Analysis
-
max time kernel
135s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 12:05
Static task
static1
Behavioral task
behavioral1
Sample
6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe
Resource
win10v2004-20240426-en
General
-
Target
6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe
-
Size
853KB
-
MD5
6734ed528fd08246dab1055ce7a124de
-
SHA1
44bcb8e21ea74f5bac9f20daf4772650b4277a6c
-
SHA256
20fc91290817d8b9208794e5464bb084d9a63fa96af2e674582a19d3af9d182f
-
SHA512
943a05779fc0e9da69a8c2df34ef19c6128a844f7ce1b166515fa0e5416c4c5af7f5928f8cf5d1032f483d3382a350809fda455ee3b90510a5b465a7f7d7b50c
-
SSDEEP
12288:vFRJLb3xdzXFMUO+iEs7sBS+jYr9WZm9++vufVZMIzUBlcYvmIAA5zVZ/7:TdPOPAs9596fVBzUBlvezAFnD
Malware Config
Extracted
darkcomet
Guest16
raptorsdc.duckdns.org:999
DC_MUTEX-5WV0Z3A
-
InstallPath
CCC.exe
-
gencode
4nktTL2MmcBp
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
Video Card Control Center
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\CCC.exe" 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe -
Executes dropped EXE 4 IoCs
Processes:
CCC.exeCCC.exeCCC.exeCCC.exepid process 3736 CCC.exe 4748 CCC.exe 1772 CCC.exe 1008 CCC.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Video Card Control Center = "C:\\Windows\\system32\\CCC.exe" 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe -
Drops file in System32 directory 3 IoCs
Processes:
6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exedescription ioc process File created C:\Windows\SysWOW64\CCC.exe 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\CCC.exe 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\ 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exeCCC.exedescription pid process target process PID 404 set thread context of 2272 404 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe PID 3736 set thread context of 1008 3736 CCC.exe CCC.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
CCC.exepid process 3736 CCC.exe 3736 CCC.exe 3736 CCC.exe 3736 CCC.exe -
Suspicious use of AdjustPrivilegeToken 50 IoCs
Processes:
6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exeCCC.exeCCC.exedescription pid process Token: SeDebugPrivilege 404 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 2272 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe Token: SeSecurityPrivilege 2272 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2272 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe Token: SeLoadDriverPrivilege 2272 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe Token: SeSystemProfilePrivilege 2272 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe Token: SeSystemtimePrivilege 2272 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 2272 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2272 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 2272 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe Token: SeBackupPrivilege 2272 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe Token: SeRestorePrivilege 2272 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe Token: SeShutdownPrivilege 2272 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe Token: SeDebugPrivilege 2272 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 2272 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 2272 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 2272 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe Token: SeUndockPrivilege 2272 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe Token: SeManageVolumePrivilege 2272 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe Token: SeImpersonatePrivilege 2272 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 2272 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe Token: 33 2272 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe Token: 34 2272 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe Token: 35 2272 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe Token: 36 2272 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe Token: SeDebugPrivilege 3736 CCC.exe Token: SeIncreaseQuotaPrivilege 1008 CCC.exe Token: SeSecurityPrivilege 1008 CCC.exe Token: SeTakeOwnershipPrivilege 1008 CCC.exe Token: SeLoadDriverPrivilege 1008 CCC.exe Token: SeSystemProfilePrivilege 1008 CCC.exe Token: SeSystemtimePrivilege 1008 CCC.exe Token: SeProfSingleProcessPrivilege 1008 CCC.exe Token: SeIncBasePriorityPrivilege 1008 CCC.exe Token: SeCreatePagefilePrivilege 1008 CCC.exe Token: SeBackupPrivilege 1008 CCC.exe Token: SeRestorePrivilege 1008 CCC.exe Token: SeShutdownPrivilege 1008 CCC.exe Token: SeDebugPrivilege 1008 CCC.exe Token: SeSystemEnvironmentPrivilege 1008 CCC.exe Token: SeChangeNotifyPrivilege 1008 CCC.exe Token: SeRemoteShutdownPrivilege 1008 CCC.exe Token: SeUndockPrivilege 1008 CCC.exe Token: SeManageVolumePrivilege 1008 CCC.exe Token: SeImpersonatePrivilege 1008 CCC.exe Token: SeCreateGlobalPrivilege 1008 CCC.exe Token: 33 1008 CCC.exe Token: 34 1008 CCC.exe Token: 35 1008 CCC.exe Token: 36 1008 CCC.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
CCC.exepid process 1008 CCC.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exeCCC.exedescription pid process target process PID 404 wrote to memory of 2272 404 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe PID 404 wrote to memory of 2272 404 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe PID 404 wrote to memory of 2272 404 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe PID 404 wrote to memory of 2272 404 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe PID 404 wrote to memory of 2272 404 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe PID 404 wrote to memory of 2272 404 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe PID 404 wrote to memory of 2272 404 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe PID 404 wrote to memory of 2272 404 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe PID 404 wrote to memory of 2272 404 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe PID 404 wrote to memory of 2272 404 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe PID 404 wrote to memory of 2272 404 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe PID 404 wrote to memory of 2272 404 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe PID 2272 wrote to memory of 3736 2272 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe CCC.exe PID 2272 wrote to memory of 3736 2272 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe CCC.exe PID 2272 wrote to memory of 3736 2272 6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe CCC.exe PID 3736 wrote to memory of 4748 3736 CCC.exe CCC.exe PID 3736 wrote to memory of 4748 3736 CCC.exe CCC.exe PID 3736 wrote to memory of 4748 3736 CCC.exe CCC.exe PID 3736 wrote to memory of 1772 3736 CCC.exe CCC.exe PID 3736 wrote to memory of 1772 3736 CCC.exe CCC.exe PID 3736 wrote to memory of 1772 3736 CCC.exe CCC.exe PID 3736 wrote to memory of 1008 3736 CCC.exe CCC.exe PID 3736 wrote to memory of 1008 3736 CCC.exe CCC.exe PID 3736 wrote to memory of 1008 3736 CCC.exe CCC.exe PID 3736 wrote to memory of 1008 3736 CCC.exe CCC.exe PID 3736 wrote to memory of 1008 3736 CCC.exe CCC.exe PID 3736 wrote to memory of 1008 3736 CCC.exe CCC.exe PID 3736 wrote to memory of 1008 3736 CCC.exe CCC.exe PID 3736 wrote to memory of 1008 3736 CCC.exe CCC.exe PID 3736 wrote to memory of 1008 3736 CCC.exe CCC.exe PID 3736 wrote to memory of 1008 3736 CCC.exe CCC.exe PID 3736 wrote to memory of 1008 3736 CCC.exe CCC.exe PID 3736 wrote to memory of 1008 3736 CCC.exe CCC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6734ed528fd08246dab1055ce7a124de_JaffaCakes118.exe"2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\CCC.exe"C:\Windows\system32\CCC.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\CCC.exe"C:\Windows\SysWOW64\CCC.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\CCC.exe"C:\Windows\SysWOW64\CCC.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\CCC.exe"C:\Windows\SysWOW64\CCC.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\CCC.exeFilesize
853KB
MD56734ed528fd08246dab1055ce7a124de
SHA144bcb8e21ea74f5bac9f20daf4772650b4277a6c
SHA25620fc91290817d8b9208794e5464bb084d9a63fa96af2e674582a19d3af9d182f
SHA512943a05779fc0e9da69a8c2df34ef19c6128a844f7ce1b166515fa0e5416c4c5af7f5928f8cf5d1032f483d3382a350809fda455ee3b90510a5b465a7f7d7b50c
-
memory/404-16-0x0000000074B10000-0x00000000750C1000-memory.dmpFilesize
5.7MB
-
memory/404-1-0x0000000074B10000-0x00000000750C1000-memory.dmpFilesize
5.7MB
-
memory/404-2-0x0000000074B10000-0x00000000750C1000-memory.dmpFilesize
5.7MB
-
memory/404-0-0x0000000074B12000-0x0000000074B13000-memory.dmpFilesize
4KB
-
memory/1008-57-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1008-48-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1008-67-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1008-66-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1008-65-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1008-64-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1008-63-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1008-62-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1008-37-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1008-39-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1008-38-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1008-61-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1008-60-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1008-42-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1008-43-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1008-44-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1008-45-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1008-46-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1008-47-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1008-59-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1008-49-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1008-50-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1008-51-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1008-52-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1008-53-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1008-54-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1008-55-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1008-56-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1008-58-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2272-7-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2272-12-0x0000000001510000-0x0000000001511000-memory.dmpFilesize
4KB
-
memory/2272-41-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2272-8-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2272-10-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2272-11-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/3736-40-0x0000000073DC0000-0x0000000074371000-memory.dmpFilesize
5.7MB
-
memory/3736-29-0x0000000073DC0000-0x0000000074371000-memory.dmpFilesize
5.7MB
-
memory/3736-28-0x0000000073DC0000-0x0000000074371000-memory.dmpFilesize
5.7MB
-
memory/3736-27-0x0000000073DC2000-0x0000000073DC3000-memory.dmpFilesize
4KB