Analysis
-
max time kernel
149s -
max time network
55s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
26-04-2024 11:52
Behavioral task
behavioral1
Sample
00b4508c912632a94e412cda51899c74_JaffaCakes118.exe
Resource
win7-20240215-en
General
-
Target
00b4508c912632a94e412cda51899c74_JaffaCakes118.exe
-
Size
891KB
-
MD5
00b4508c912632a94e412cda51899c74
-
SHA1
92d770176192283fc313060da3aa64ab4f3fb0ce
-
SHA256
825034af80c22c76d6cab1c71433cd66d73fb777125d4541aebba4a9a738e5e3
-
SHA512
af0fe8cdea6cef68a6f5e47627779fc2079c7ddf73a94a5ee74472a9ad6a52cad13068d5fc0d7cbd076812270f33fd60cf8dc844af49927b381b310f61e4ce7b
-
SSDEEP
12288:k9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hZYoa1sQDt:oZ1xuVVjfFoynPaVBUR8f+kN10EBnno
Malware Config
Extracted
darkcomet
Guest16
90.211.217.77:1604
DC_MUTEX-PUCAX1M
-
gencode
v0xzhQ2SiLAX
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
00b4508c912632a94e412cda51899c74_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe -
Modifies security service 2 TTPs 1 IoCs
Processes:
00b4508c912632a94e412cda51899c74_JaffaCakes118.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 4804 attrib.exe 2828 attrib.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
00b4508c912632a94e412cda51899c74_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
00b4508c912632a94e412cda51899c74_JaffaCakes118.exepid process 4220 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
00b4508c912632a94e412cda51899c74_JaffaCakes118.exedescription pid process Token: SeIncreaseQuotaPrivilege 4220 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe Token: SeSecurityPrivilege 4220 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 4220 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe Token: SeLoadDriverPrivilege 4220 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe Token: SeSystemProfilePrivilege 4220 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe Token: SeSystemtimePrivilege 4220 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 4220 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4220 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 4220 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe Token: SeBackupPrivilege 4220 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe Token: SeRestorePrivilege 4220 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe Token: SeShutdownPrivilege 4220 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe Token: SeDebugPrivilege 4220 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 4220 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 4220 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 4220 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe Token: SeUndockPrivilege 4220 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe Token: SeManageVolumePrivilege 4220 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe Token: SeImpersonatePrivilege 4220 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 4220 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe Token: 33 4220 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe Token: 34 4220 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe Token: 35 4220 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe Token: 36 4220 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
00b4508c912632a94e412cda51899c74_JaffaCakes118.exepid process 4220 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 34 IoCs
Processes:
00b4508c912632a94e412cda51899c74_JaffaCakes118.execmd.execmd.exedescription pid process target process PID 4220 wrote to memory of 872 4220 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe cmd.exe PID 4220 wrote to memory of 872 4220 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe cmd.exe PID 4220 wrote to memory of 872 4220 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe cmd.exe PID 4220 wrote to memory of 4552 4220 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe cmd.exe PID 4220 wrote to memory of 4552 4220 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe cmd.exe PID 4220 wrote to memory of 4552 4220 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe cmd.exe PID 4220 wrote to memory of 4812 4220 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe notepad.exe PID 4220 wrote to memory of 4812 4220 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe notepad.exe PID 4220 wrote to memory of 4812 4220 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe notepad.exe PID 4220 wrote to memory of 4812 4220 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe notepad.exe PID 4220 wrote to memory of 4812 4220 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe notepad.exe PID 4220 wrote to memory of 4812 4220 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe notepad.exe PID 4220 wrote to memory of 4812 4220 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe notepad.exe PID 4220 wrote to memory of 4812 4220 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe notepad.exe PID 4220 wrote to memory of 4812 4220 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe notepad.exe PID 4220 wrote to memory of 4812 4220 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe notepad.exe PID 4220 wrote to memory of 4812 4220 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe notepad.exe PID 4220 wrote to memory of 4812 4220 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe notepad.exe PID 4220 wrote to memory of 4812 4220 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe notepad.exe PID 4220 wrote to memory of 4812 4220 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe notepad.exe PID 4220 wrote to memory of 4812 4220 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe notepad.exe PID 4220 wrote to memory of 4812 4220 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe notepad.exe PID 4220 wrote to memory of 4812 4220 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe notepad.exe PID 4220 wrote to memory of 4812 4220 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe notepad.exe PID 4220 wrote to memory of 4812 4220 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe notepad.exe PID 4220 wrote to memory of 4812 4220 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe notepad.exe PID 4220 wrote to memory of 4812 4220 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe notepad.exe PID 4220 wrote to memory of 4812 4220 00b4508c912632a94e412cda51899c74_JaffaCakes118.exe notepad.exe PID 872 wrote to memory of 4804 872 cmd.exe attrib.exe PID 872 wrote to memory of 4804 872 cmd.exe attrib.exe PID 872 wrote to memory of 4804 872 cmd.exe attrib.exe PID 4552 wrote to memory of 2828 4552 cmd.exe attrib.exe PID 4552 wrote to memory of 2828 4552 cmd.exe attrib.exe PID 4552 wrote to memory of 2828 4552 cmd.exe attrib.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 4804 attrib.exe 2828 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\00b4508c912632a94e412cda51899c74_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\00b4508c912632a94e412cda51899c74_JaffaCakes118.exe"1⤵
- Modifies firewall policy service
- Modifies security service
- Checks computer location settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\00b4508c912632a94e412cda51899c74_JaffaCakes118.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\00b4508c912632a94e412cda51899c74_JaffaCakes118.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4220-0-0x0000000002160000-0x0000000002161000-memory.dmpFilesize
4KB
-
memory/4220-2-0x0000000000400000-0x00000000004EC000-memory.dmpFilesize
944KB
-
memory/4220-3-0x0000000000400000-0x00000000004EC000-memory.dmpFilesize
944KB
-
memory/4220-4-0x0000000002160000-0x0000000002161000-memory.dmpFilesize
4KB
-
memory/4812-1-0x00000000011B0000-0x00000000011B1000-memory.dmpFilesize
4KB