darkcomet | 408b365717114ce6b406c8b1dfc8dbb49679a2c37758da2a399f2628346a8943

General

Target

8f62b86a64556d62d3192bf4a1ad6660_JaffaCakes118.exe
Size

1.0MB
MD5

8f62b86a64556d62d3192bf4a1ad6660
SHA1

768b87bc641a42119f050c19a94493c908b310a7
SHA256

408b365717114ce6b406c8b1dfc8dbb49679a2c37758da2a399f2628346a8943
SHA512

131afb3f106e235649afec855e502212c255484b1b182493ae717300f65aec9f0c62ea5cc457cef6a616fac60ac8b0eb37403dc36aac95e8afc2b59796c11996
SSDEEP

24576:nFE//Tct4bOsyczmyM8rn8Hry+dFG3K0bbQolC:FSVyczo

Score

10^/10

darkcomet guest discovery evasion persistence rat trojan upx

Malware Config

Extracted

Family

darkcomet

Botnet

Guest

C2

larohabi.no-ip.org:1604

larohabi.no-ip.org:8080

larohabi.no-ip.org:100

127.0.0.1:

127.0.0.1:8080

larohabi.no-ip.org:1337

Mutex

DC_MUTEX-2LPNA5H

Attributes

InstallPath
IE Explorer\ieexp.exe
gencode
ikLmMzDk59K0
install
true
offline_keylogger
true
persistence
true
reg_key
Windows Updater

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

svzhost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IE Explorer\\ieexp.exe"	svzhost.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

svzhost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	svzhost.exe

Drops file in Drivers directory 4 IoCs

Processes:

svzhost.exeieexp.exesvzhost.exe8f62b86a64556d62d3192bf4a1ad6660_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	svzhost.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	ieexp.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	svzhost.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	8f62b86a64556d62d3192bf4a1ad6660_JaffaCakes118.exe

Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

2764 attrib.exe
3048 attrib.exe
Executes dropped EXE 7 IoCs

Processes:

svzhost.exesvzhost.exeieexp.exesvzhost.exesvzhost.exesvzhost.exesvzhost.exe

pid process

2852 svzhost.exe
316 svzhost.exe
3008 ieexp.exe
3052 svzhost.exe
2648 svzhost.exe
2620 svzhost.exe
1764 svzhost.exe
Loads dropped DLL 2 IoCs

Processes:

8f62b86a64556d62d3192bf4a1ad6660_JaffaCakes118.exesvzhost.exe

pid process

2868 8f62b86a64556d62d3192bf4a1ad6660_JaffaCakes118.exe
316 svzhost.exe

pid	process
2764	attrib.exe
3048	attrib.exe

pid	process
2868	8f62b86a64556d62d3192bf4a1ad6660_JaffaCakes118.exe
316	svzhost.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

ieexp.exesvzhost.exesvzhost.exe8f62b86a64556d62d3192bf4a1ad6660_JaffaCakes118.exesvzhost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Users\\Admin\\AppData\\Roaming\\svzhost.exe"	ieexp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Updater = "C:\\Windows\\system32\\IE Explorer\\ieexp.exe"	svzhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Users\\Admin\\AppData\\Roaming\\svzhost.exe"	svzhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft = "C:\\Users\\Admin\\AppData\\Roaming\\svzhost.exe"	8f62b86a64556d62d3192bf4a1ad6660_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Updater = "C:\\Windows\\system32\\IE Explorer\\ieexp.exe"	svzhost.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

ieexp.exesvzhost.exesvzhost.exe8f62b86a64556d62d3192bf4a1ad6660_JaffaCakes118.exe

description	ioc	process
File opened (read-only)	\??\z:	ieexp.exe
File opened (read-only)	\??\h:	svzhost.exe
File opened (read-only)	\??\i:	svzhost.exe
File opened (read-only)	\??\m:	svzhost.exe
File opened (read-only)	\??\t:	svzhost.exe
File opened (read-only)	\??\j:	ieexp.exe
File opened (read-only)	\??\p:	svzhost.exe
File opened (read-only)	\??\x:	ieexp.exe
File opened (read-only)	\??\j:	8f62b86a64556d62d3192bf4a1ad6660_JaffaCakes118.exe
File opened (read-only)	\??\m:	8f62b86a64556d62d3192bf4a1ad6660_JaffaCakes118.exe
File opened (read-only)	\??\b:	svzhost.exe
File opened (read-only)	\??\s:	svzhost.exe
File opened (read-only)	\??\w:	svzhost.exe
File opened (read-only)	\??\j:	svzhost.exe
File opened (read-only)	\??\v:	svzhost.exe
File opened (read-only)	\??\t:	8f62b86a64556d62d3192bf4a1ad6660_JaffaCakes118.exe
File opened (read-only)	\??\h:	svzhost.exe
File opened (read-only)	\??\o:	svzhost.exe
File opened (read-only)	\??\b:	svzhost.exe
File opened (read-only)	\??\w:	8f62b86a64556d62d3192bf4a1ad6660_JaffaCakes118.exe
File opened (read-only)	\??\i:	ieexp.exe
File opened (read-only)	\??\y:	ieexp.exe
File opened (read-only)	\??\q:	8f62b86a64556d62d3192bf4a1ad6660_JaffaCakes118.exe
File opened (read-only)	\??\i:	svzhost.exe
File opened (read-only)	\??\a:	ieexp.exe
File opened (read-only)	\??\e:	ieexp.exe
File opened (read-only)	\??\l:	ieexp.exe
File opened (read-only)	\??\b:	8f62b86a64556d62d3192bf4a1ad6660_JaffaCakes118.exe
File opened (read-only)	\??\k:	8f62b86a64556d62d3192bf4a1ad6660_JaffaCakes118.exe
File opened (read-only)	\??\o:	8f62b86a64556d62d3192bf4a1ad6660_JaffaCakes118.exe
File opened (read-only)	\??\y:	8f62b86a64556d62d3192bf4a1ad6660_JaffaCakes118.exe
File opened (read-only)	\??\v:	ieexp.exe
File opened (read-only)	\??\n:	svzhost.exe
File opened (read-only)	\??\z:	svzhost.exe
File opened (read-only)	\??\g:	8f62b86a64556d62d3192bf4a1ad6660_JaffaCakes118.exe
File opened (read-only)	\??\r:	8f62b86a64556d62d3192bf4a1ad6660_JaffaCakes118.exe
File opened (read-only)	\??\u:	8f62b86a64556d62d3192bf4a1ad6660_JaffaCakes118.exe
File opened (read-only)	\??\g:	ieexp.exe
File opened (read-only)	\??\k:	ieexp.exe
File opened (read-only)	\??\o:	ieexp.exe
File opened (read-only)	\??\p:	ieexp.exe
File opened (read-only)	\??\g:	svzhost.exe
File opened (read-only)	\??\o:	svzhost.exe
File opened (read-only)	\??\j:	svzhost.exe
File opened (read-only)	\??\r:	svzhost.exe
File opened (read-only)	\??\z:	svzhost.exe
File opened (read-only)	\??\u:	svzhost.exe
File opened (read-only)	\??\n:	ieexp.exe
File opened (read-only)	\??\r:	ieexp.exe
File opened (read-only)	\??\q:	svzhost.exe
File opened (read-only)	\??\r:	svzhost.exe
File opened (read-only)	\??\l:	8f62b86a64556d62d3192bf4a1ad6660_JaffaCakes118.exe
File opened (read-only)	\??\k:	svzhost.exe
File opened (read-only)	\??\n:	svzhost.exe
File opened (read-only)	\??\w:	svzhost.exe
File opened (read-only)	\??\m:	ieexp.exe
File opened (read-only)	\??\w:	ieexp.exe
File opened (read-only)	\??\s:	svzhost.exe
File opened (read-only)	\??\a:	svzhost.exe
File opened (read-only)	\??\e:	svzhost.exe
File opened (read-only)	\??\g:	svzhost.exe
File opened (read-only)	\??\q:	svzhost.exe
File opened (read-only)	\??\x:	svzhost.exe
File opened (read-only)	\??\h:	8f62b86a64556d62d3192bf4a1ad6660_JaffaCakes118.exe

AutoIT Executable 5 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/2868-81-0x0000000000400000-0x00000000004E5000-memory.dmp	autoit_exe
behavioral1/memory/2868-129-0x0000000000400000-0x00000000004E5000-memory.dmp	autoit_exe
behavioral1/memory/2852-140-0x0000000000400000-0x00000000004E5000-memory.dmp	autoit_exe
behavioral1/memory/3008-151-0x0000000000400000-0x00000000004E5000-memory.dmp	autoit_exe
behavioral1/memory/3052-153-0x0000000000400000-0x00000000004E5000-memory.dmp	autoit_exe

Drops file in System32 directory 3 IoCs

Processes:

svzhost.exe

description	ioc	process
File created	C:\Windows\SysWOW64\IE Explorer\ieexp.exe	svzhost.exe
File opened for modification	C:\Windows\SysWOW64\IE Explorer\ieexp.exe	svzhost.exe
File opened for modification	C:\Windows\SysWOW64\IE Explorer\	svzhost.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

svzhost.exesvzhost.exe

description	pid	process	target process
PID 2852 set thread context of 316	2852	svzhost.exe	svzhost.exe
PID 3052 set thread context of 2648	3052	svzhost.exe	svzhost.exe
PID 2852 set thread context of 2620	2852	svzhost.exe	svzhost.exe
PID 3052 set thread context of 1764	3052	svzhost.exe	svzhost.exe

UPX packed file 23 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2868-0-0x0000000000400000-0x00000000004E5000-memory.dmp	upx
C:\Users\Admin\AppData\Roaming\svzhost.exe	upx
behavioral1/memory/2868-11-0x0000000004200000-0x00000000042E5000-memory.dmp	upx
behavioral1/memory/316-23-0x0000000000400000-0x00000000004C7000-memory.dmp	upx
behavioral1/memory/316-25-0x0000000000400000-0x00000000004C7000-memory.dmp	upx
behavioral1/memory/316-26-0x0000000000400000-0x00000000004C7000-memory.dmp	upx
behavioral1/memory/3008-64-0x0000000000400000-0x00000000004E5000-memory.dmp	upx
behavioral1/memory/316-62-0x00000000044B0000-0x0000000004595000-memory.dmp	upx
behavioral1/memory/316-69-0x0000000000400000-0x00000000004C7000-memory.dmp	upx
behavioral1/memory/2648-82-0x0000000000400000-0x00000000004C7000-memory.dmp	upx
behavioral1/memory/2648-84-0x0000000000400000-0x00000000004C7000-memory.dmp	upx
behavioral1/memory/2648-83-0x0000000000400000-0x00000000004C7000-memory.dmp	upx
behavioral1/memory/2868-81-0x0000000000400000-0x00000000004E5000-memory.dmp	upx
behavioral1/memory/2648-85-0x0000000000400000-0x00000000004C7000-memory.dmp	upx
behavioral1/memory/2648-86-0x0000000000400000-0x00000000004C7000-memory.dmp	upx
behavioral1/memory/2868-129-0x0000000000400000-0x00000000004E5000-memory.dmp	upx
behavioral1/memory/2620-135-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2852-140-0x0000000000400000-0x00000000004E5000-memory.dmp	upx
behavioral1/memory/1764-149-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/3008-151-0x0000000000400000-0x00000000004E5000-memory.dmp	upx
behavioral1/memory/3052-153-0x0000000000400000-0x00000000004E5000-memory.dmp	upx
behavioral1/memory/2648-154-0x0000000000400000-0x00000000004C7000-memory.dmp	upx
behavioral1/memory/2620-157-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 28 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

8f62b86a64556d62d3192bf4a1ad6660_JaffaCakes118.exeattrib.exeattrib.exeipconfig.execmd.exesvzhost.execmd.exenotepad.exeieexp.exeipconfig.exeipconfig.exesvzhost.execmd.execmd.execmd.execmd.execmd.execmd.exeipconfig.exeipconfig.exesvzhost.exeipconfig.exenotepad.exeipconfig.execmd.execmd.exesvzhost.exeipconfig.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8f62b86a64556d62d3192bf4a1ad6660_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svzhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ieexp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svzhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svzhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svzhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe

Gathers network information 2 TTPs 8 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command and Scripting Interpreter
T1059

Processes:

ipconfig.exeipconfig.exeipconfig.exeipconfig.exeipconfig.exeipconfig.exeipconfig.exeipconfig.exe

pid process

1968 ipconfig.exe
1576 ipconfig.exe
2196 ipconfig.exe
2808 ipconfig.exe
2956 ipconfig.exe
2736 ipconfig.exe
2388 ipconfig.exe
2556 ipconfig.exe

pid	process
1968	ipconfig.exe
1576	ipconfig.exe
2196	ipconfig.exe
2808	ipconfig.exe
2956	ipconfig.exe
2736	ipconfig.exe
2388	ipconfig.exe
2556	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

Processes:

svzhost.exesvzhost.exe

pid	process
2852	svzhost.exe
2852	svzhost.exe
2852	svzhost.exe
2852	svzhost.exe
2852	svzhost.exe
3052	svzhost.exe
3052	svzhost.exe
3052	svzhost.exe
3052	svzhost.exe
3052	svzhost.exe
2852	svzhost.exe
2852	svzhost.exe
2852	svzhost.exe
2852	svzhost.exe
2852	svzhost.exe
2852	svzhost.exe
2852	svzhost.exe
2852	svzhost.exe
2852	svzhost.exe
2852	svzhost.exe
2852	svzhost.exe
2852	svzhost.exe
2852	svzhost.exe
2852	svzhost.exe
2852	svzhost.exe
3052	svzhost.exe
3052	svzhost.exe
3052	svzhost.exe
3052	svzhost.exe
3052	svzhost.exe
3052	svzhost.exe
3052	svzhost.exe
3052	svzhost.exe
3052	svzhost.exe
3052	svzhost.exe
3052	svzhost.exe
3052	svzhost.exe
3052	svzhost.exe
3052	svzhost.exe
3052	svzhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

svzhost.exe

pid process

2648 svzhost.exe

pid	process
2648	svzhost.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

svzhost.exesvzhost.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	316	svzhost.exe
Token: SeSecurityPrivilege	316	svzhost.exe
Token: SeTakeOwnershipPrivilege	316	svzhost.exe
Token: SeLoadDriverPrivilege	316	svzhost.exe
Token: SeSystemProfilePrivilege	316	svzhost.exe
Token: SeSystemtimePrivilege	316	svzhost.exe
Token: SeProfSingleProcessPrivilege	316	svzhost.exe
Token: SeIncBasePriorityPrivilege	316	svzhost.exe
Token: SeCreatePagefilePrivilege	316	svzhost.exe
Token: SeBackupPrivilege	316	svzhost.exe
Token: SeRestorePrivilege	316	svzhost.exe
Token: SeShutdownPrivilege	316	svzhost.exe
Token: SeDebugPrivilege	316	svzhost.exe
Token: SeSystemEnvironmentPrivilege	316	svzhost.exe
Token: SeChangeNotifyPrivilege	316	svzhost.exe
Token: SeRemoteShutdownPrivilege	316	svzhost.exe
Token: SeUndockPrivilege	316	svzhost.exe
Token: SeManageVolumePrivilege	316	svzhost.exe
Token: SeImpersonatePrivilege	316	svzhost.exe
Token: SeCreateGlobalPrivilege	316	svzhost.exe
Token: 33	316	svzhost.exe
Token: 34	316	svzhost.exe
Token: 35	316	svzhost.exe
Token: SeIncreaseQuotaPrivilege	2648	svzhost.exe
Token: SeSecurityPrivilege	2648	svzhost.exe
Token: SeTakeOwnershipPrivilege	2648	svzhost.exe
Token: SeLoadDriverPrivilege	2648	svzhost.exe
Token: SeSystemProfilePrivilege	2648	svzhost.exe
Token: SeSystemtimePrivilege	2648	svzhost.exe
Token: SeProfSingleProcessPrivilege	2648	svzhost.exe
Token: SeIncBasePriorityPrivilege	2648	svzhost.exe
Token: SeCreatePagefilePrivilege	2648	svzhost.exe
Token: SeBackupPrivilege	2648	svzhost.exe
Token: SeRestorePrivilege	2648	svzhost.exe
Token: SeShutdownPrivilege	2648	svzhost.exe
Token: SeDebugPrivilege	2648	svzhost.exe
Token: SeSystemEnvironmentPrivilege	2648	svzhost.exe
Token: SeChangeNotifyPrivilege	2648	svzhost.exe
Token: SeRemoteShutdownPrivilege	2648	svzhost.exe
Token: SeUndockPrivilege	2648	svzhost.exe
Token: SeManageVolumePrivilege	2648	svzhost.exe
Token: SeImpersonatePrivilege	2648	svzhost.exe
Token: SeCreateGlobalPrivilege	2648	svzhost.exe
Token: 33	2648	svzhost.exe
Token: 34	2648	svzhost.exe
Token: 35	2648	svzhost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

svzhost.exe

pid process

2648 svzhost.exe

pid	process
2648	svzhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

8f62b86a64556d62d3192bf4a1ad6660_JaffaCakes118.execmd.execmd.exesvzhost.execmd.execmd.exesvzhost.exe

description	pid	process	target process
PID 2868 wrote to memory of 2936	2868	8f62b86a64556d62d3192bf4a1ad6660_JaffaCakes118.exe	cmd.exe
PID 2868 wrote to memory of 2936	2868	8f62b86a64556d62d3192bf4a1ad6660_JaffaCakes118.exe	cmd.exe
PID 2868 wrote to memory of 2936	2868	8f62b86a64556d62d3192bf4a1ad6660_JaffaCakes118.exe	cmd.exe
PID 2868 wrote to memory of 2936	2868	8f62b86a64556d62d3192bf4a1ad6660_JaffaCakes118.exe	cmd.exe
PID 2936 wrote to memory of 2808	2936	cmd.exe	ipconfig.exe
PID 2936 wrote to memory of 2808	2936	cmd.exe	ipconfig.exe
PID 2936 wrote to memory of 2808	2936	cmd.exe	ipconfig.exe
PID 2936 wrote to memory of 2808	2936	cmd.exe	ipconfig.exe
PID 2868 wrote to memory of 2684	2868	8f62b86a64556d62d3192bf4a1ad6660_JaffaCakes118.exe	cmd.exe
PID 2868 wrote to memory of 2684	2868	8f62b86a64556d62d3192bf4a1ad6660_JaffaCakes118.exe	cmd.exe
PID 2868 wrote to memory of 2684	2868	8f62b86a64556d62d3192bf4a1ad6660_JaffaCakes118.exe	cmd.exe
PID 2868 wrote to memory of 2684	2868	8f62b86a64556d62d3192bf4a1ad6660_JaffaCakes118.exe	cmd.exe
PID 2684 wrote to memory of 2956	2684	cmd.exe	ipconfig.exe
PID 2684 wrote to memory of 2956	2684	cmd.exe	ipconfig.exe
PID 2684 wrote to memory of 2956	2684	cmd.exe	ipconfig.exe
PID 2684 wrote to memory of 2956	2684	cmd.exe	ipconfig.exe
PID 2868 wrote to memory of 2852	2868	8f62b86a64556d62d3192bf4a1ad6660_JaffaCakes118.exe	svzhost.exe
PID 2868 wrote to memory of 2852	2868	8f62b86a64556d62d3192bf4a1ad6660_JaffaCakes118.exe	svzhost.exe
PID 2868 wrote to memory of 2852	2868	8f62b86a64556d62d3192bf4a1ad6660_JaffaCakes118.exe	svzhost.exe
PID 2868 wrote to memory of 2852	2868	8f62b86a64556d62d3192bf4a1ad6660_JaffaCakes118.exe	svzhost.exe
PID 2852 wrote to memory of 2688	2852	svzhost.exe	cmd.exe
PID 2852 wrote to memory of 2688	2852	svzhost.exe	cmd.exe
PID 2852 wrote to memory of 2688	2852	svzhost.exe	cmd.exe
PID 2852 wrote to memory of 2688	2852	svzhost.exe	cmd.exe
PID 2688 wrote to memory of 2736	2688	cmd.exe	ipconfig.exe
PID 2688 wrote to memory of 2736	2688	cmd.exe	ipconfig.exe
PID 2688 wrote to memory of 2736	2688	cmd.exe	ipconfig.exe
PID 2688 wrote to memory of 2736	2688	cmd.exe	ipconfig.exe
PID 2852 wrote to memory of 2528	2852	svzhost.exe	cmd.exe
PID 2852 wrote to memory of 2528	2852	svzhost.exe	cmd.exe
PID 2852 wrote to memory of 2528	2852	svzhost.exe	cmd.exe
PID 2852 wrote to memory of 2528	2852	svzhost.exe	cmd.exe
PID 2528 wrote to memory of 2388	2528	cmd.exe	ipconfig.exe
PID 2528 wrote to memory of 2388	2528	cmd.exe	ipconfig.exe
PID 2528 wrote to memory of 2388	2528	cmd.exe	ipconfig.exe
PID 2528 wrote to memory of 2388	2528	cmd.exe	ipconfig.exe
PID 2852 wrote to memory of 316	2852	svzhost.exe	svzhost.exe
PID 2852 wrote to memory of 316	2852	svzhost.exe	svzhost.exe
PID 2852 wrote to memory of 316	2852	svzhost.exe	svzhost.exe
PID 2852 wrote to memory of 316	2852	svzhost.exe	svzhost.exe
PID 2852 wrote to memory of 316	2852	svzhost.exe	svzhost.exe
PID 2852 wrote to memory of 316	2852	svzhost.exe	svzhost.exe
PID 316 wrote to memory of 2900	316	svzhost.exe	cmd.exe
PID 316 wrote to memory of 2900	316	svzhost.exe	cmd.exe
PID 316 wrote to memory of 2900	316	svzhost.exe	cmd.exe
PID 316 wrote to memory of 2900	316	svzhost.exe	cmd.exe
PID 316 wrote to memory of 2548	316	svzhost.exe	cmd.exe
PID 316 wrote to memory of 2548	316	svzhost.exe	cmd.exe
PID 316 wrote to memory of 2548	316	svzhost.exe	cmd.exe
PID 316 wrote to memory of 2548	316	svzhost.exe	cmd.exe
PID 316 wrote to memory of 1732	316	svzhost.exe	notepad.exe
PID 316 wrote to memory of 1732	316	svzhost.exe	notepad.exe
PID 316 wrote to memory of 1732	316	svzhost.exe	notepad.exe
PID 316 wrote to memory of 1732	316	svzhost.exe	notepad.exe
PID 316 wrote to memory of 1732	316	svzhost.exe	notepad.exe
PID 316 wrote to memory of 1732	316	svzhost.exe	notepad.exe
PID 316 wrote to memory of 1732	316	svzhost.exe	notepad.exe
PID 316 wrote to memory of 1732	316	svzhost.exe	notepad.exe
PID 316 wrote to memory of 1732	316	svzhost.exe	notepad.exe
PID 316 wrote to memory of 1732	316	svzhost.exe	notepad.exe
PID 316 wrote to memory of 1732	316	svzhost.exe	notepad.exe
PID 316 wrote to memory of 1732	316	svzhost.exe	notepad.exe
PID 316 wrote to memory of 1732	316	svzhost.exe	notepad.exe
PID 316 wrote to memory of 1732	316	svzhost.exe	notepad.exe

Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

2764 attrib.exe
3048 attrib.exe

pid	process
2764	attrib.exe
3048	attrib.exe

C:\Users\Admin\AppData\Local\Temp\8f62b86a64556d62d3192bf4a1ad6660_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8f62b86a64556d62d3192bf4a1ad6660_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C ipconfig /flushdns
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2936
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - System Location Discovery: System Language Discovery
    - Gathers network information
    PID:2808
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C ipconfig /flushdns
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - System Location Discovery: System Language Discovery
    - Gathers network information
    PID:2956
- C:\Users\Admin\AppData\Roaming\svzhost.exe
  C:\Users\Admin\AppData\Roaming\svzhost.exe
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Enumerates connected drives
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /C ipconfig /flushdns
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2688
  - - C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /flushdns
      4⤵
      System Location Discovery: System Language Discovery
      Gathers network information
      PID:2736
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /C ipconfig /flushdns
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2528
  - - C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /flushdns
      4⤵
      System Location Discovery: System Language Discovery
      Gathers network information
      PID:2388
- - C:\Users\Admin\AppData\Roaming\svzhost.exe
    "C:\Users\Admin\AppData\Roaming\svzhost.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:316
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming\svzhost.exe" +s +h
      4⤵
      System Location Discovery: System Language Discovery
      PID:2900
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Users\Admin\AppData\Roaming\svzhost.exe" +s +h
        5⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:2764
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Roaming" +s +h
      4⤵
      System Location Discovery: System Language Discovery
      PID:2548
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib "C:\Users\Admin\AppData\Roaming" +s +h
        5⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:3048
  - - C:\Windows\SysWOW64\notepad.exe
      notepad
      4⤵
      System Location Discovery: System Language Discovery
      PID:1732
  - - C:\Windows\SysWOW64\IE Explorer\ieexp.exe
      "C:\Windows\system32\IE Explorer\ieexp.exe"
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      Adds Run key to start application
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      PID:3008
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /C ipconfig /flushdns
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2544
      - C:\Windows\SysWOW64\ipconfig.exe
        
        ipconfig /flushdns
        6⤵
        System Location Discovery: System Language Discovery
        Gathers network information
        
        PID:2556
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /C ipconfig /flushdns
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2508
      - C:\Windows\SysWOW64\ipconfig.exe
        
        ipconfig /flushdns
        6⤵
        System Location Discovery: System Language Discovery
        Gathers network information
        
        PID:1968
    - - C:\Users\Admin\AppData\Roaming\svzhost.exe
        
        C:\Users\Admin\AppData\Roaming\svzhost.exe
        5⤵
        Drops file in Drivers directory
        Executes dropped EXE
        Enumerates connected drives
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3052
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /C ipconfig /flushdns
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1424
        
        C:\Windows\SysWOW64\ipconfig.exe
        
        ipconfig /flushdns
        7⤵
        System Location Discovery: System Language Discovery
        Gathers network information
        
        PID:1576
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /C ipconfig /flushdns
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2056
        
        C:\Windows\SysWOW64\ipconfig.exe
        
        ipconfig /flushdns
        7⤵
        System Location Discovery: System Language Discovery
        Gathers network information
        
        PID:2196
      - C:\Users\Admin\AppData\Roaming\svzhost.exe
        
        "C:\Users\Admin\AppData\Roaming\svzhost.exe"
        6⤵
        Disables RegEdit via registry modification
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2648
        
        C:\Windows\SysWOW64\notepad.exe
        
        notepad
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2136
      - C:\Users\Admin\AppData\Roaming\svzhost.exe
        
        "C:\Users\Admin\AppData\Roaming\svzhost.exe"
        6⤵
        Executes dropped EXE
        
        PID:1764
- - C:\Users\Admin\AppData\Roaming\svzhost.exe
    "C:\Users\Admin\AppData\Roaming\svzhost.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Hide Artifacts

2

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\svzhost.exe

Filesize
1.0MB

MD5
8f62b86a64556d62d3192bf4a1ad6660

SHA1
768b87bc641a42119f050c19a94493c908b310a7

SHA256
408b365717114ce6b406c8b1dfc8dbb49679a2c37758da2a399f2628346a8943

SHA512
131afb3f106e235649afec855e502212c255484b1b182493ae717300f65aec9f0c62ea5cc457cef6a616fac60ac8b0eb37403dc36aac95e8afc2b59796c11996

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
1KB

MD5
fb09c2b8ebdf4c1d59f0416a3f390eb8

SHA1
1506cf5fe983b5648ff08f4151e8a97e1e1904ef

SHA256
7d018f8bcd2903fac71a2290576670471e0a842ed672292365d873af18fefd9d

SHA512
66ea785b5ce4a2ba74df5f4059a1fd2678a75292f150922697bdc9a5e116911b3e45a2803408524ceda2d5231181e292cc1b6c83dbe2d8fb6c59bcbf89668f66

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
2KB

MD5
0691279ed7866d867d45f9b9e7415b8d

SHA1
fcc40f9c0de781b32ce9fbbe8c5c4ea26302c770

SHA256
4b8f3d2ceb8a4887d314c7675d8d6e14250feead67d59b1b1f1426858566941e

SHA512
cf8d2e0f1d1b5fb07f6f20ca72404df4d7ce322a873df342d90c76dc0ad10ba39074bcec294e99a7a8781ec8360d5872734664d86120638b77cf7757ff60d9f5

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
2KB

MD5
13f3e6f44495c972a430163ba720498a

SHA1
1049b3d9ccbcebea525ea967753db649b3afc389

SHA256
c2533fd0e8e7ac11732c22907be05021c1596c6629bb463849953d49011126d5

SHA512
065107e8c935f065876f653988110110d1cde5768dc55f2c1b9936cf4ac50e6f240cb04d6c5a9ec4ff9b80fa79fdec13bdac57efb1e46cf6484807507fe9a59d

Download Submit
memory/316-69-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/316-22-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/316-23-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/316-25-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/316-26-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/316-62-0x00000000044B0000-0x0000000004595000-memory.dmp

Filesize
916KB

Download
memory/316-20-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/1732-57-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/1732-29-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/1764-149-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2620-157-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2620-135-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2648-84-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2648-82-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2648-83-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2648-154-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2648-85-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2648-86-0x0000000000400000-0x00000000004C7000-memory.dmp

Filesize
796KB

Download
memory/2852-140-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2868-11-0x0000000004200000-0x00000000042E5000-memory.dmp

Filesize
916KB

Download
memory/2868-129-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2868-0-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/2868-81-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/3008-151-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/3008-64-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download
memory/3052-153-0x0000000000400000-0x00000000004E5000-memory.dmp

Filesize
916KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads