Analysis

  • max time kernel
    146s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-07-2024 02:59

General

  • Target

    5a33e9b9c627ea6bce5e8d0ca829176e_JaffaCakes118.exe

  • Size

    3.9MB

  • MD5

    5a33e9b9c627ea6bce5e8d0ca829176e

  • SHA1

    013051e396b1a1e785d22e5527efdee96e60b05d

  • SHA256

    6064b9d452f32cf09e464f17381b9f04fe929c8ed35f43772def8556eadec550

  • SHA512

    982ee4b6a05f2a9c38d4722c5eba5fb14260dd3bcd7f6626a050c2a9fd48f10c693901e8c021bc12367ef60f8ad4899e4fb3f10d7f2aa5706d1e822b0ee79576

  • SSDEEP

    98304:DkwBHjSM12JtDpJX2c+4uXzwcMSdT23sEeKGSxzEceeVTUg:DkbM12JVrXL+4umSV23+WIgVTUg

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • DCRat payload 2 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\5a33e9b9c627ea6bce5e8d0ca829176e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\5a33e9b9c627ea6bce5e8d0ca829176e_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:548
    • C:\Users\Admin\AppData\Local\Temp\skinchanger_csgo_08.02.2021.exe
      "C:\Users\Admin\AppData\Local\Temp\skinchanger_csgo_08.02.2021.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4856
      • C:\Program Files\Java\jre-1.8\bin\javaw.exe
        "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -Xms64m -Xmx128m -jar "C:\Users\Admin\AppData\Local\Temp\skinchanger_csgo_08.02.2021.exe"
        3⤵
        • Suspicious use of SetWindowsHookEx
        PID:5032
    • C:\Users\Admin\AppData\Local\Temp\DCrmiZ.exe
      "C:\Users\Admin\AppData\Local\Temp\DCrmiZ.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:4136
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\dhcpbroker\LboxPbvRMQFdTG327MfoAXtGOluFbW.vbe"
        3⤵
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:3600
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\dhcpbroker\KTNvVUs7rCbjeE6SfbcNAGzeGA6bfl.bat" "
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4616
          • C:\dhcpbroker\intocrt.exe
            "C:\dhcpbroker\intocrt.exe"
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3048
            • C:\Windows\SYSTEM32\schtasks.exe
              "schtasks" /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\Vss\Writers\Application\Idle.exe'" /rl HIGHEST /f
              6⤵
              • Scheduled Task/Job: Scheduled Task
              PID:4448
            • C:\Windows\SYSTEM32\schtasks.exe
              "schtasks" /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Documents and Settings\RuntimeBroker.exe'" /rl HIGHEST /f
              6⤵
              • Scheduled Task/Job: Scheduled Task
              PID:4060
            • C:\Windows\SYSTEM32\schtasks.exe
              "schtasks" /create /tn "intocrt" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\intocrt.exe'" /rl HIGHEST /f
              6⤵
              • Scheduled Task/Job: Scheduled Task
              PID:3336
            • C:\Windows\SYSTEM32\schtasks.exe
              "schtasks" /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\ProgramData\Oracle\Java\.oracle_jre_usage\WaaSMedicAgent.exe'" /rl HIGHEST /f
              6⤵
              • Scheduled Task/Job: Scheduled Task
              PID:536
            • C:\ProgramData\Oracle\Java\.oracle_jre_usage\WaaSMedicAgent.exe
              "C:\ProgramData\Oracle\Java\.oracle_jre_usage\WaaSMedicAgent.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4148

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\DCrmiZ.exe

    Filesize

    444KB

    MD5

    38e6a371b9b49ac702d736ce075720cf

    SHA1

    fc45fe7359a82b3dac083d7e7db8a81f8d4f3d43

    SHA256

    a043fa5ebafa40a931a1efcb3addf8e9a6e15c964d5fb3621a19640305e46e9c

    SHA512

    f4f37c236059ca103177a7afc896a9753a416d0cf9b1f47874aa25a2beafbf7a2b359091cac29fa33588532f2ca809b8d1c78ce6532cf7516ad23501520d0fd4

  • C:\Users\Admin\AppData\Local\Temp\skinchanger_csgo_08.02.2021.exe

    Filesize

    4.0MB

    MD5

    d1f66e48b6142bc32afbb7c3643f95cf

    SHA1

    d25c69dfb6636dec0b3785e976d95abee5dbd75d

    SHA256

    f30235dde35a1e71d2885f6f84adaa6a16214692e984211c64d1ad7b5adc10a8

    SHA512

    9a2be6d06914c9f02f40581e65246ea80dbacbafca8bc9343bf5c09f5544c1024d39a3af91ff0cad898d0217b0fdf993fa25db1e781a0a05aa1f469791552b17

  • C:\dhcpbroker\KTNvVUs7rCbjeE6SfbcNAGzeGA6bfl.bat

    Filesize

    27B

    MD5

    b6d7b2fd5e3c8f474280e1ba4204842e

    SHA1

    2d4a6cf418bbbaaa62b1e1aaa83a093046a925cb

    SHA256

    f26d4068d07f5b1b1f49c33611cbc27a7faba8936e71b6c90911e160d5489c11

    SHA512

    e3cbd02b67d6de805e3083492fbf4339537b9f164f10bbfea24b29f2e527eb486992d56f53d111dc07f9ac68f343b90617f985d3462b4845511cab1f9fc1131e

  • C:\dhcpbroker\LboxPbvRMQFdTG327MfoAXtGOluFbW.vbe

    Filesize

    222B

    MD5

    08dc32b1d4cdcf5a2f704fc5ceabe2b7

    SHA1

    d166caaed25c6f0660bcadb4d914d2ca37338bd3

    SHA256

    afded55b6d7bd3c7971283d1483a1f678f9898744ce8de8d2e2338a52042cf9d

    SHA512

    8f5588dc392d9b23a7306a8196727364ddcece8f8df6ebf77a3230796119f0be4957d724936f589ec95a41e2ce5c3f596d6191bcac1c7ac84e3afa5b6aca5051

  • C:\dhcpbroker\intocrt.exe

    Filesize

    444KB

    MD5

    be47c79de361e8b5c036c6a025c5244b

    SHA1

    d68fa5f0de905e6ec474e7232da445bcdefc7c2c

    SHA256

    7775fde3daf8cf53361e33c23addc126dc1f3e9ddd9c4cf587a0e755e680086c

    SHA512

    aead9390e3ed14315cbd5d27022f3c4f9a396da3a1547db598f6258f62377c5836bb0f93d970c25a075950904732f753797856981baf52cf901e4c26c8c9afcf

  • memory/548-1-0x00007FF8B5743000-0x00007FF8B5745000-memory.dmp

    Filesize

    8KB

  • memory/548-4-0x00007FF8B5740000-0x00007FF8B6201000-memory.dmp

    Filesize

    10.8MB

  • memory/548-0-0x0000000000670000-0x0000000000A68000-memory.dmp

    Filesize

    4.0MB

  • memory/548-22-0x00007FF8B5740000-0x00007FF8B6201000-memory.dmp

    Filesize

    10.8MB

  • memory/3048-204-0x0000013100670000-0x00000131006E6000-memory.dmp

    Filesize

    472KB

  • memory/4856-21-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/5032-82-0x0000026884490000-0x0000026884491000-memory.dmp

    Filesize

    4KB

  • memory/5032-89-0x0000026884490000-0x0000026884491000-memory.dmp

    Filesize

    4KB

  • memory/5032-101-0x0000026884490000-0x0000026884491000-memory.dmp

    Filesize

    4KB

  • memory/5032-122-0x0000026884490000-0x0000026884491000-memory.dmp

    Filesize

    4KB

  • memory/5032-61-0x0000026884490000-0x0000026884491000-memory.dmp

    Filesize

    4KB

  • memory/5032-43-0x0000026884490000-0x0000026884491000-memory.dmp

    Filesize

    4KB

  • memory/5032-26-0x0000026885DB0000-0x0000026886020000-memory.dmp

    Filesize

    2.4MB

  • memory/5032-290-0x0000026885DB0000-0x0000026886020000-memory.dmp

    Filesize

    2.4MB

  • memory/5032-318-0x0000026884490000-0x0000026884491000-memory.dmp

    Filesize

    4KB