Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
30-07-2024 20:47
Static task
static1
Behavioral task
behavioral1
Sample
79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe
-
Size
540KB
-
MD5
79f990b51a93bcea447361c0ff124fa5
-
SHA1
0b0f738448b585e95876a1db1a5ccd349bb8f394
-
SHA256
1fd2795be467787899008bd222d7c4d336701f294461e4c6c7a28059148b0a81
-
SHA512
a1f78ad9c0e89c07d02bea6664d04803a051c1aaae3a4658c1525946cf3e190e943b25681dfab3897b643ea65896a462ac66d254cbc05a2525d1092b15164e8a
-
SSDEEP
12288:ke0upxXUG/EwhiALlal/1VOqIn9fy/afPdTL67P/wcpG5txe+bE:zzxEG/Eclw9s59q/sZu7P/waGrxe+I
Malware Config
Extracted
darkcomet
Guest16
winupdt.sytes.net:5500
DC_MUTEX-FYC4NVU
-
InstallPath
Install\Winup.exe
-
gencode
xlw5yo0FAZSj
-
install
true
-
offline_keylogger
true
-
password
111
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\Install\\Winup.exe" 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
Processes:
Winup.exepid process 2828 Winup.exe -
Loads dropped DLL 2 IoCs
Processes:
79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exepid process 2220 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe 2220 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe -
Molebox Virtualization software 1 IoCs
Detects file using Molebox Virtualization software.
Processes:
resource yara_rule \Windows\Install\Winup.exe molebox -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Winup.exe79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\Install\\Winup.exe" Winup.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\Install\\Winup.exe" 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe -
Drops file in Windows directory 3 IoCs
Processes:
79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exedescription ioc process File created C:\Windows\Install\Winup.exe 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe File opened for modification C:\Windows\Install\Winup.exe 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe File opened for modification C:\Windows\Install\ 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exeWinup.exenotepad.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Winup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exeWinup.exedescription pid process Token: SeIncreaseQuotaPrivilege 2220 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Token: SeSecurityPrivilege 2220 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2220 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Token: SeLoadDriverPrivilege 2220 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Token: SeSystemProfilePrivilege 2220 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Token: SeSystemtimePrivilege 2220 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 2220 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2220 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 2220 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Token: SeBackupPrivilege 2220 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Token: SeRestorePrivilege 2220 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Token: SeShutdownPrivilege 2220 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Token: SeDebugPrivilege 2220 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 2220 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 2220 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 2220 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Token: SeUndockPrivilege 2220 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Token: SeManageVolumePrivilege 2220 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Token: SeImpersonatePrivilege 2220 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 2220 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Token: 33 2220 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Token: 34 2220 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Token: 35 2220 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 2828 Winup.exe Token: SeSecurityPrivilege 2828 Winup.exe Token: SeTakeOwnershipPrivilege 2828 Winup.exe Token: SeLoadDriverPrivilege 2828 Winup.exe Token: SeSystemProfilePrivilege 2828 Winup.exe Token: SeSystemtimePrivilege 2828 Winup.exe Token: SeProfSingleProcessPrivilege 2828 Winup.exe Token: SeIncBasePriorityPrivilege 2828 Winup.exe Token: SeCreatePagefilePrivilege 2828 Winup.exe Token: SeBackupPrivilege 2828 Winup.exe Token: SeRestorePrivilege 2828 Winup.exe Token: SeShutdownPrivilege 2828 Winup.exe Token: SeDebugPrivilege 2828 Winup.exe Token: SeSystemEnvironmentPrivilege 2828 Winup.exe Token: SeChangeNotifyPrivilege 2828 Winup.exe Token: SeRemoteShutdownPrivilege 2828 Winup.exe Token: SeUndockPrivilege 2828 Winup.exe Token: SeManageVolumePrivilege 2828 Winup.exe Token: SeImpersonatePrivilege 2828 Winup.exe Token: SeCreateGlobalPrivilege 2828 Winup.exe Token: 33 2828 Winup.exe Token: 34 2828 Winup.exe Token: 35 2828 Winup.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Winup.exepid process 2828 Winup.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exeWinup.exedescription pid process target process PID 2220 wrote to memory of 2828 2220 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Winup.exe PID 2220 wrote to memory of 2828 2220 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Winup.exe PID 2220 wrote to memory of 2828 2220 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Winup.exe PID 2220 wrote to memory of 2828 2220 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Winup.exe PID 2220 wrote to memory of 2828 2220 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Winup.exe PID 2220 wrote to memory of 2828 2220 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Winup.exe PID 2220 wrote to memory of 2828 2220 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Winup.exe PID 2828 wrote to memory of 2760 2828 Winup.exe notepad.exe PID 2828 wrote to memory of 2760 2828 Winup.exe notepad.exe PID 2828 wrote to memory of 2760 2828 Winup.exe notepad.exe PID 2828 wrote to memory of 2760 2828 Winup.exe notepad.exe PID 2828 wrote to memory of 2760 2828 Winup.exe notepad.exe PID 2828 wrote to memory of 2760 2828 Winup.exe notepad.exe PID 2828 wrote to memory of 2760 2828 Winup.exe notepad.exe PID 2828 wrote to memory of 2760 2828 Winup.exe notepad.exe PID 2828 wrote to memory of 2760 2828 Winup.exe notepad.exe PID 2828 wrote to memory of 2760 2828 Winup.exe notepad.exe PID 2828 wrote to memory of 2760 2828 Winup.exe notepad.exe PID 2828 wrote to memory of 2760 2828 Winup.exe notepad.exe PID 2828 wrote to memory of 2760 2828 Winup.exe notepad.exe PID 2828 wrote to memory of 2760 2828 Winup.exe notepad.exe PID 2828 wrote to memory of 2760 2828 Winup.exe notepad.exe PID 2828 wrote to memory of 2760 2828 Winup.exe notepad.exe PID 2828 wrote to memory of 2760 2828 Winup.exe notepad.exe PID 2828 wrote to memory of 2760 2828 Winup.exe notepad.exe PID 2828 wrote to memory of 2760 2828 Winup.exe notepad.exe PID 2828 wrote to memory of 2760 2828 Winup.exe notepad.exe PID 2828 wrote to memory of 2760 2828 Winup.exe notepad.exe PID 2828 wrote to memory of 2760 2828 Winup.exe notepad.exe PID 2828 wrote to memory of 2760 2828 Winup.exe notepad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\Install\Winup.exe"C:\Windows\Install\Winup.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\SysWOW64\notepad.exenotepad3⤵
- System Location Discovery: System Language Discovery
PID:2760
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
540KB
MD579f990b51a93bcea447361c0ff124fa5
SHA10b0f738448b585e95876a1db1a5ccd349bb8f394
SHA2561fd2795be467787899008bd222d7c4d336701f294461e4c6c7a28059148b0a81
SHA512a1f78ad9c0e89c07d02bea6664d04803a051c1aaae3a4658c1525946cf3e190e943b25681dfab3897b643ea65896a462ac66d254cbc05a2525d1092b15164e8a