Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06-04-2024 15:23
Static task
static1
Behavioral task
behavioral1
Sample
e2d5f98dbb215361dc39bbf892aafd80_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e2d5f98dbb215361dc39bbf892aafd80_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
e2d5f98dbb215361dc39bbf892aafd80_JaffaCakes118.exe
-
Size
1.1MB
-
MD5
e2d5f98dbb215361dc39bbf892aafd80
-
SHA1
0e6eaceea0820c4ccd859a5c1aa1bd7224897f2f
-
SHA256
8a84c9d58284fbe1729e7c8c0ffcc8f47ec59eac7f05faaf6e1ecf69950a08e7
-
SHA512
d2163fb08c30cae411da1073b0628b4c12f09ff0961172f7c8828e3a3ac22138a5bc71aaf2321d7cd450543b78071e606da3b63e60a74c0d00234389c889a797
-
SSDEEP
12288:ZNip5W70M8BJ2ds9q1pfWeOyGtYWDmTis+MdbKBJPA0iLKPlAHBkia4rBwb4X0kF:Ze5ysJN6WarKba1DsaG+huViB
Malware Config
Extracted
darkcomet
Guest16
127.0.0.1:1604
DC_MUTEX-X8BTGZP
-
gencode
gLKKW46aGkvG
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
vbc.exepid process 1188 vbc.exe -
Loads dropped DLL 1 IoCs
Processes:
e2d5f98dbb215361dc39bbf892aafd80_JaffaCakes118.exepid process 1244 e2d5f98dbb215361dc39bbf892aafd80_JaffaCakes118.exe -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
e2d5f98dbb215361dc39bbf892aafd80_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinUpdtr = "C:\\Users\\Admin\\AppData\\Roaming\\WinUpdtr\\e2d5f98dbb215361dc39bbf892aafd80_JaffaCakes118.exe" e2d5f98dbb215361dc39bbf892aafd80_JaffaCakes118.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
e2d5f98dbb215361dc39bbf892aafd80_JaffaCakes118.exevbc.exedescription pid process target process PID 1244 set thread context of 1188 1244 e2d5f98dbb215361dc39bbf892aafd80_JaffaCakes118.exe vbc.exe PID 1188 set thread context of 2596 1188 vbc.exe iexplore.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
vbc.exedescription pid process Token: SeIncreaseQuotaPrivilege 1188 vbc.exe Token: SeSecurityPrivilege 1188 vbc.exe Token: SeTakeOwnershipPrivilege 1188 vbc.exe Token: SeLoadDriverPrivilege 1188 vbc.exe Token: SeSystemProfilePrivilege 1188 vbc.exe Token: SeSystemtimePrivilege 1188 vbc.exe Token: SeProfSingleProcessPrivilege 1188 vbc.exe Token: SeIncBasePriorityPrivilege 1188 vbc.exe Token: SeCreatePagefilePrivilege 1188 vbc.exe Token: SeBackupPrivilege 1188 vbc.exe Token: SeRestorePrivilege 1188 vbc.exe Token: SeShutdownPrivilege 1188 vbc.exe Token: SeDebugPrivilege 1188 vbc.exe Token: SeSystemEnvironmentPrivilege 1188 vbc.exe Token: SeChangeNotifyPrivilege 1188 vbc.exe Token: SeRemoteShutdownPrivilege 1188 vbc.exe Token: SeUndockPrivilege 1188 vbc.exe Token: SeManageVolumePrivilege 1188 vbc.exe Token: SeImpersonatePrivilege 1188 vbc.exe Token: SeCreateGlobalPrivilege 1188 vbc.exe Token: 33 1188 vbc.exe Token: 34 1188 vbc.exe Token: 35 1188 vbc.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
e2d5f98dbb215361dc39bbf892aafd80_JaffaCakes118.exevbc.exedescription pid process target process PID 1244 wrote to memory of 1188 1244 e2d5f98dbb215361dc39bbf892aafd80_JaffaCakes118.exe vbc.exe PID 1244 wrote to memory of 1188 1244 e2d5f98dbb215361dc39bbf892aafd80_JaffaCakes118.exe vbc.exe PID 1244 wrote to memory of 1188 1244 e2d5f98dbb215361dc39bbf892aafd80_JaffaCakes118.exe vbc.exe PID 1244 wrote to memory of 1188 1244 e2d5f98dbb215361dc39bbf892aafd80_JaffaCakes118.exe vbc.exe PID 1244 wrote to memory of 1188 1244 e2d5f98dbb215361dc39bbf892aafd80_JaffaCakes118.exe vbc.exe PID 1244 wrote to memory of 1188 1244 e2d5f98dbb215361dc39bbf892aafd80_JaffaCakes118.exe vbc.exe PID 1244 wrote to memory of 1188 1244 e2d5f98dbb215361dc39bbf892aafd80_JaffaCakes118.exe vbc.exe PID 1244 wrote to memory of 1188 1244 e2d5f98dbb215361dc39bbf892aafd80_JaffaCakes118.exe vbc.exe PID 1244 wrote to memory of 1188 1244 e2d5f98dbb215361dc39bbf892aafd80_JaffaCakes118.exe vbc.exe PID 1244 wrote to memory of 1188 1244 e2d5f98dbb215361dc39bbf892aafd80_JaffaCakes118.exe vbc.exe PID 1244 wrote to memory of 1188 1244 e2d5f98dbb215361dc39bbf892aafd80_JaffaCakes118.exe vbc.exe PID 1244 wrote to memory of 1188 1244 e2d5f98dbb215361dc39bbf892aafd80_JaffaCakes118.exe vbc.exe PID 1244 wrote to memory of 1188 1244 e2d5f98dbb215361dc39bbf892aafd80_JaffaCakes118.exe vbc.exe PID 1188 wrote to memory of 2596 1188 vbc.exe iexplore.exe PID 1188 wrote to memory of 2596 1188 vbc.exe iexplore.exe PID 1188 wrote to memory of 2596 1188 vbc.exe iexplore.exe PID 1188 wrote to memory of 2596 1188 vbc.exe iexplore.exe PID 1188 wrote to memory of 2596 1188 vbc.exe iexplore.exe PID 1188 wrote to memory of 2596 1188 vbc.exe iexplore.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2d5f98dbb215361dc39bbf892aafd80_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e2d5f98dbb215361dc39bbf892aafd80_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vbc.exeC:\Users\Admin\AppData\Local\Temp\vbc.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\vbc.exeFilesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98
-
memory/1188-17-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1188-27-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/1188-16-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1188-9-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1188-11-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1188-13-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1188-14-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1188-18-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1188-30-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1188-26-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1188-15-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1188-19-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1188-21-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1188-23-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1188-25-0x0000000000400000-0x00000000004B0000-memory.dmpFilesize
704KB
-
memory/1244-24-0x0000000074CE0000-0x000000007528B000-memory.dmpFilesize
5.7MB
-
memory/1244-0-0x0000000074CE0000-0x000000007528B000-memory.dmpFilesize
5.7MB
-
memory/1244-1-0x00000000002B0000-0x00000000002F0000-memory.dmpFilesize
256KB
-
memory/1244-2-0x0000000074CE0000-0x000000007528B000-memory.dmpFilesize
5.7MB
-
memory/2596-29-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB