Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system -
submitted
30-07-2024 20:47
Static task
static1
Behavioral task
behavioral1
Sample
79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe
-
Size
540KB
-
MD5
79f990b51a93bcea447361c0ff124fa5
-
SHA1
0b0f738448b585e95876a1db1a5ccd349bb8f394
-
SHA256
1fd2795be467787899008bd222d7c4d336701f294461e4c6c7a28059148b0a81
-
SHA512
a1f78ad9c0e89c07d02bea6664d04803a051c1aaae3a4658c1525946cf3e190e943b25681dfab3897b643ea65896a462ac66d254cbc05a2525d1092b15164e8a
-
SSDEEP
12288:ke0upxXUG/EwhiALlal/1VOqIn9fy/afPdTL67P/wcpG5txe+bE:zzxEG/Eclw9s59q/sZu7P/waGrxe+I
Malware Config
Extracted
darkcomet
Guest16
winupdt.sytes.net:5500
DC_MUTEX-FYC4NVU
-
InstallPath
Install\Winup.exe
-
gencode
xlw5yo0FAZSj
-
install
true
-
offline_keylogger
true
-
password
111
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\Install\\Winup.exe" 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2951562807-3718269429-4208157415-1000\Control Panel\International\Geo\Nation 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
Processes:
Winup.exepid process 2376 Winup.exe -
Molebox Virtualization software 1 IoCs
Detects file using Molebox Virtualization software.
Processes:
resource yara_rule C:\Windows\Install\Winup.exe molebox -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exeWinup.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2951562807-3718269429-4208157415-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\Install\\Winup.exe" 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2951562807-3718269429-4208157415-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\Install\\Winup.exe" Winup.exe -
Drops file in Windows directory 3 IoCs
Processes:
79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exedescription ioc process File opened for modification C:\Windows\Install\Winup.exe 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe File opened for modification C:\Windows\Install\ 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe File created C:\Windows\Install\Winup.exe 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exeWinup.exenotepad.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Winup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exeWinup.exedescription pid process Token: SeIncreaseQuotaPrivilege 2224 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Token: SeSecurityPrivilege 2224 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2224 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Token: SeLoadDriverPrivilege 2224 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Token: SeSystemProfilePrivilege 2224 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Token: SeSystemtimePrivilege 2224 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 2224 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2224 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 2224 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Token: SeBackupPrivilege 2224 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Token: SeRestorePrivilege 2224 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Token: SeShutdownPrivilege 2224 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Token: SeDebugPrivilege 2224 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 2224 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 2224 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 2224 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Token: SeUndockPrivilege 2224 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Token: SeManageVolumePrivilege 2224 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Token: SeImpersonatePrivilege 2224 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 2224 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Token: 33 2224 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Token: 34 2224 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Token: 35 2224 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Token: 36 2224 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 2376 Winup.exe Token: SeSecurityPrivilege 2376 Winup.exe Token: SeTakeOwnershipPrivilege 2376 Winup.exe Token: SeLoadDriverPrivilege 2376 Winup.exe Token: SeSystemProfilePrivilege 2376 Winup.exe Token: SeSystemtimePrivilege 2376 Winup.exe Token: SeProfSingleProcessPrivilege 2376 Winup.exe Token: SeIncBasePriorityPrivilege 2376 Winup.exe Token: SeCreatePagefilePrivilege 2376 Winup.exe Token: SeBackupPrivilege 2376 Winup.exe Token: SeRestorePrivilege 2376 Winup.exe Token: SeShutdownPrivilege 2376 Winup.exe Token: SeDebugPrivilege 2376 Winup.exe Token: SeSystemEnvironmentPrivilege 2376 Winup.exe Token: SeChangeNotifyPrivilege 2376 Winup.exe Token: SeRemoteShutdownPrivilege 2376 Winup.exe Token: SeUndockPrivilege 2376 Winup.exe Token: SeManageVolumePrivilege 2376 Winup.exe Token: SeImpersonatePrivilege 2376 Winup.exe Token: SeCreateGlobalPrivilege 2376 Winup.exe Token: 33 2376 Winup.exe Token: 34 2376 Winup.exe Token: 35 2376 Winup.exe Token: 36 2376 Winup.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Winup.exepid process 2376 Winup.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exeWinup.exedescription pid process target process PID 2224 wrote to memory of 2376 2224 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Winup.exe PID 2224 wrote to memory of 2376 2224 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Winup.exe PID 2224 wrote to memory of 2376 2224 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Winup.exe PID 2224 wrote to memory of 2376 2224 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Winup.exe PID 2224 wrote to memory of 2376 2224 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Winup.exe PID 2224 wrote to memory of 2376 2224 79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe Winup.exe PID 2376 wrote to memory of 4048 2376 Winup.exe notepad.exe PID 2376 wrote to memory of 4048 2376 Winup.exe notepad.exe PID 2376 wrote to memory of 4048 2376 Winup.exe notepad.exe PID 2376 wrote to memory of 4048 2376 Winup.exe notepad.exe PID 2376 wrote to memory of 4048 2376 Winup.exe notepad.exe PID 2376 wrote to memory of 4048 2376 Winup.exe notepad.exe PID 2376 wrote to memory of 4048 2376 Winup.exe notepad.exe PID 2376 wrote to memory of 4048 2376 Winup.exe notepad.exe PID 2376 wrote to memory of 4048 2376 Winup.exe notepad.exe PID 2376 wrote to memory of 4048 2376 Winup.exe notepad.exe PID 2376 wrote to memory of 4048 2376 Winup.exe notepad.exe PID 2376 wrote to memory of 4048 2376 Winup.exe notepad.exe PID 2376 wrote to memory of 4048 2376 Winup.exe notepad.exe PID 2376 wrote to memory of 4048 2376 Winup.exe notepad.exe PID 2376 wrote to memory of 4048 2376 Winup.exe notepad.exe PID 2376 wrote to memory of 4048 2376 Winup.exe notepad.exe PID 2376 wrote to memory of 4048 2376 Winup.exe notepad.exe PID 2376 wrote to memory of 4048 2376 Winup.exe notepad.exe PID 2376 wrote to memory of 4048 2376 Winup.exe notepad.exe PID 2376 wrote to memory of 4048 2376 Winup.exe notepad.exe PID 2376 wrote to memory of 4048 2376 Winup.exe notepad.exe PID 2376 wrote to memory of 4048 2376 Winup.exe notepad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\79f990b51a93bcea447361c0ff124fa5_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Windows\Install\Winup.exe"C:\Windows\Install\Winup.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\SysWOW64\notepad.exenotepad3⤵
- System Location Discovery: System Language Discovery
PID:4048
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
540KB
MD579f990b51a93bcea447361c0ff124fa5
SHA10b0f738448b585e95876a1db1a5ccd349bb8f394
SHA2561fd2795be467787899008bd222d7c4d336701f294461e4c6c7a28059148b0a81
SHA512a1f78ad9c0e89c07d02bea6664d04803a051c1aaae3a4658c1525946cf3e190e943b25681dfab3897b643ea65896a462ac66d254cbc05a2525d1092b15164e8a