Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system - submitted
17/07/2024, 18:39
Behavioral task
behavioral1
Sample
5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
8 signatures
150 seconds
General
- Target 5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe
- Size 660KB
- Sample240717-xa3cdsxare
- SHA256 6aa603b64f53e40c712fe600f0d8adef2a8e167fb05d0d29809ab81063533045
- MD5 5447d2affe40571408dca9a3d073805a
- SHA1 f1606af2dcf3fb425158637aadd5abc902546009
- SHA512 7964bffd70a0eaa10713b18af9ebd8ad20b1c5ac8d6b6e0f75c45d3a33ca1372a9aeb8e2fb7b02fa202c7f1729b5fe17f37e404e5405febc9fc1ff79b2339308
- SSDEEP 12288:MXhpvNWw276S/DuoeFcfbmiJ99VPhYR5MTSHvLenELrWv1lZw4JuMkMh/fy452U4:anAw2WWeFcfbP9VPSPMTSPL/rWvzq4Jo
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
darkcomet
Botnet
-
Huila12
C2
-
127.0.0.1:1604
-
192.168.10.101:1604
-
213.168.31.153:1604
-
abaregen.zapto.org:1604
Mutex
-
DC_MUTEX-H2JX34G
Attributes
-
gencode
peCyx2rXtJg9
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
- Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 3400 attrib.exe 416 attrib.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-464762018-485119342-1613148473-1000\Control Panel\International\Geo\Nation 5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1956 5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe - Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1956 5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe Token: SeSecurityPrivilege 1956 5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 1956 5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe Token: SeLoadDriverPrivilege 1956 5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe Token: SeSystemProfilePrivilege 1956 5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe Token: SeSystemtimePrivilege 1956 5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 1956 5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1956 5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 1956 5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe Token: SeBackupPrivilege 1956 5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe Token: SeRestorePrivilege 1956 5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe Token: SeShutdownPrivilege 1956 5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe Token: SeDebugPrivilege 1956 5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 1956 5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 1956 5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 1956 5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe Token: SeUndockPrivilege 1956 5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe Token: SeManageVolumePrivilege 1956 5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe Token: SeImpersonatePrivilege 1956 5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 1956 5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe Token: 33 1956 5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe Token: 34 1956 5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe Token: 35 1956 5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe Token: 36 1956 5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1956 5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe - Suspicious use of WriteProcessMemory 34 IoCs
description pid Process procid_target PID 1956 wrote to memory of 3952 1956 5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe 92 PID 1956 wrote to memory of 3952 1956 5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe 92 PID 1956 wrote to memory of 3952 1956 5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe 92 PID 1956 wrote to memory of 4636 1956 5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe 94 PID 1956 wrote to memory of 4636 1956 5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe 94 PID 1956 wrote to memory of 4636 1956 5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe 94 PID 1956 wrote to memory of 608 1956 5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe 95 PID 1956 wrote to memory of 608 1956 5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe 95 PID 1956 wrote to memory of 608 1956 5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe 95 PID 1956 wrote to memory of 608 1956 5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe 95 PID 1956 wrote to memory of 608 1956 5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe 95 PID 1956 wrote to memory of 608 1956 5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe 95 PID 1956 wrote to memory of 608 1956 5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe 95 PID 1956 wrote to memory of 608 1956 5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe 95 PID 1956 wrote to memory of 608 1956 5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe 95 PID 1956 wrote to memory of 608 1956 5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe 95 PID 1956 wrote to memory of 608 1956 5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe 95 PID 1956 wrote to memory of 608 1956 5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe 95 PID 1956 wrote to memory of 608 1956 5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe 95 PID 1956 wrote to memory of 608 1956 5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe 95 PID 1956 wrote to memory of 608 1956 5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe 95 PID 1956 wrote to memory of 608 1956 5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe 95 PID 1956 wrote to memory of 608 1956 5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe 95 PID 1956 wrote to memory of 608 1956 5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe 95 PID 1956 wrote to memory of 608 1956 5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe 95 PID 1956 wrote to memory of 608 1956 5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe 95 PID 1956 wrote to memory of 608 1956 5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe 95 PID 1956 wrote to memory of 608 1956 5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe 95 PID 3952 wrote to memory of 3400 3952 cmd.exe 97 PID 3952 wrote to memory of 3400 3952 cmd.exe 97 PID 3952 wrote to memory of 3400 3952 cmd.exe 97 PID 4636 wrote to memory of 416 4636 cmd.exe 98 PID 4636 wrote to memory of 416 4636 cmd.exe 98 PID 4636 wrote to memory of 416 4636 cmd.exe 98 - Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 3400 attrib.exe 416 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\5447d2affe40571408dca9a3d073805a_JaffaCakes118.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:3400
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:416
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵PID:608
-