Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
12/10/2024, 03:22
Behavioral task
behavioral1
Sample
3836b53342a37d161cb58d2d4474c4e0_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
17 signatures
150 seconds
General
- Target 3836b53342a37d161cb58d2d4474c4e0_JaffaCakes118.exe
- Size 747KB
- Sample241012-dxckpsvdpk
- SHA256 69ab63c43dcc7832042f204315203140ad370a54b6b8aa1bad70b02628e26d57
- MD5 3836b53342a37d161cb58d2d4474c4e0
- SHA1 83b4321ef1863c342960ad53387f3003e67c864b
- SHA512 b61d998fe141f673cef968b903245bc9e3774bdf6dfda80e81678fdf7e392b4af0c56ef24cfc75b98a967ecf3b9e36fb1660cf639b62d999a845d38b4c8233ef
- SSDEEP 12288:pk0QVlhmPojAPTMEsUTg0oChO/Q2JbsbjPbN5qhRTtYe3f+Iw86k/9/+/qMd0QZs:C0QRWoJEfg0oChGdJQbjPbNW5tYeP+Gz
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
darkcomet
Botnet
-
Guest16
C2
-
197.31.192.25:5000
Mutex
-
DC_MUTEX-F54S21D
Attributes
-
gencode
DUhvCRzrVklo
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
- Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile iexplore.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" iexplore.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" iexplore.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile 3836b53342a37d161cb58d2d4474c4e0_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 3836b53342a37d161cb58d2d4474c4e0_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" 3836b53342a37d161cb58d2d4474c4e0_JaffaCakes118.exe - Modifies security service 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" 3836b53342a37d161cb58d2d4474c4e0_JaffaCakes118.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" iexplore.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 3836b53342a37d161cb58d2d4474c4e0_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 3836b53342a37d161cb58d2d4474c4e0_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" iexplore.exe - Disables RegEdit via registry modification 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 3836b53342a37d161cb58d2d4474c4e0_JaffaCakes118.exe Set value (int) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" iexplore.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 3836b53342a37d161cb58d2d4474c4e0_JaffaCakes118.exe - Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 1440 attrib.exe 1904 attrib.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation 3836b53342a37d161cb58d2d4474c4e0_JaffaCakes118.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 3836b53342a37d161cb58d2d4474c4e0_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 3836b53342a37d161cb58d2d4474c4e0_JaffaCakes118.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2380 set thread context of 2496 2380 3836b53342a37d161cb58d2d4474c4e0_JaffaCakes118.exe 89 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3836b53342a37d161cb58d2d4474c4e0_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2496 iexplore.exe - Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2380 3836b53342a37d161cb58d2d4474c4e0_JaffaCakes118.exe Token: SeSecurityPrivilege 2380 3836b53342a37d161cb58d2d4474c4e0_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2380 3836b53342a37d161cb58d2d4474c4e0_JaffaCakes118.exe Token: SeLoadDriverPrivilege 2380 3836b53342a37d161cb58d2d4474c4e0_JaffaCakes118.exe Token: SeSystemProfilePrivilege 2380 3836b53342a37d161cb58d2d4474c4e0_JaffaCakes118.exe Token: SeSystemtimePrivilege 2380 3836b53342a37d161cb58d2d4474c4e0_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 2380 3836b53342a37d161cb58d2d4474c4e0_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2380 3836b53342a37d161cb58d2d4474c4e0_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 2380 3836b53342a37d161cb58d2d4474c4e0_JaffaCakes118.exe Token: SeBackupPrivilege 2380 3836b53342a37d161cb58d2d4474c4e0_JaffaCakes118.exe Token: SeRestorePrivilege 2380 3836b53342a37d161cb58d2d4474c4e0_JaffaCakes118.exe Token: SeShutdownPrivilege 2380 3836b53342a37d161cb58d2d4474c4e0_JaffaCakes118.exe Token: SeDebugPrivilege 2380 3836b53342a37d161cb58d2d4474c4e0_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 2380 3836b53342a37d161cb58d2d4474c4e0_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 2380 3836b53342a37d161cb58d2d4474c4e0_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 2380 3836b53342a37d161cb58d2d4474c4e0_JaffaCakes118.exe Token: SeUndockPrivilege 2380 3836b53342a37d161cb58d2d4474c4e0_JaffaCakes118.exe Token: SeManageVolumePrivilege 2380 3836b53342a37d161cb58d2d4474c4e0_JaffaCakes118.exe Token: SeImpersonatePrivilege 2380 3836b53342a37d161cb58d2d4474c4e0_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 2380 3836b53342a37d161cb58d2d4474c4e0_JaffaCakes118.exe Token: 33 2380 3836b53342a37d161cb58d2d4474c4e0_JaffaCakes118.exe Token: 34 2380 3836b53342a37d161cb58d2d4474c4e0_JaffaCakes118.exe Token: 35 2380 3836b53342a37d161cb58d2d4474c4e0_JaffaCakes118.exe Token: 36 2380 3836b53342a37d161cb58d2d4474c4e0_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 2496 iexplore.exe Token: SeSecurityPrivilege 2496 iexplore.exe Token: SeTakeOwnershipPrivilege 2496 iexplore.exe Token: SeLoadDriverPrivilege 2496 iexplore.exe Token: SeSystemProfilePrivilege 2496 iexplore.exe Token: SeSystemtimePrivilege 2496 iexplore.exe Token: SeProfSingleProcessPrivilege 2496 iexplore.exe Token: SeIncBasePriorityPrivilege 2496 iexplore.exe Token: SeCreatePagefilePrivilege 2496 iexplore.exe Token: SeBackupPrivilege 2496 iexplore.exe Token: SeRestorePrivilege 2496 iexplore.exe Token: SeShutdownPrivilege 2496 iexplore.exe Token: SeDebugPrivilege 2496 iexplore.exe Token: SeSystemEnvironmentPrivilege 2496 iexplore.exe Token: SeChangeNotifyPrivilege 2496 iexplore.exe Token: SeRemoteShutdownPrivilege 2496 iexplore.exe Token: SeUndockPrivilege 2496 iexplore.exe Token: SeManageVolumePrivilege 2496 iexplore.exe Token: SeImpersonatePrivilege 2496 iexplore.exe Token: SeCreateGlobalPrivilege 2496 iexplore.exe Token: 33 2496 iexplore.exe Token: 34 2496 iexplore.exe Token: 35 2496 iexplore.exe Token: 36 2496 iexplore.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2496 iexplore.exe - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2380 wrote to memory of 1012 2380 3836b53342a37d161cb58d2d4474c4e0_JaffaCakes118.exe 86 PID 2380 wrote to memory of 1012 2380 3836b53342a37d161cb58d2d4474c4e0_JaffaCakes118.exe 86 PID 2380 wrote to memory of 1012 2380 3836b53342a37d161cb58d2d4474c4e0_JaffaCakes118.exe 86 PID 2380 wrote to memory of 1996 2380 3836b53342a37d161cb58d2d4474c4e0_JaffaCakes118.exe 87 PID 2380 wrote to memory of 1996 2380 3836b53342a37d161cb58d2d4474c4e0_JaffaCakes118.exe 87 PID 2380 wrote to memory of 1996 2380 3836b53342a37d161cb58d2d4474c4e0_JaffaCakes118.exe 87 PID 2380 wrote to memory of 2496 2380 3836b53342a37d161cb58d2d4474c4e0_JaffaCakes118.exe 89 PID 2380 wrote to memory of 2496 2380 3836b53342a37d161cb58d2d4474c4e0_JaffaCakes118.exe 89 PID 2380 wrote to memory of 2496 2380 3836b53342a37d161cb58d2d4474c4e0_JaffaCakes118.exe 89 PID 2380 wrote to memory of 2496 2380 3836b53342a37d161cb58d2d4474c4e0_JaffaCakes118.exe 89 PID 2380 wrote to memory of 2496 2380 3836b53342a37d161cb58d2d4474c4e0_JaffaCakes118.exe 89 PID 1996 wrote to memory of 1440 1996 cmd.exe 91 PID 1996 wrote to memory of 1440 1996 cmd.exe 91 PID 1996 wrote to memory of 1440 1996 cmd.exe 91 PID 1012 wrote to memory of 1904 1012 cmd.exe 92 PID 1012 wrote to memory of 1904 1012 cmd.exe 92 PID 1012 wrote to memory of 1904 1012 cmd.exe 92 - System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern 3836b53342a37d161cb58d2d4474c4e0_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" 3836b53342a37d161cb58d2d4474c4e0_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion 3836b53342a37d161cb58d2d4474c4e0_JaffaCakes118.exe - Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 1440 attrib.exe 1904 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3836b53342a37d161cb58d2d4474c4e0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3836b53342a37d161cb58d2d4474c4e0_JaffaCakes118.exe"1⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Windows security modification
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2380 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\3836b53342a37d161cb58d2d4474c4e0_JaffaCakes118.exe" +s +h2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\3836b53342a37d161cb58d2d4474c4e0_JaffaCakes118.exe" +s +h3⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:1904
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:1440
-
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2496
-
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Modify Registry
5