Analysis
- max time kernel
91s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
28/09/2024, 04:26
Behavioral task
behavioral1
Sample
fb8030f178975b9d3af8e66da432d495_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
6 signatures
150 seconds
General
- Target fb8030f178975b9d3af8e66da432d495_JaffaCakes118.exe
- Size 649KB
- Sample240928-e2gwnaxapj
- SHA256 e816d8269e146137b95cb10c7a06ea139b7831d5d0f16590ddd47e5dd34aea7a
- MD5 fb8030f178975b9d3af8e66da432d495
- SHA1 1d15af048fbbd6a590c9de30b613970714d3f01d
- SHA512 57147f38e17802ef6d61ed62fd52031b8b27984d1868a7e1a1ada2b34d91bc8aa5d7785c6c6be00a6d18f3504377c5644c65f7b21a27a8aa966f5aa33b6eb2e3
- SSDEEP 12288:7k0QVlhmPojAPTMEsUTg0oChO/Q2JbsbjPbN5qhRTtYe3f+Iw86k/9/+J:w0QRWoJEfg0oChGdJQbjPbNW5tYeP+Go
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
darkcomet
Botnet
-
Guest16
C2
-
testalexfghfgh.no-ip.org:1604
Mutex
-
DC_MUTEX-6K8WDVK
Attributes
-
gencode
3JLUdTjiYQuD
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 436 set thread context of 3452 436 fb8030f178975b9d3af8e66da432d495_JaffaCakes118.exe 84 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fb8030f178975b9d3af8e66da432d495_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe - Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 436 fb8030f178975b9d3af8e66da432d495_JaffaCakes118.exe Token: SeSecurityPrivilege 436 fb8030f178975b9d3af8e66da432d495_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 436 fb8030f178975b9d3af8e66da432d495_JaffaCakes118.exe Token: SeLoadDriverPrivilege 436 fb8030f178975b9d3af8e66da432d495_JaffaCakes118.exe Token: SeSystemProfilePrivilege 436 fb8030f178975b9d3af8e66da432d495_JaffaCakes118.exe Token: SeSystemtimePrivilege 436 fb8030f178975b9d3af8e66da432d495_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 436 fb8030f178975b9d3af8e66da432d495_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 436 fb8030f178975b9d3af8e66da432d495_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 436 fb8030f178975b9d3af8e66da432d495_JaffaCakes118.exe Token: SeBackupPrivilege 436 fb8030f178975b9d3af8e66da432d495_JaffaCakes118.exe Token: SeRestorePrivilege 436 fb8030f178975b9d3af8e66da432d495_JaffaCakes118.exe Token: SeShutdownPrivilege 436 fb8030f178975b9d3af8e66da432d495_JaffaCakes118.exe Token: SeDebugPrivilege 436 fb8030f178975b9d3af8e66da432d495_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 436 fb8030f178975b9d3af8e66da432d495_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 436 fb8030f178975b9d3af8e66da432d495_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 436 fb8030f178975b9d3af8e66da432d495_JaffaCakes118.exe Token: SeUndockPrivilege 436 fb8030f178975b9d3af8e66da432d495_JaffaCakes118.exe Token: SeManageVolumePrivilege 436 fb8030f178975b9d3af8e66da432d495_JaffaCakes118.exe Token: SeImpersonatePrivilege 436 fb8030f178975b9d3af8e66da432d495_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 436 fb8030f178975b9d3af8e66da432d495_JaffaCakes118.exe Token: 33 436 fb8030f178975b9d3af8e66da432d495_JaffaCakes118.exe Token: 34 436 fb8030f178975b9d3af8e66da432d495_JaffaCakes118.exe Token: 35 436 fb8030f178975b9d3af8e66da432d495_JaffaCakes118.exe Token: 36 436 fb8030f178975b9d3af8e66da432d495_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 3452 iexplore.exe Token: SeSecurityPrivilege 3452 iexplore.exe Token: SeTakeOwnershipPrivilege 3452 iexplore.exe Token: SeLoadDriverPrivilege 3452 iexplore.exe Token: SeSystemProfilePrivilege 3452 iexplore.exe Token: SeSystemtimePrivilege 3452 iexplore.exe Token: SeProfSingleProcessPrivilege 3452 iexplore.exe Token: SeIncBasePriorityPrivilege 3452 iexplore.exe Token: SeCreatePagefilePrivilege 3452 iexplore.exe Token: SeBackupPrivilege 3452 iexplore.exe Token: SeRestorePrivilege 3452 iexplore.exe Token: SeShutdownPrivilege 3452 iexplore.exe Token: SeDebugPrivilege 3452 iexplore.exe Token: SeSystemEnvironmentPrivilege 3452 iexplore.exe Token: SeChangeNotifyPrivilege 3452 iexplore.exe Token: SeRemoteShutdownPrivilege 3452 iexplore.exe Token: SeUndockPrivilege 3452 iexplore.exe Token: SeManageVolumePrivilege 3452 iexplore.exe Token: SeImpersonatePrivilege 3452 iexplore.exe Token: SeCreateGlobalPrivilege 3452 iexplore.exe Token: 33 3452 iexplore.exe Token: 34 3452 iexplore.exe Token: 35 3452 iexplore.exe Token: 36 3452 iexplore.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 436 wrote to memory of 3452 436 fb8030f178975b9d3af8e66da432d495_JaffaCakes118.exe 84 PID 436 wrote to memory of 3452 436 fb8030f178975b9d3af8e66da432d495_JaffaCakes118.exe 84 PID 436 wrote to memory of 3452 436 fb8030f178975b9d3af8e66da432d495_JaffaCakes118.exe 84 PID 436 wrote to memory of 3452 436 fb8030f178975b9d3af8e66da432d495_JaffaCakes118.exe 84 PID 436 wrote to memory of 3452 436 fb8030f178975b9d3af8e66da432d495_JaffaCakes118.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb8030f178975b9d3af8e66da432d495_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fb8030f178975b9d3af8e66da432d495_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3452
-