Malware Analysis Report

2025-04-13 23:11

Sample ID 240722-2fmw4ssblc
Target 650e8eebea969067fdde31da20d9b0ba_JaffaCakes118
SHA256 dc2bbbadf241dc21246ca32daaea5abcef6c5141ca83cbb863c48e6d4b17646e
Tags
darkcomet evasion persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

dc2bbbadf241dc21246ca32daaea5abcef6c5141ca83cbb863c48e6d4b17646e

Threat Level: Known bad

The file 650e8eebea969067fdde31da20d9b0ba_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

darkcomet evasion persistence rat trojan

Darkcomet family

Darkcomet

Modifies firewall policy service

Modifies WinLogon for persistence

Sets file to hidden

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of AdjustPrivilegeToken

Views/modifies file attributes

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-22 22:31

Signatures

Darkcomet family

darkcomet

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-22 22:31

Reported

2024-07-22 23:33

Platform

win7-20240708-en

Max time kernel

148s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe"

Signatures

Darkcomet

trojan rat darkcomet

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\MSWINST\\mswinstat.exe" C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\MSWINST\mswinstat.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Windows\MSWINST\mswinstat.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" C:\Windows\MSWINST\mswinstat.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A

Sets file to hidden

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\MSWINST\mswinstat.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\MSWINST\\mswinstat.exe" C:\Windows\MSWINST\mswinstat.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\MSWINST\\mswinstat.exe" C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\MSWINST\\mswinstat.exe" C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2240 set thread context of 1792 N/A C:\Windows\MSWINST\mswinstat.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\MSWINST\mswinstat.exe C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A
File opened for modification C:\Windows\MSWINST\mswinstat.exe C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A
File opened for modification C:\Windows\MSWINST\ C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\MSWINST\mswinstat.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\MSWINST\mswinstat.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\MSWINST\mswinstat.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\MSWINST\mswinstat.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\MSWINST\mswinstat.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\MSWINST\mswinstat.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\MSWINST\mswinstat.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\MSWINST\mswinstat.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\MSWINST\mswinstat.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\MSWINST\mswinstat.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\MSWINST\mswinstat.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\MSWINST\mswinstat.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\MSWINST\mswinstat.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\MSWINST\mswinstat.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\MSWINST\mswinstat.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\MSWINST\mswinstat.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\MSWINST\mswinstat.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\MSWINST\mswinstat.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\MSWINST\mswinstat.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\MSWINST\mswinstat.exe N/A
Token: 33 N/A C:\Windows\MSWINST\mswinstat.exe N/A
Token: 34 N/A C:\Windows\MSWINST\mswinstat.exe N/A
Token: 35 N/A C:\Windows\MSWINST\mswinstat.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeSystemtimePrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeUndockPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeManageVolumePrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2308 wrote to memory of 2264 N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2308 wrote to memory of 2264 N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2308 wrote to memory of 2264 N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2308 wrote to memory of 2264 N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2264 wrote to memory of 2268 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2264 wrote to memory of 2268 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2264 wrote to memory of 2268 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2264 wrote to memory of 2268 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2308 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe C:\Windows\MSWINST\mswinstat.exe
PID 2308 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe C:\Windows\MSWINST\mswinstat.exe
PID 2308 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe C:\Windows\MSWINST\mswinstat.exe
PID 2308 wrote to memory of 2240 N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe C:\Windows\MSWINST\mswinstat.exe
PID 2240 wrote to memory of 1792 N/A C:\Windows\MSWINST\mswinstat.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2240 wrote to memory of 1792 N/A C:\Windows\MSWINST\mswinstat.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2240 wrote to memory of 1792 N/A C:\Windows\MSWINST\mswinstat.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2240 wrote to memory of 1792 N/A C:\Windows\MSWINST\mswinstat.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2240 wrote to memory of 1792 N/A C:\Windows\MSWINST\mswinstat.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 2240 wrote to memory of 1792 N/A C:\Windows\MSWINST\mswinstat.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe" +s +h

C:\Windows\MSWINST\mswinstat.exe

"C:\Windows\MSWINST\mswinstat.exe"

C:\Program Files (x86)\Internet Explorer\iexplore.exe

"C:\Program Files (x86)\Internet Explorer\iexplore.exe"

Network

Country Destination Domain Proto
N/A 192.168.0.106:1605 tcp
US 8.8.8.8:53 ifcvehzadx.zapto.org udp
N/A 192.168.0.106:1605 tcp
N/A 192.168.0.106:1605 tcp
N/A 192.168.0.106:1605 tcp
N/A 192.168.0.106:1605 tcp
N/A 192.168.0.106:1605 tcp
N/A 192.168.0.106:1605 tcp
N/A 192.168.0.106:1605 tcp

Files

memory/2308-0-0x0000000000260000-0x0000000000261000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat

MD5 996f0aaed9af6625ed3e623c73d2965d
SHA1 cbd202d3723fe64b4455cb25bbeab4dab018fea2
SHA256 3f191bad7339a018fb0022c72759a6526e2f961154fbdd16ec7942f83930521b
SHA512 dbfb3fae42f0f65956173293acbf816ed0625d6297deb1046c513512bd969c8494d1f3e253bd1ee7ba30f7394b9a78fd8d869ff75aa3ce13b6e61d054b8c6b3d

C:\Windows\MSWINST\mswinstat.exe

MD5 650e8eebea969067fdde31da20d9b0ba
SHA1 710f976b524504e65d01ddb947a7bb756a9e1fd6
SHA256 dc2bbbadf241dc21246ca32daaea5abcef6c5141ca83cbb863c48e6d4b17646e
SHA512 b41a26c3c62d9b0e21310916a09d762d93ab94edfdf410b4b254655489cdde92c7719fb866ff37ce8c6bae6f1517252071053a36f727dc6c0faf2551a8753029

memory/2308-21-0x0000000000400000-0x00000000004C3000-memory.dmp

memory/1792-23-0x0000000000400000-0x00000000004C3000-memory.dmp

memory/2240-24-0x0000000000400000-0x00000000004C3000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-22 22:31

Reported

2024-07-22 23:32

Platform

win10v2004-20240709-en

Max time kernel

148s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe"

Signatures

Darkcomet

trojan rat darkcomet

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\MSWINST\\mswinstat.exe" C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A

Modifies firewall policy service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Windows\MSWINST\mswinstat.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Windows\MSWINST\mswinstat.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" C:\Windows\MSWINST\mswinstat.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A

Sets file to hidden

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Windows\MSWINST\mswinstat.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\MSWINST\\mswinstat.exe" C:\Windows\MSWINST\mswinstat.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\MSWINST\\mswinstat.exe" C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\MSWINST\\mswinstat.exe" C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 472 set thread context of 2600 N/A C:\Windows\MSWINST\mswinstat.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\MSWINST\mswinstat.exe C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A
File opened for modification C:\Windows\MSWINST\mswinstat.exe C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A
File opened for modification C:\Windows\MSWINST\ C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\MSWINST\mswinstat.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\MSWINST\mswinstat.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\MSWINST\mswinstat.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\MSWINST\mswinstat.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\MSWINST\mswinstat.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\MSWINST\mswinstat.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\MSWINST\mswinstat.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\MSWINST\mswinstat.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\MSWINST\mswinstat.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\MSWINST\mswinstat.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\MSWINST\mswinstat.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\MSWINST\mswinstat.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\MSWINST\mswinstat.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\MSWINST\mswinstat.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\MSWINST\mswinstat.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\MSWINST\mswinstat.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\MSWINST\mswinstat.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\MSWINST\mswinstat.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\MSWINST\mswinstat.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\MSWINST\mswinstat.exe N/A
Token: 33 N/A C:\Windows\MSWINST\mswinstat.exe N/A
Token: 34 N/A C:\Windows\MSWINST\mswinstat.exe N/A
Token: 35 N/A C:\Windows\MSWINST\mswinstat.exe N/A
Token: 36 N/A C:\Windows\MSWINST\mswinstat.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeSecurityPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeSystemtimePrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Internet Explorer\iexplore.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1120 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1120 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1120 wrote to memory of 2028 N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2028 wrote to memory of 1336 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2028 wrote to memory of 1336 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2028 wrote to memory of 1336 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1120 wrote to memory of 472 N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe C:\Windows\MSWINST\mswinstat.exe
PID 1120 wrote to memory of 472 N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe C:\Windows\MSWINST\mswinstat.exe
PID 1120 wrote to memory of 472 N/A C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe C:\Windows\MSWINST\mswinstat.exe
PID 472 wrote to memory of 2600 N/A C:\Windows\MSWINST\mswinstat.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 472 wrote to memory of 2600 N/A C:\Windows\MSWINST\mswinstat.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 472 wrote to memory of 2600 N/A C:\Windows\MSWINST\mswinstat.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 472 wrote to memory of 2600 N/A C:\Windows\MSWINST\mswinstat.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe
PID 472 wrote to memory of 2600 N/A C:\Windows\MSWINST\mswinstat.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Users\Admin\AppData\Local\Temp\650e8eebea969067fdde31da20d9b0ba_JaffaCakes118.exe" +s +h

C:\Windows\MSWINST\mswinstat.exe

"C:\Windows\MSWINST\mswinstat.exe"

C:\Program Files (x86)\Internet Explorer\iexplore.exe

"C:\Program Files (x86)\Internet Explorer\iexplore.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
N/A 192.168.0.106:1605 tcp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 ifcvehzadx.zapto.org udp
N/A 192.168.0.106:1605 tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 ifcvehzadx.zapto.org udp
N/A 192.168.0.106:1605 tcp
US 8.8.8.8:53 ifcvehzadx.zapto.org udp
N/A 192.168.0.106:1605 tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 ifcvehzadx.zapto.org udp
N/A 192.168.0.106:1605 tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 ifcvehzadx.zapto.org udp
N/A 192.168.0.106:1605 tcp
US 8.8.8.8:53 ifcvehzadx.zapto.org udp
N/A 192.168.0.106:1605 tcp
US 8.8.8.8:53 ifcvehzadx.zapto.org udp
N/A 192.168.0.106:1605 tcp

Files

memory/1120-0-0x00000000007D0000-0x00000000007D1000-memory.dmp

C:\Windows\MSWINST\mswinstat.exe

MD5 650e8eebea969067fdde31da20d9b0ba
SHA1 710f976b524504e65d01ddb947a7bb756a9e1fd6
SHA256 dc2bbbadf241dc21246ca32daaea5abcef6c5141ca83cbb863c48e6d4b17646e
SHA512 b41a26c3c62d9b0e21310916a09d762d93ab94edfdf410b4b254655489cdde92c7719fb866ff37ce8c6bae6f1517252071053a36f727dc6c0faf2551a8753029

C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat

MD5 996f0aaed9af6625ed3e623c73d2965d
SHA1 cbd202d3723fe64b4455cb25bbeab4dab018fea2
SHA256 3f191bad7339a018fb0022c72759a6526e2f961154fbdd16ec7942f83930521b
SHA512 dbfb3fae42f0f65956173293acbf816ed0625d6297deb1046c513512bd969c8494d1f3e253bd1ee7ba30f7394b9a78fd8d869ff75aa3ce13b6e61d054b8c6b3d

memory/1120-66-0x0000000000400000-0x00000000004C3000-memory.dmp

memory/472-67-0x0000000002720000-0x0000000002721000-memory.dmp

memory/2600-68-0x0000000000400000-0x00000000004C3000-memory.dmp

memory/472-69-0x0000000000400000-0x00000000004C3000-memory.dmp