Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 16:25
Behavioral task
behavioral1
Sample
67e0fbdcc5b4c67ea6020f2a9a3cd66b_JaffaCakes118.exe
Resource
win7-20240215-en
General
-
Target
67e0fbdcc5b4c67ea6020f2a9a3cd66b_JaffaCakes118.exe
-
Size
7.6MB
-
MD5
67e0fbdcc5b4c67ea6020f2a9a3cd66b
-
SHA1
3b62c037ad412deecf638812e66bbddfa05efa35
-
SHA256
61469ca57f2adc1298c401654f480d1a74216bf198fcc4083c4ecb4c915719a5
-
SHA512
abdd972d162d4fae5f1bbe7b8e46b6ad72c1481ec3c448c1a327971a96e87774d2461e4858d19c6874b53ef74bac431e2dd21f6c0d6691a67b0b4b84b6a807f6
-
SSDEEP
196608:rvJviy/wgWy5EIapA2yxr/229ivSZ1RCcMNcNLtQ89yCrvWF37aGb5:LJ5tFye2yt/2ai6Z12Cp23wWF37L
Malware Config
Extracted
darkcomet
Neo
neoxyne.myvnc.com:1995
DC_MUTEX-RVTKUEQ
-
InstallPath
Google\chromemsdcsc.exe
-
gencode
uiEb6MXxZaxa
-
install
true
-
offline_keylogger
true
-
password
neoxyne1995
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
BUILD.EXEdescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\Google\\chromemsdcsc.exe" BUILD.EXE -
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
chromemsdcsc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile chromemsdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" chromemsdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" chromemsdcsc.exe -
Modifies security service 2 TTPs 1 IoCs
Processes:
chromemsdcsc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" chromemsdcsc.exe -
Processes:
chromemsdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" chromemsdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" chromemsdcsc.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 2708 attrib.exe 2720 attrib.exe -
Executes dropped EXE 3 IoCs
Processes:
BUILD.EXEFC1.6.EXEchromemsdcsc.exepid process 1632 BUILD.EXE 2984 FC1.6.EXE 2312 chromemsdcsc.exe -
Loads dropped DLL 5 IoCs
Processes:
67e0fbdcc5b4c67ea6020f2a9a3cd66b_JaffaCakes118.exeBUILD.EXEpid process 1728 67e0fbdcc5b4c67ea6020f2a9a3cd66b_JaffaCakes118.exe 1728 67e0fbdcc5b4c67ea6020f2a9a3cd66b_JaffaCakes118.exe 1728 67e0fbdcc5b4c67ea6020f2a9a3cd66b_JaffaCakes118.exe 1632 BUILD.EXE 1632 BUILD.EXE -
Processes:
resource yara_rule behavioral1/memory/1728-0-0x0000000000140000-0x0000000000952000-memory.dmp upx \Users\Admin\AppData\Roaming\BUILD.EXE upx behavioral1/memory/1728-20-0x0000000000140000-0x0000000000952000-memory.dmp upx behavioral1/memory/1632-14-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2312-42-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1632-83-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2312-84-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2312-85-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2312-86-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2312-89-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2312-92-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2312-94-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Processes:
resource yara_rule \Users\Admin\AppData\Roaming\FC1.6.EXE vmprotect behavioral1/memory/2984-31-0x0000000000400000-0x0000000000BDA000-memory.dmp vmprotect -
Processes:
chromemsdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" chromemsdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" chromemsdcsc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
BUILD.EXEchromemsdcsc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\Google\\chromemsdcsc.exe" BUILD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\Google\\chromemsdcsc.exe" chromemsdcsc.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
FC1.6.EXEpid process 2984 FC1.6.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
FC1.6.EXEpid process 2984 FC1.6.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
chromemsdcsc.exepid process 2312 chromemsdcsc.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
BUILD.EXEchromemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 1632 BUILD.EXE Token: SeSecurityPrivilege 1632 BUILD.EXE Token: SeTakeOwnershipPrivilege 1632 BUILD.EXE Token: SeLoadDriverPrivilege 1632 BUILD.EXE Token: SeSystemProfilePrivilege 1632 BUILD.EXE Token: SeSystemtimePrivilege 1632 BUILD.EXE Token: SeProfSingleProcessPrivilege 1632 BUILD.EXE Token: SeIncBasePriorityPrivilege 1632 BUILD.EXE Token: SeCreatePagefilePrivilege 1632 BUILD.EXE Token: SeBackupPrivilege 1632 BUILD.EXE Token: SeRestorePrivilege 1632 BUILD.EXE Token: SeShutdownPrivilege 1632 BUILD.EXE Token: SeDebugPrivilege 1632 BUILD.EXE Token: SeSystemEnvironmentPrivilege 1632 BUILD.EXE Token: SeChangeNotifyPrivilege 1632 BUILD.EXE Token: SeRemoteShutdownPrivilege 1632 BUILD.EXE Token: SeUndockPrivilege 1632 BUILD.EXE Token: SeManageVolumePrivilege 1632 BUILD.EXE Token: SeImpersonatePrivilege 1632 BUILD.EXE Token: SeCreateGlobalPrivilege 1632 BUILD.EXE Token: 33 1632 BUILD.EXE Token: 34 1632 BUILD.EXE Token: 35 1632 BUILD.EXE Token: SeIncreaseQuotaPrivilege 2312 chromemsdcsc.exe Token: SeSecurityPrivilege 2312 chromemsdcsc.exe Token: SeTakeOwnershipPrivilege 2312 chromemsdcsc.exe Token: SeLoadDriverPrivilege 2312 chromemsdcsc.exe Token: SeSystemProfilePrivilege 2312 chromemsdcsc.exe Token: SeSystemtimePrivilege 2312 chromemsdcsc.exe Token: SeProfSingleProcessPrivilege 2312 chromemsdcsc.exe Token: SeIncBasePriorityPrivilege 2312 chromemsdcsc.exe Token: SeCreatePagefilePrivilege 2312 chromemsdcsc.exe Token: SeBackupPrivilege 2312 chromemsdcsc.exe Token: SeRestorePrivilege 2312 chromemsdcsc.exe Token: SeShutdownPrivilege 2312 chromemsdcsc.exe Token: SeDebugPrivilege 2312 chromemsdcsc.exe Token: SeSystemEnvironmentPrivilege 2312 chromemsdcsc.exe Token: SeChangeNotifyPrivilege 2312 chromemsdcsc.exe Token: SeRemoteShutdownPrivilege 2312 chromemsdcsc.exe Token: SeUndockPrivilege 2312 chromemsdcsc.exe Token: SeManageVolumePrivilege 2312 chromemsdcsc.exe Token: SeImpersonatePrivilege 2312 chromemsdcsc.exe Token: SeCreateGlobalPrivilege 2312 chromemsdcsc.exe Token: 33 2312 chromemsdcsc.exe Token: 34 2312 chromemsdcsc.exe Token: 35 2312 chromemsdcsc.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
FC1.6.EXEchromemsdcsc.exepid process 2984 FC1.6.EXE 2984 FC1.6.EXE 2312 chromemsdcsc.exe -
Suspicious use of WriteProcessMemory 59 IoCs
Processes:
67e0fbdcc5b4c67ea6020f2a9a3cd66b_JaffaCakes118.exeBUILD.EXEcmd.execmd.exechromemsdcsc.exedescription pid process target process PID 1728 wrote to memory of 1632 1728 67e0fbdcc5b4c67ea6020f2a9a3cd66b_JaffaCakes118.exe BUILD.EXE PID 1728 wrote to memory of 1632 1728 67e0fbdcc5b4c67ea6020f2a9a3cd66b_JaffaCakes118.exe BUILD.EXE PID 1728 wrote to memory of 1632 1728 67e0fbdcc5b4c67ea6020f2a9a3cd66b_JaffaCakes118.exe BUILD.EXE PID 1728 wrote to memory of 1632 1728 67e0fbdcc5b4c67ea6020f2a9a3cd66b_JaffaCakes118.exe BUILD.EXE PID 1728 wrote to memory of 2984 1728 67e0fbdcc5b4c67ea6020f2a9a3cd66b_JaffaCakes118.exe FC1.6.EXE PID 1728 wrote to memory of 2984 1728 67e0fbdcc5b4c67ea6020f2a9a3cd66b_JaffaCakes118.exe FC1.6.EXE PID 1728 wrote to memory of 2984 1728 67e0fbdcc5b4c67ea6020f2a9a3cd66b_JaffaCakes118.exe FC1.6.EXE PID 1728 wrote to memory of 2984 1728 67e0fbdcc5b4c67ea6020f2a9a3cd66b_JaffaCakes118.exe FC1.6.EXE PID 1632 wrote to memory of 2528 1632 BUILD.EXE cmd.exe PID 1632 wrote to memory of 2528 1632 BUILD.EXE cmd.exe PID 1632 wrote to memory of 2528 1632 BUILD.EXE cmd.exe PID 1632 wrote to memory of 2528 1632 BUILD.EXE cmd.exe PID 1632 wrote to memory of 1964 1632 BUILD.EXE cmd.exe PID 1632 wrote to memory of 1964 1632 BUILD.EXE cmd.exe PID 1632 wrote to memory of 1964 1632 BUILD.EXE cmd.exe PID 1632 wrote to memory of 1964 1632 BUILD.EXE cmd.exe PID 2528 wrote to memory of 2720 2528 cmd.exe attrib.exe PID 2528 wrote to memory of 2720 2528 cmd.exe attrib.exe PID 2528 wrote to memory of 2720 2528 cmd.exe attrib.exe PID 2528 wrote to memory of 2720 2528 cmd.exe attrib.exe PID 1964 wrote to memory of 2708 1964 cmd.exe attrib.exe PID 1964 wrote to memory of 2708 1964 cmd.exe attrib.exe PID 1964 wrote to memory of 2708 1964 cmd.exe attrib.exe PID 1964 wrote to memory of 2708 1964 cmd.exe attrib.exe PID 1632 wrote to memory of 2312 1632 BUILD.EXE chromemsdcsc.exe PID 1632 wrote to memory of 2312 1632 BUILD.EXE chromemsdcsc.exe PID 1632 wrote to memory of 2312 1632 BUILD.EXE chromemsdcsc.exe PID 1632 wrote to memory of 2312 1632 BUILD.EXE chromemsdcsc.exe PID 2312 wrote to memory of 2424 2312 chromemsdcsc.exe iexplore.exe PID 2312 wrote to memory of 2424 2312 chromemsdcsc.exe iexplore.exe PID 2312 wrote to memory of 2424 2312 chromemsdcsc.exe iexplore.exe PID 2312 wrote to memory of 2424 2312 chromemsdcsc.exe iexplore.exe PID 2312 wrote to memory of 2460 2312 chromemsdcsc.exe explorer.exe PID 2312 wrote to memory of 2460 2312 chromemsdcsc.exe explorer.exe PID 2312 wrote to memory of 2460 2312 chromemsdcsc.exe explorer.exe PID 2312 wrote to memory of 2460 2312 chromemsdcsc.exe explorer.exe PID 2312 wrote to memory of 2468 2312 chromemsdcsc.exe notepad.exe PID 2312 wrote to memory of 2468 2312 chromemsdcsc.exe notepad.exe PID 2312 wrote to memory of 2468 2312 chromemsdcsc.exe notepad.exe PID 2312 wrote to memory of 2468 2312 chromemsdcsc.exe notepad.exe PID 2312 wrote to memory of 2468 2312 chromemsdcsc.exe notepad.exe PID 2312 wrote to memory of 2468 2312 chromemsdcsc.exe notepad.exe PID 2312 wrote to memory of 2468 2312 chromemsdcsc.exe notepad.exe PID 2312 wrote to memory of 2468 2312 chromemsdcsc.exe notepad.exe PID 2312 wrote to memory of 2468 2312 chromemsdcsc.exe notepad.exe PID 2312 wrote to memory of 2468 2312 chromemsdcsc.exe notepad.exe PID 2312 wrote to memory of 2468 2312 chromemsdcsc.exe notepad.exe PID 2312 wrote to memory of 2468 2312 chromemsdcsc.exe notepad.exe PID 2312 wrote to memory of 2468 2312 chromemsdcsc.exe notepad.exe PID 2312 wrote to memory of 2468 2312 chromemsdcsc.exe notepad.exe PID 2312 wrote to memory of 2468 2312 chromemsdcsc.exe notepad.exe PID 2312 wrote to memory of 2468 2312 chromemsdcsc.exe notepad.exe PID 2312 wrote to memory of 2468 2312 chromemsdcsc.exe notepad.exe PID 2312 wrote to memory of 2468 2312 chromemsdcsc.exe notepad.exe PID 2312 wrote to memory of 2468 2312 chromemsdcsc.exe notepad.exe PID 2312 wrote to memory of 2468 2312 chromemsdcsc.exe notepad.exe PID 2312 wrote to memory of 2468 2312 chromemsdcsc.exe notepad.exe PID 2312 wrote to memory of 2468 2312 chromemsdcsc.exe notepad.exe PID 2312 wrote to memory of 2468 2312 chromemsdcsc.exe notepad.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
chromemsdcsc.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern chromemsdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" chromemsdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion chromemsdcsc.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 2720 attrib.exe 2708 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\67e0fbdcc5b4c67ea6020f2a9a3cd66b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\67e0fbdcc5b4c67ea6020f2a9a3cd66b_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\BUILD.EXE"C:\Users\Admin\AppData\Roaming\BUILD.EXE"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\BUILD.EXE" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Roaming\BUILD.EXE" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Roaming" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Roaming\Google\chromemsdcsc.exe"C:\Users\Admin\AppData\Roaming\Google\chromemsdcsc.exe"3⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"4⤵
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"4⤵
-
C:\Windows\SysWOW64\notepad.exenotepad4⤵
-
C:\Users\Admin\AppData\Roaming\FC1.6.EXE"C:\Users\Admin\AppData\Roaming\FC1.6.EXE"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Roaming\BUILD.EXEFilesize
252KB
MD56d659c12fafab6fa2d2a86284bcc6275
SHA1db2e30ccfa2b33ddb1642b6120c4b21f192602e0
SHA256ce9d70b2a5a070116ddf2e930015cde52d091590bddcfc5efe9901ae5fbf3082
SHA512c83c5c046fe6013803f08a34afe94fd2f65a050766524fd0eaab87cde338b7ba0eb22b4c7665630f518e3749946d374826d7610a3bb66e7cc23471014489e63b
-
\Users\Admin\AppData\Roaming\FC1.6.EXEFilesize
7.7MB
MD53d6ac1ce37bfa675bfbfb063b96ed3ba
SHA1fc3df919a2e336f3987358e63c0a696fbec3a70f
SHA25695fcb64d3e2e9dda7daf314639620de8acf81bd9dbb73f249db310f9573d82f8
SHA5125e2eab52c386a19fd786be9767d4a1fe69060837fefd956f4fc0a5b95c81aa4216d40abdd5902555e1a9c6903c26d5da66c074e8e683f1cbcb23ef0fa29bf1e7
-
memory/1632-14-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1632-21-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/1632-83-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1632-40-0x0000000004210000-0x00000000042C7000-memory.dmpFilesize
732KB
-
memory/1632-41-0x0000000004210000-0x00000000042C7000-memory.dmpFilesize
732KB
-
memory/1728-12-0x0000000003180000-0x0000000003237000-memory.dmpFilesize
732KB
-
memory/1728-11-0x0000000003180000-0x0000000003237000-memory.dmpFilesize
732KB
-
memory/1728-20-0x0000000000140000-0x0000000000952000-memory.dmpFilesize
8.1MB
-
memory/1728-0-0x0000000000140000-0x0000000000952000-memory.dmpFilesize
8.1MB
-
memory/2312-84-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/2312-42-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/2312-85-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/2312-86-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/2312-89-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/2312-92-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/2312-94-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/2468-44-0x00000000000B0000-0x00000000000B1000-memory.dmpFilesize
4KB
-
memory/2468-82-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/2984-26-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/2984-28-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/2984-31-0x0000000000400000-0x0000000000BDA000-memory.dmpFilesize
7.9MB
-
memory/2984-30-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB