Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
26-06-2024 21:59
Static task
static1
Behavioral task
behavioral1
Sample
139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe
Resource
win7-20240611-en
General
-
Target
139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe
-
Size
1.1MB
-
MD5
139c407f18afa076d2b84d9e9a976dde
-
SHA1
2f52a86e60931efd85b1297d485d024fb705e887
-
SHA256
8383502063bfc21e46558865c747ef9ca8023b46732c1cef09467e51c60331cb
-
SHA512
b86e131e17bb7ac254dc8cf8c877e7c6bf90dd50b267818b08b2df93503816663ca9caa0cc18044b2057ad09651771c133459e1512713db18db59bdafbb792d9
-
SSDEEP
24576:3Pns0XeQ2sPtysnGgeFC9A9fCG5qigd512vwyMR:fs0XeD2vTcCmqEJgdawj
Malware Config
Extracted
darkcomet
ÓÇã
nnns.zapto.org:1604
DC_MUTEX-F54S21D
-
gencode
pZ2PbkJ4J7qu
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Drops file in Drivers directory 1 IoCs
Processes:
139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exedescription pid process target process PID 4456 set thread context of 4868 4456 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exedescription pid process Token: SeIncreaseQuotaPrivilege 4868 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe Token: SeSecurityPrivilege 4868 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 4868 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe Token: SeLoadDriverPrivilege 4868 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe Token: SeSystemProfilePrivilege 4868 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe Token: SeSystemtimePrivilege 4868 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 4868 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4868 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 4868 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe Token: SeBackupPrivilege 4868 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe Token: SeRestorePrivilege 4868 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe Token: SeShutdownPrivilege 4868 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe Token: SeDebugPrivilege 4868 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 4868 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 4868 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 4868 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe Token: SeUndockPrivilege 4868 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe Token: SeManageVolumePrivilege 4868 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe Token: SeImpersonatePrivilege 4868 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 4868 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe Token: 33 4868 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe Token: 34 4868 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe Token: 35 4868 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe Token: 36 4868 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exepid process 4456 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe 4868 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exedescription pid process target process PID 4456 wrote to memory of 4868 4456 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe PID 4456 wrote to memory of 4868 4456 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe PID 4456 wrote to memory of 4868 4456 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe PID 4456 wrote to memory of 4868 4456 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe PID 4456 wrote to memory of 4868 4456 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe PID 4456 wrote to memory of 4868 4456 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe PID 4456 wrote to memory of 4868 4456 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe PID 4456 wrote to memory of 4868 4456 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe PID 4456 wrote to memory of 4868 4456 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe PID 4456 wrote to memory of 4868 4456 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe PID 4456 wrote to memory of 4868 4456 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe PID 4456 wrote to memory of 4868 4456 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe PID 4456 wrote to memory of 4868 4456 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe PID 4456 wrote to memory of 4868 4456 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe 139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\139c407f18afa076d2b84d9e9a976dde_JaffaCakes118.exe"2⤵
- Drops file in Drivers directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4868