Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
19-04-2024 00:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f9197d5a2e2d7a2b2f80bb387f7d2c28_JaffaCakes118.exe
Resource
win7-20240221-en
windows7-x64
12 signatures
150 seconds
General
-
Target
f9197d5a2e2d7a2b2f80bb387f7d2c28_JaffaCakes118.exe
-
Size
1.2MB
-
MD5
f9197d5a2e2d7a2b2f80bb387f7d2c28
-
SHA1
4852766feb4948903bc09c9a493bf0f0398c0095
-
SHA256
5bfa91a23214f1a4bba7efffd224e5fdde2e7b69ecd9fe286b62451585c577a9
-
SHA512
6a53efdd665ccc6cc0bcd287809326ec9af28b584d14bf448d944fdbca27abde5362353c5793277bd29cffb79a322d034721d120060574aa667335551eff8718
-
SSDEEP
24576:Y2O/GlDHqFHHVDFNEzQbCG3/QJfSPXYuTfx8n2VuFSWVxNu:nHUYQjQhUo0WbsGxQ
Malware Config
Extracted
Family
darkcomet
Botnet
NEWBABY2
C2
dcthings.changeip.org:988
Mutex
DC_MUTEX-HMSY2RH
Attributes
-
gencode
a2CQEonCR87h
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
f9197d5a2e2d7a2b2f80bb387f7d2c28_JaffaCakes118.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation f9197d5a2e2d7a2b2f80bb387f7d2c28_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
Processes:
ppirvcydqcw.exepid Process 2552 ppirvcydqcw.exe -
Processes:
resource yara_rule behavioral2/memory/2000-25-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/2000-27-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/2000-28-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/2000-30-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/2000-29-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/2000-32-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/2000-33-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/2000-34-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
ppirvcydqcw.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\C:\Users\Admin\85YD65~1 = "C:\\Users\\Admin\\85YD65~1\\qxctox.vbs" ppirvcydqcw.exe -
Processes:
ppirvcydqcw.exedescription ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ppirvcydqcw.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ppirvcydqcw.exedescription pid Process procid_target PID 2552 set thread context of 2000 2552 ppirvcydqcw.exe 96 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
ppirvcydqcw.exepid Process 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe 2552 ppirvcydqcw.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
RegSvcs.exeppirvcydqcw.exedescription pid Process Token: SeIncreaseQuotaPrivilege 2000 RegSvcs.exe Token: SeSecurityPrivilege 2000 RegSvcs.exe Token: SeTakeOwnershipPrivilege 2000 RegSvcs.exe Token: SeLoadDriverPrivilege 2000 RegSvcs.exe Token: SeSystemProfilePrivilege 2000 RegSvcs.exe Token: SeSystemtimePrivilege 2000 RegSvcs.exe Token: SeProfSingleProcessPrivilege 2000 RegSvcs.exe Token: SeIncBasePriorityPrivilege 2000 RegSvcs.exe Token: SeCreatePagefilePrivilege 2000 RegSvcs.exe Token: SeBackupPrivilege 2000 RegSvcs.exe Token: SeRestorePrivilege 2000 RegSvcs.exe Token: SeShutdownPrivilege 2000 RegSvcs.exe Token: SeDebugPrivilege 2000 RegSvcs.exe Token: SeSystemEnvironmentPrivilege 2000 RegSvcs.exe Token: SeChangeNotifyPrivilege 2000 RegSvcs.exe Token: SeRemoteShutdownPrivilege 2000 RegSvcs.exe Token: SeUndockPrivilege 2000 RegSvcs.exe Token: SeManageVolumePrivilege 2000 RegSvcs.exe Token: SeImpersonatePrivilege 2000 RegSvcs.exe Token: SeCreateGlobalPrivilege 2000 RegSvcs.exe Token: 33 2000 RegSvcs.exe Token: 34 2000 RegSvcs.exe Token: 35 2000 RegSvcs.exe Token: 36 2000 RegSvcs.exe Token: SeDebugPrivilege 2552 ppirvcydqcw.exe Token: SeDebugPrivilege 2552 ppirvcydqcw.exe Token: SeDebugPrivilege 2552 ppirvcydqcw.exe Token: SeDebugPrivilege 2552 ppirvcydqcw.exe Token: SeDebugPrivilege 2552 ppirvcydqcw.exe Token: SeDebugPrivilege 2552 ppirvcydqcw.exe Token: SeDebugPrivilege 2552 ppirvcydqcw.exe Token: SeDebugPrivilege 2552 ppirvcydqcw.exe Token: SeDebugPrivilege 2552 ppirvcydqcw.exe Token: SeDebugPrivilege 2552 ppirvcydqcw.exe Token: SeDebugPrivilege 2552 ppirvcydqcw.exe Token: SeDebugPrivilege 2552 ppirvcydqcw.exe Token: SeDebugPrivilege 2552 ppirvcydqcw.exe Token: SeDebugPrivilege 2552 ppirvcydqcw.exe Token: SeDebugPrivilege 2552 ppirvcydqcw.exe Token: SeDebugPrivilege 2552 ppirvcydqcw.exe Token: SeDebugPrivilege 2552 ppirvcydqcw.exe Token: SeDebugPrivilege 2552 ppirvcydqcw.exe Token: SeDebugPrivilege 2552 ppirvcydqcw.exe Token: SeDebugPrivilege 2552 ppirvcydqcw.exe Token: SeDebugPrivilege 2552 ppirvcydqcw.exe Token: SeDebugPrivilege 2552 ppirvcydqcw.exe Token: SeDebugPrivilege 2552 ppirvcydqcw.exe Token: SeDebugPrivilege 2552 ppirvcydqcw.exe Token: SeDebugPrivilege 2552 ppirvcydqcw.exe Token: SeDebugPrivilege 2552 ppirvcydqcw.exe Token: SeDebugPrivilege 2552 ppirvcydqcw.exe Token: SeDebugPrivilege 2552 ppirvcydqcw.exe Token: SeDebugPrivilege 2552 ppirvcydqcw.exe Token: SeDebugPrivilege 2552 ppirvcydqcw.exe Token: SeDebugPrivilege 2552 ppirvcydqcw.exe Token: SeDebugPrivilege 2552 ppirvcydqcw.exe Token: SeDebugPrivilege 2552 ppirvcydqcw.exe Token: SeDebugPrivilege 2552 ppirvcydqcw.exe Token: SeDebugPrivilege 2552 ppirvcydqcw.exe Token: SeDebugPrivilege 2552 ppirvcydqcw.exe Token: SeDebugPrivilege 2552 ppirvcydqcw.exe Token: SeDebugPrivilege 2552 ppirvcydqcw.exe Token: SeDebugPrivilege 2552 ppirvcydqcw.exe Token: SeDebugPrivilege 2552 ppirvcydqcw.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegSvcs.exepid Process 2000 RegSvcs.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
f9197d5a2e2d7a2b2f80bb387f7d2c28_JaffaCakes118.exeppirvcydqcw.exedescription pid Process procid_target PID 2840 wrote to memory of 2552 2840 f9197d5a2e2d7a2b2f80bb387f7d2c28_JaffaCakes118.exe 91 PID 2840 wrote to memory of 2552 2840 f9197d5a2e2d7a2b2f80bb387f7d2c28_JaffaCakes118.exe 91 PID 2840 wrote to memory of 2552 2840 f9197d5a2e2d7a2b2f80bb387f7d2c28_JaffaCakes118.exe 91 PID 2552 wrote to memory of 2000 2552 ppirvcydqcw.exe 96 PID 2552 wrote to memory of 2000 2552 ppirvcydqcw.exe 96 PID 2552 wrote to memory of 2000 2552 ppirvcydqcw.exe 96 PID 2552 wrote to memory of 2000 2552 ppirvcydqcw.exe 96 PID 2552 wrote to memory of 2000 2552 ppirvcydqcw.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\f9197d5a2e2d7a2b2f80bb387f7d2c28_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f9197d5a2e2d7a2b2f80bb387f7d2c28_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\85yd658866kut\ppirvcydqcw.exe"C:\Users\Admin\85yd658866kut\ppirvcydqcw.exe" qzkhxqu2⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2000
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
146B
MD5f8f28e7c74bd6a4cc7df56669afa88cf
SHA17bb80e39c9110df945606e130487d9d6640b070b
SHA256c77b3f14f6b629c255ca6a3a670a2a74c745fb81eaaa889b48f1e6f40b2204dd
SHA51236ce3e93494ab29b2993053915848719d2323767fc728eb48bec9fb2b779e134fd4bf8af6e2c3a62308ec1cf103146c6af63d83afd870cd7293fd4d7f34e1a52
-
Filesize
251KB
MD5ee86c399347a94cc72e7f7265beaad5f
SHA1fac42d67f75805b995f5e64cdb1396f931b93373
SHA256bbbc1f71ad5a62ee9c0d79027b92d8e8507e53ca0e25cb6927f05dc3f488cd11
SHA512728c9f1e38d91af7aa9cc3e02960c666891103cba59db77aa332937c9dc158b8e7d5c866f34831b18381e87d8c10fd8e6dc5918e33c40481c1d7aa73e885e80d
-
Filesize
910KB
MD5330c70c8a9a4add2f13b5d896e335574
SHA18b50e8ed46359453ddd2f95fb666eaa0688e33f9
SHA256767e7e13b2dd575a03e92e687c973248bef7a0f17984a69cdf052ea0d342dc16
SHA5120c0eaabd34d93440df485a0f2682de919417fc6eefb18b296354eee49aae45b9f117a580e6bdbc9d9480f80e67ac14943f364e8f8b4c4342656331ca5d7aede3
-
Filesize
710.9MB
MD5040c0ca4e6d406e859e4b3d3a762d801
SHA1239418df64e0282a85ac8f2485314c905fcd5c7e
SHA25667f2a26a4a4c06ddaec5cc24766ec91706e2035f92397b28c4d84bf510bb565a
SHA512ab845c212d7ef3d66c8fb37e76ed70fadb1caf5d9958abbf101e23710a8a819c31571161668143b6adf3645a4e6727287b63ce757a6e1986677c46e65073d6fb