Analysis
-
max time kernel
153s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-04-2024 07:35
Static task
static1
Behavioral task
behavioral1
Sample
f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe
-
Size
762KB
-
MD5
f78c0e1ce4b55a7cb15aa5c658ea7869
-
SHA1
d94b5a56d2229e38087927e3b135b699bfb1ee41
-
SHA256
86c7e250b9b3e4cbd7a3287011fbf212dd48f6afcfb5f226a11b5fea24ecbe3d
-
SHA512
3e1afdfd6c9d19fd51e6fcf0cb0ec30601c55096748debd38c33e8203aa799231268c096f7bca2ed17cb531e8f7522d8fef51e30864d0aef42eea0273a5bd5ae
-
SSDEEP
12288:dfbTcwXKp/oZ/0fY+VzD/2VU0p5LG4D0BQz7dbIXDnvziFQC1M6HRMuK7kJjwU:dncwMQhGqq0qKsQz7d6mef7kB
Malware Config
Extracted
darkcomet
Guest16_min
127.0.0.1:1604
DCMIN_MUTEX-6H00RHC
-
gencode
GSjCCgNrE819
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exedescription pid process target process PID 2932 set thread context of 2268 2932 f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exedescription pid process Token: SeIncreaseQuotaPrivilege 2268 f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe Token: SeSecurityPrivilege 2268 f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2268 f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe Token: SeLoadDriverPrivilege 2268 f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe Token: SeSystemProfilePrivilege 2268 f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe Token: SeSystemtimePrivilege 2268 f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 2268 f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2268 f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 2268 f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe Token: SeBackupPrivilege 2268 f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe Token: SeRestorePrivilege 2268 f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe Token: SeShutdownPrivilege 2268 f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe Token: SeDebugPrivilege 2268 f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 2268 f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 2268 f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 2268 f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe Token: SeUndockPrivilege 2268 f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe Token: SeManageVolumePrivilege 2268 f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe Token: SeImpersonatePrivilege 2268 f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 2268 f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe Token: 33 2268 f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe Token: 34 2268 f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe Token: 35 2268 f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exef78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exepid process 2932 f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe 2268 f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exedescription pid process target process PID 2932 wrote to memory of 2268 2932 f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe PID 2932 wrote to memory of 2268 2932 f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe PID 2932 wrote to memory of 2268 2932 f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe PID 2932 wrote to memory of 2268 2932 f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe PID 2932 wrote to memory of 2268 2932 f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe PID 2932 wrote to memory of 2268 2932 f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe PID 2932 wrote to memory of 2268 2932 f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe PID 2932 wrote to memory of 2268 2932 f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe PID 2932 wrote to memory of 2268 2932 f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe PID 2932 wrote to memory of 2268 2932 f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe PID 2932 wrote to memory of 2268 2932 f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe PID 2932 wrote to memory of 2268 2932 f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe PID 2932 wrote to memory of 2268 2932 f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f78c0e1ce4b55a7cb15aa5c658ea7869_JaffaCakes118.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2268-2-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2268-4-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2268-6-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2268-8-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2268-10-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2268-12-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2268-14-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2268-16-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2268-18-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2268-20-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2268-21-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2268-22-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2268-23-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2268-24-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2268-25-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/2268-26-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2268-27-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2268-28-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2268-30-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB