000400000-0x00000000004CD000-memory.dmpFilesize
820KB
-
memory/2892-5-0x0000000000400000-0x00000000004CD000-memory.dmpFilesize
820KB
-
memory/2892-55-0x0000000000400000-0x00000000004CD000-memory.dmpFilesize
820KB
-
memory/2892-56-0x0000000000400000-0x00000000004CD000-memory.dmpFilesize
820KB
-
memory/2892-57-0x0000000000400000-0x00000000004CD000-memory.dmpFilesize
820KB
-
memory/2892-9-0x0000000000400000-0x00000000004CD000-memory.dmpFilesize
820KB
-
memory/2892-59-0x0000000000400000-0x00000000004CD000-memory.dmpFilesize
820KB
-
memory/2892-60-0x0000000000400000-0x00000000004CD000-memory.dmpFilesize
820KB
-
memory/2892-61-0x0000000000400000-0x00000000004CD000-memory.dmpFilesize
820KB
-
memory/2892-62-0x0000000000400000-0x00000000004CD000-memory.dmpFilesize
820KB
-
memory/2892-63-0x0000000000400000-0x00000000004CD000-memory.dmpFilesize
820KB
-
memory/2892-64-0x0000000000400000-0x00000000004CD000-memory.dmpFilesize
820KB
-
memory/2892-65-0x0000000000400000-0x00000000004CD000-memory.dmpFilesize
820KB
-
memory/2892-66-0x0000000000400000-0x00000000004CD000-memory.dmpFilesize
820KB
-
memory/2892-67-0x0000000000400000-0x00000000004CD000-memory.dmpFilesize
820KB
-
memory/2892-68-0x0000000000400000-0x00000000004CD000-memory.dmpFilesize
820KB
-
memory/2892-69-0x0000000000400000-0x00000000004CD000-memory.dmpFilesize
820KB
-
memory/2892-70-0x0000000000400000-0x00000000004CD000-memory.dmpFilesize
820KB
-
memory/2892-71-0x0000000000400000-0x00000000004CD000-memory.dmpFilesize
820KB
-
memory/2892-122-0x0000000000110000-0x0000000000111000-memory.dmpFilesize
4KB
-
memory/2892-121-0x0000000000400000-0x00000000004CD000-memory.dmpFilesize
820KB