Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 11:51
Behavioral task
behavioral1
Sample
5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe
-
Size
659KB
-
MD5
5eeb8b4e21e59894b65a6eb02266734f
-
SHA1
a76a1311b98e655b139bc934483ed6687f0be551
-
SHA256
89d4174111f2938051d86672b40965bedbee157227ccccc41ab937a32146de7d
-
SHA512
fd921d9a296116ebf31d649a823394e33d82b282fa57a0a9fc5a446ac2ddb17eaa51d260d89e8b4688e2990846f7d46efc90d5f9120f749de5ce7cfe4dd081a9
-
SSDEEP
12288:C9HMeUmcufrvA3kb445UEJ2jsWiD4EvFuu4cNgZhCiZKD/XdyFK:uiBIGkbxqEcjsWiDxguehC2SV
Malware Config
Extracted
darkcomet
Guest16
127.0.0.1:1604
DC_MUTEX-TX8PZLM
-
InstallPath
MSDCSC\explorer.exe
-
gencode
CKTbkZPpFBmx
-
install
true
-
offline_keylogger
true
-
password
18082004
-
persistence
true
-
reg_key
AudioDriver
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Desktop\\MSDCSC\\explorer.exe" 5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" explorer.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 2512 attrib.exe 2884 attrib.exe -
Deletes itself 1 IoCs
Processes:
notepad.exepid process 2868 notepad.exe -
Executes dropped EXE 1 IoCs
Processes:
explorer.exepid process 2624 explorer.exe -
Loads dropped DLL 2 IoCs
Processes:
5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exepid process 1612 5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe 1612 5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exeexplorer.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\AudioDriver = "C:\\Users\\Admin\\Desktop\\MSDCSC\\explorer.exe" 5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\AudioDriver = "C:\\Users\\Admin\\Desktop\\MSDCSC\\explorer.exe" explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 2624 explorer.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exeexplorer.exedescription pid process Token: SeIncreaseQuotaPrivilege 1612 5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe Token: SeSecurityPrivilege 1612 5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 1612 5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe Token: SeLoadDriverPrivilege 1612 5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe Token: SeSystemProfilePrivilege 1612 5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe Token: SeSystemtimePrivilege 1612 5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 1612 5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1612 5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 1612 5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe Token: SeBackupPrivilege 1612 5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe Token: SeRestorePrivilege 1612 5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe Token: SeShutdownPrivilege 1612 5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe Token: SeDebugPrivilege 1612 5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 1612 5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 1612 5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 1612 5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe Token: SeUndockPrivilege 1612 5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe Token: SeManageVolumePrivilege 1612 5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe Token: SeImpersonatePrivilege 1612 5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 1612 5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe Token: 33 1612 5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe Token: 34 1612 5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe Token: 35 1612 5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 2624 explorer.exe Token: SeSecurityPrivilege 2624 explorer.exe Token: SeTakeOwnershipPrivilege 2624 explorer.exe Token: SeLoadDriverPrivilege 2624 explorer.exe Token: SeSystemProfilePrivilege 2624 explorer.exe Token: SeSystemtimePrivilege 2624 explorer.exe Token: SeProfSingleProcessPrivilege 2624 explorer.exe Token: SeIncBasePriorityPrivilege 2624 explorer.exe Token: SeCreatePagefilePrivilege 2624 explorer.exe Token: SeBackupPrivilege 2624 explorer.exe Token: SeRestorePrivilege 2624 explorer.exe Token: SeShutdownPrivilege 2624 explorer.exe Token: SeDebugPrivilege 2624 explorer.exe Token: SeSystemEnvironmentPrivilege 2624 explorer.exe Token: SeChangeNotifyPrivilege 2624 explorer.exe Token: SeRemoteShutdownPrivilege 2624 explorer.exe Token: SeUndockPrivilege 2624 explorer.exe Token: SeManageVolumePrivilege 2624 explorer.exe Token: SeImpersonatePrivilege 2624 explorer.exe Token: SeCreateGlobalPrivilege 2624 explorer.exe Token: 33 2624 explorer.exe Token: 34 2624 explorer.exe Token: 35 2624 explorer.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
explorer.exepid process 2624 explorer.exe -
Suspicious use of WriteProcessMemory 61 IoCs
Processes:
5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.execmd.execmd.exeexplorer.exedescription pid process target process PID 1612 wrote to memory of 3020 1612 5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe cmd.exe PID 1612 wrote to memory of 3020 1612 5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe cmd.exe PID 1612 wrote to memory of 3020 1612 5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe cmd.exe PID 1612 wrote to memory of 3020 1612 5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe cmd.exe PID 1612 wrote to memory of 2916 1612 5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe cmd.exe PID 1612 wrote to memory of 2916 1612 5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe cmd.exe PID 1612 wrote to memory of 2916 1612 5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe cmd.exe PID 1612 wrote to memory of 2916 1612 5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe cmd.exe PID 1612 wrote to memory of 2868 1612 5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe notepad.exe PID 1612 wrote to memory of 2868 1612 5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe notepad.exe PID 1612 wrote to memory of 2868 1612 5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe notepad.exe PID 1612 wrote to memory of 2868 1612 5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe notepad.exe PID 1612 wrote to memory of 2868 1612 5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe notepad.exe PID 1612 wrote to memory of 2868 1612 5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe notepad.exe PID 1612 wrote to memory of 2868 1612 5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe notepad.exe PID 1612 wrote to memory of 2868 1612 5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe notepad.exe PID 1612 wrote to memory of 2868 1612 5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe notepad.exe PID 1612 wrote to memory of 2868 1612 5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe notepad.exe PID 1612 wrote to memory of 2868 1612 5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe notepad.exe PID 1612 wrote to memory of 2868 1612 5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe notepad.exe PID 1612 wrote to memory of 2868 1612 5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe notepad.exe PID 1612 wrote to memory of 2868 1612 5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe notepad.exe PID 1612 wrote to memory of 2868 1612 5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe notepad.exe PID 1612 wrote to memory of 2868 1612 5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe notepad.exe PID 1612 wrote to memory of 2868 1612 5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe notepad.exe PID 1612 wrote to memory of 2868 1612 5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe notepad.exe PID 3020 wrote to memory of 2884 3020 cmd.exe attrib.exe PID 3020 wrote to memory of 2884 3020 cmd.exe attrib.exe PID 3020 wrote to memory of 2884 3020 cmd.exe attrib.exe PID 3020 wrote to memory of 2884 3020 cmd.exe attrib.exe PID 2916 wrote to memory of 2512 2916 cmd.exe attrib.exe PID 2916 wrote to memory of 2512 2916 cmd.exe attrib.exe PID 2916 wrote to memory of 2512 2916 cmd.exe attrib.exe PID 2916 wrote to memory of 2512 2916 cmd.exe attrib.exe PID 1612 wrote to memory of 2624 1612 5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe explorer.exe PID 1612 wrote to memory of 2624 1612 5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe explorer.exe PID 1612 wrote to memory of 2624 1612 5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe explorer.exe PID 1612 wrote to memory of 2624 1612 5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe explorer.exe PID 2624 wrote to memory of 2404 2624 explorer.exe notepad.exe PID 2624 wrote to memory of 2404 2624 explorer.exe notepad.exe PID 2624 wrote to memory of 2404 2624 explorer.exe notepad.exe PID 2624 wrote to memory of 2404 2624 explorer.exe notepad.exe PID 2624 wrote to memory of 2404 2624 explorer.exe notepad.exe PID 2624 wrote to memory of 2404 2624 explorer.exe notepad.exe PID 2624 wrote to memory of 2404 2624 explorer.exe notepad.exe PID 2624 wrote to memory of 2404 2624 explorer.exe notepad.exe PID 2624 wrote to memory of 2404 2624 explorer.exe notepad.exe PID 2624 wrote to memory of 2404 2624 explorer.exe notepad.exe PID 2624 wrote to memory of 2404 2624 explorer.exe notepad.exe PID 2624 wrote to memory of 2404 2624 explorer.exe notepad.exe PID 2624 wrote to memory of 2404 2624 explorer.exe notepad.exe PID 2624 wrote to memory of 2404 2624 explorer.exe notepad.exe PID 2624 wrote to memory of 2404 2624 explorer.exe notepad.exe PID 2624 wrote to memory of 2404 2624 explorer.exe notepad.exe PID 2624 wrote to memory of 2404 2624 explorer.exe notepad.exe PID 2624 wrote to memory of 2404 2624 explorer.exe notepad.exe PID 2624 wrote to memory of 2404 2624 explorer.exe notepad.exe PID 2624 wrote to memory of 2404 2624 explorer.exe notepad.exe PID 2624 wrote to memory of 2404 2624 explorer.exe notepad.exe PID 2624 wrote to memory of 2404 2624 explorer.exe notepad.exe PID 2624 wrote to memory of 2404 2624 explorer.exe notepad.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 2512 attrib.exe 2884 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\5eeb8b4e21e59894b65a6eb02266734f_JaffaCakes118.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Deletes itself
-
C:\Users\Admin\Desktop\MSDCSC\explorer.exe"C:\Users\Admin\Desktop\MSDCSC\explorer.exe"2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\Desktop\MSDCSC\explorer.exeFilesize
659KB
MD55eeb8b4e21e59894b65a6eb02266734f
SHA1a76a1311b98e655b139bc934483ed6687f0be551
SHA25689d4174111f2938051d86672b40965bedbee157227ccccc41ab937a32146de7d
SHA512fd921d9a296116ebf31d649a823394e33d82b282fa57a0a9fc5a446ac2ddb17eaa51d260d89e8b4688e2990846f7d46efc90d5f9120f749de5ce7cfe4dd081a9
-
memory/1612-0-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/1612-67-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2404-66-0x0000000000210000-0x0000000000211000-memory.dmpFilesize
4KB
-
memory/2624-69-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2624-71-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2624-72-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2624-73-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2624-75-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2868-4-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB
-
memory/2868-18-0x0000000000180000-0x0000000000181000-memory.dmpFilesize
4KB