Analysis
-
max time kernel
149s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
06-05-2024 05:56
Behavioral task
behavioral1
Sample
1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe
Resource
win7-20240215-en
General
-
Target
1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe
-
Size
660KB
-
MD5
1b13fd5d2438595750bd28c0512a5efc
-
SHA1
12fa776a5a2c2f6b6abbb23512c32f5f89e09e6d
-
SHA256
8f5bfa1785455e30f95dc1aab6855220db3077a497448cedc15b435274efe238
-
SHA512
7013c113fe427a3c35cfe8fc29850cef0569a5e2319d13ec6df4679528fa88cf3b18e8f577405b2ae0543f3b0acab0ffbbc823370ce0fbd6e0511bf43bd62f2e
-
SSDEEP
12288:gXhpvNWw276S/DuoeFcfbmiJ99VPhYR5MTSHvLenELrWv1lZw4JuMkMh/fy452Un:mnAw2WWeFcfbP9VPSPMTSPL/rWvzq4JX
Malware Config
Extracted
darkcomet
Guest16
myramic.hopto.org:1604
192.168.1.34:1604
DC_MUTEX-U21HY5A
-
gencode
17wuPD1x7bTT
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid Process 2532 attrib.exe 2576 attrib.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exedescription pid Process Token: SeIncreaseQuotaPrivilege 1268 1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe Token: SeSecurityPrivilege 1268 1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 1268 1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe Token: SeLoadDriverPrivilege 1268 1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe Token: SeSystemProfilePrivilege 1268 1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe Token: SeSystemtimePrivilege 1268 1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 1268 1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1268 1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 1268 1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe Token: SeBackupPrivilege 1268 1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe Token: SeRestorePrivilege 1268 1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe Token: SeShutdownPrivilege 1268 1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe Token: SeDebugPrivilege 1268 1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 1268 1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 1268 1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 1268 1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe Token: SeUndockPrivilege 1268 1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe Token: SeManageVolumePrivilege 1268 1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe Token: SeImpersonatePrivilege 1268 1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 1268 1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe Token: 33 1268 1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe Token: 34 1268 1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe Token: 35 1268 1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exepid Process 1268 1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.execmd.execmd.exedescription pid Process procid_target PID 1268 wrote to memory of 2284 1268 1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe 28 PID 1268 wrote to memory of 2284 1268 1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe 28 PID 1268 wrote to memory of 2284 1268 1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe 28 PID 1268 wrote to memory of 2284 1268 1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe 28 PID 1268 wrote to memory of 2728 1268 1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe 30 PID 1268 wrote to memory of 2728 1268 1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe 30 PID 1268 wrote to memory of 2728 1268 1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe 30 PID 1268 wrote to memory of 2728 1268 1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe 30 PID 1268 wrote to memory of 2892 1268 1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe 31 PID 1268 wrote to memory of 2892 1268 1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe 31 PID 1268 wrote to memory of 2892 1268 1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe 31 PID 1268 wrote to memory of 2892 1268 1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe 31 PID 1268 wrote to memory of 2892 1268 1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe 31 PID 1268 wrote to memory of 2892 1268 1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe 31 PID 1268 wrote to memory of 2892 1268 1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe 31 PID 1268 wrote to memory of 2892 1268 1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe 31 PID 1268 wrote to memory of 2892 1268 1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe 31 PID 1268 wrote to memory of 2892 1268 1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe 31 PID 1268 wrote to memory of 2892 1268 1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe 31 PID 1268 wrote to memory of 2892 1268 1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe 31 PID 1268 wrote to memory of 2892 1268 1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe 31 PID 1268 wrote to memory of 2892 1268 1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe 31 PID 1268 wrote to memory of 2892 1268 1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe 31 PID 1268 wrote to memory of 2892 1268 1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe 31 PID 1268 wrote to memory of 2892 1268 1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe 31 PID 1268 wrote to memory of 2892 1268 1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe 31 PID 1268 wrote to memory of 2892 1268 1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe 31 PID 1268 wrote to memory of 2892 1268 1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe 31 PID 1268 wrote to memory of 2892 1268 1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe 31 PID 1268 wrote to memory of 2892 1268 1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe 31 PID 1268 wrote to memory of 2892 1268 1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe 31 PID 2728 wrote to memory of 2532 2728 cmd.exe 33 PID 2728 wrote to memory of 2532 2728 cmd.exe 33 PID 2728 wrote to memory of 2532 2728 cmd.exe 33 PID 2728 wrote to memory of 2532 2728 cmd.exe 33 PID 2284 wrote to memory of 2576 2284 cmd.exe 34 PID 2284 wrote to memory of 2576 2284 cmd.exe 34 PID 2284 wrote to memory of 2576 2284 cmd.exe 34 PID 2284 wrote to memory of 2576 2284 cmd.exe 34 -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid Process 2532 attrib.exe 2576 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\1b13fd5d2438595750bd28c0512a5efc_JaffaCakes118.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2576
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2532
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵PID:2892
-