Malware Analysis Report

2024-10-19 07:59

Sample ID 240627-cegw2azcnj
Target 144769859640eab70ec9ed969401e8e3_JaffaCakes118
SHA256 7a9776c90605606de12e06a0088cbf44c12e8be266c13c5894304eda81035711
Tags
darkcomet bootkit evasion persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

7a9776c90605606de12e06a0088cbf44c12e8be266c13c5894304eda81035711

Threat Level: Known bad

The file 144769859640eab70ec9ed969401e8e3_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

darkcomet bootkit evasion persistence rat trojan

Windows security bypass

Modifies security service

Darkcomet

Modifies WinLogon for persistence

Modifies firewall policy service

Disables RegEdit via registry modification

Disables Task Manager via registry modification

Executes dropped EXE

Checks BIOS information in registry

Identifies Wine through registry keys

Loads dropped DLL

Writes to the Master Boot Record (MBR)

Checks whether UAC is enabled

Adds Run key to start application

Suspicious use of SetThreadContext

Suspicious use of NtSetInformationThreadHideFromDebugger

Enumerates physical storage devices

Unsigned PE

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Enumerates system info in registry

Checks processor information in registry

Suspicious use of WriteProcessMemory

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-27 01:59

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-27 01:59

Reported

2024-06-27 02:01

Platform

win7-20240611-en

Max time kernel

150s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe"

Signatures

Darkcomet

trojan rat darkcomet

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\setup" C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe N/A

Modifies firewall policy service

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Windows\SysWOW64\explorer.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" C:\Windows\SysWOW64\explorer.exe N/A

Modifies security service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" C:\Windows\SysWOW64\explorer.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\SysWOW64\explorer.exe N/A

Disables RegEdit via registry modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" C:\Windows\SysWOW64\explorer.exe N/A

Disables Task Manager via registry modification

evasion

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Windows\SysWOW64\explorer.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\BROUF_POP.EXE N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\BROUF_POP.EXE N/A

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Wine C:\Windows\SysWOW64\explorer.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\setup.exe = "C:\\setup" C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\setup.exe = "C:\\setup" C:\Windows\SysWOW64\notepad.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PhysicalDrive0 C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe N/A
File opened for modification \??\PhysicalDrive0 C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2124 set thread context of 2480 N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\SysWOW64\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\SysWOW64\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\SysWOW64\explorer.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Windows\SysWOW64\explorer.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: 33 N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: 34 N/A C:\Windows\SysWOW64\explorer.exe N/A
Token: 35 N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2124 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe C:\Windows\SysWOW64\notepad.exe
PID 2124 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe C:\Windows\SysWOW64\notepad.exe
PID 2124 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe C:\Windows\SysWOW64\notepad.exe
PID 2124 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe C:\Windows\SysWOW64\notepad.exe
PID 2124 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe C:\Windows\SysWOW64\notepad.exe
PID 2124 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe C:\Windows\SysWOW64\notepad.exe
PID 2124 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe C:\Windows\SysWOW64\notepad.exe
PID 2124 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe C:\Windows\SysWOW64\notepad.exe
PID 2124 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe C:\Windows\SysWOW64\notepad.exe
PID 2124 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe C:\Windows\SysWOW64\notepad.exe
PID 2124 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe C:\Windows\SysWOW64\notepad.exe
PID 2124 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe C:\Windows\SysWOW64\notepad.exe
PID 2124 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe C:\Windows\SysWOW64\notepad.exe
PID 2124 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe C:\Windows\SysWOW64\notepad.exe
PID 2124 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe C:\Windows\SysWOW64\notepad.exe
PID 2124 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe C:\Windows\SysWOW64\notepad.exe
PID 2124 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe C:\Windows\SysWOW64\notepad.exe
PID 2124 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe C:\Windows\SysWOW64\notepad.exe
PID 2124 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe C:\Windows\SysWOW64\notepad.exe
PID 2124 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe C:\Windows\SysWOW64\notepad.exe
PID 2124 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe C:\Windows\SysWOW64\notepad.exe
PID 2124 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe C:\Windows\SysWOW64\notepad.exe
PID 2124 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe C:\Windows\SysWOW64\notepad.exe
PID 2124 wrote to memory of 2700 N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe C:\Windows\SysWOW64\notepad.exe
PID 2124 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\BROUF_POP.EXE
PID 2124 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\BROUF_POP.EXE
PID 2124 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\BROUF_POP.EXE
PID 2124 wrote to memory of 2540 N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\BROUF_POP.EXE
PID 2124 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 2124 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 2124 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 2124 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 2124 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 2124 wrote to memory of 2480 N/A C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe C:\Windows\SysWOW64\explorer.exe
PID 2480 wrote to memory of 1988 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 2480 wrote to memory of 1988 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 2480 wrote to memory of 1988 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 2480 wrote to memory of 1988 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 2480 wrote to memory of 1988 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 2480 wrote to memory of 1988 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 2480 wrote to memory of 1988 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 2480 wrote to memory of 1988 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 2480 wrote to memory of 1988 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 2480 wrote to memory of 1988 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 2480 wrote to memory of 1988 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 2480 wrote to memory of 1988 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 2480 wrote to memory of 1988 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 2480 wrote to memory of 1988 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 2480 wrote to memory of 1988 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 2480 wrote to memory of 1988 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 2480 wrote to memory of 1988 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 2480 wrote to memory of 1988 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 2480 wrote to memory of 1988 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 2480 wrote to memory of 1988 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 2480 wrote to memory of 1988 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 2480 wrote to memory of 1988 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 2480 wrote to memory of 1988 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\notepad.exe
PID 2480 wrote to memory of 1628 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\BROUF_POP.EXE
PID 2480 wrote to memory of 1628 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\BROUF_POP.EXE
PID 2480 wrote to memory of 1628 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\BROUF_POP.EXE
PID 2480 wrote to memory of 1628 N/A C:\Windows\SysWOW64\explorer.exe C:\Users\Admin\AppData\Local\Temp\BROUF_POP.EXE

Processes

C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe"

C:\Windows\SysWOW64\notepad.exe

notepad

C:\Users\Admin\AppData\Local\Temp\BROUF_POP.EXE

"C:\Users\Admin\AppData\Local\Temp\BROUF_POP.EXE"

C:\Windows\SysWOW64\explorer.exe

"C:\Windows\SysWOW64\explorer.exe"

C:\Windows\SysWOW64\notepad.exe

C:\Windows\SysWOW64\notepad.exe

C:\Users\Admin\AppData\Local\Temp\BROUF_POP.EXE

"C:\Users\Admin\AppData\Local\Temp\BROUF_POP.EXE"

Network

Country Destination Domain Proto
US 8.8.8.8:53 tamere.zapto.org udp

Files

memory/2124-0-0x0000000013140000-0x000000001340F000-memory.dmp

memory/2124-1-0x0000000013141000-0x000000001318D000-memory.dmp

memory/2124-2-0x0000000013140000-0x000000001340F000-memory.dmp

memory/2124-3-0x0000000013140000-0x000000001340F000-memory.dmp

memory/2124-6-0x0000000013140000-0x000000001340F000-memory.dmp

memory/2124-5-0x0000000013140000-0x000000001340F000-memory.dmp

memory/2700-35-0x0000000000230000-0x0000000000231000-memory.dmp

C:\setup

MD5 144769859640eab70ec9ed969401e8e3
SHA1 cb6603e8867a74d2d27059cdc47438cf2340920a
SHA256 7a9776c90605606de12e06a0088cbf44c12e8be266c13c5894304eda81035711
SHA512 9a9d4b67a04ef8a1cbea7bc2574dbc42db6e1460650b951a322d62e6e92c64b3ee6924ce0bec5664a4c4668224f62a5ca1d3ed81430a77d31e40fb56c7fdbbef

memory/2124-37-0x0000000013140000-0x000000001340F000-memory.dmp

memory/2700-7-0x0000000000080000-0x0000000000081000-memory.dmp

memory/2124-40-0x0000000013140000-0x000000001340F000-memory.dmp

\Users\Admin\AppData\Local\Temp\BROUF_POP.EXE

MD5 3bed4a376b5fce52fc08539e95ae369f
SHA1 feb471bdf3f78a2140fecfa474eda876e3f75e78
SHA256 7cb7d9efb92bfbb8aaee1df39c63a02092c6e6552bec1fd0cda3c68c3eb2d034
SHA512 e25578774eac1d88b883c32446096e7b882fcb4256b901ae8cba277a6f1ba948a311e61f64ee5d43661e72f72f5c96aacdc285176304df5a0867ea39669c62b7

C:\BsDD_tmp

MD5 d98926e26231d491cd5d40854453f3cf
SHA1 3a3a1d71b37b7c8b54a80a7917c12c63ba2480fd
SHA256 8f523b0f039109f042f5a0a807ae36a1cde13ee7a9512bb746e2c6e8bf90beab
SHA512 565e295523e06a56507ea6096d23f0ce2a00acd5c376b3badea4f6aa591991b5e21c831d45e24b33f34d4dcf7eaa5263077cf86f9d905952ff944aab6d11399a

memory/2480-61-0x0000000013140000-0x000000001340F000-memory.dmp

memory/2480-64-0x0000000013140000-0x000000001340F000-memory.dmp

memory/2480-69-0x0000000013140000-0x000000001340F000-memory.dmp

memory/2124-68-0x0000000013140000-0x000000001340F000-memory.dmp

memory/2480-67-0x0000000013140000-0x000000001340F000-memory.dmp

memory/2480-62-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2480-70-0x0000000013140000-0x000000001340F000-memory.dmp

memory/2480-71-0x0000000013140000-0x000000001340F000-memory.dmp

memory/2480-82-0x0000000013140000-0x000000001340F000-memory.dmp

memory/2480-85-0x0000000013140000-0x000000001340F000-memory.dmp

memory/2480-93-0x0000000013140000-0x000000001340F000-memory.dmp

memory/2480-92-0x0000000013140000-0x000000001340F000-memory.dmp

memory/2480-91-0x0000000013140000-0x000000001340F000-memory.dmp

memory/2480-90-0x0000000013140000-0x000000001340F000-memory.dmp

memory/2480-88-0x0000000013140000-0x000000001340F000-memory.dmp

memory/2480-87-0x0000000013140000-0x000000001340F000-memory.dmp

memory/2480-86-0x0000000013140000-0x000000001340F000-memory.dmp

memory/2480-84-0x0000000013140000-0x000000001340F000-memory.dmp

memory/2480-89-0x0000000013140000-0x000000001340F000-memory.dmp

memory/2480-83-0x0000000013140000-0x000000001340F000-memory.dmp

memory/2480-81-0x0000000013140000-0x000000001340F000-memory.dmp

memory/2480-80-0x0000000013140000-0x000000001340F000-memory.dmp

memory/2480-78-0x0000000013140000-0x000000001340F000-memory.dmp

memory/2480-77-0x0000000013140000-0x000000001340F000-memory.dmp

memory/2480-74-0x0000000013140000-0x000000001340F000-memory.dmp

memory/2480-73-0x0000000013140000-0x000000001340F000-memory.dmp

memory/2480-72-0x0000000013140000-0x000000001340F000-memory.dmp

memory/2480-79-0x0000000013140000-0x000000001340F000-memory.dmp

memory/2480-75-0x0000000013140000-0x000000001340F000-memory.dmp

memory/2480-76-0x0000000013140000-0x000000001340F000-memory.dmp

memory/2480-95-0x0000000013140000-0x000000001340F000-memory.dmp

memory/2480-96-0x0000000013140000-0x000000001340F000-memory.dmp

memory/2480-94-0x0000000013140000-0x000000001340F000-memory.dmp

memory/2480-158-0x0000000013140000-0x000000001340F000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-27 01:59

Reported

2024-06-27 02:01

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe"

Signatures

Identifies Wine through registry keys

evasion
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Wine C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 144.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 174.117.168.52.in-addr.arpa udp

Files

memory/1028-0-0x0000000013140000-0x000000001340F000-memory.dmp

memory/1028-1-0x0000000013140000-0x000000001340F000-memory.dmp