darkcomet | deef8627aa367994fa3e80cf2341e40cc5e76cbed492b0a0e57a60965a30d495

Analysis

max time kernel
149s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29-11-2024 07:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

afa960d772a3025176774141b7171fac_JaffaCakes118.exe
Size

987KB
MD5

afa960d772a3025176774141b7171fac
SHA1

8e40f89dd9a54938c1bdbe71e88c68d316d49ff5
SHA256

deef8627aa367994fa3e80cf2341e40cc5e76cbed492b0a0e57a60965a30d495
SHA512

1dc46fb8628454f1dce890569a27f0619e604427e0458cdf46e7645908fc00e0136ca6699c7a4faf2c9b8dac9fcc4c0680161f0081992f5d64b4fbf157c48836
SSDEEP

24576:1tARHJKlrUqX5MOnTm+CFO4QvQVTTY6Eb5S:1tAR8GqXlnS+CnQvATT2S

Score

10^/10

darkcomet discovery persistence rat spyware stealer trojan upx

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\Windupdt\\winupdate.exe"	DFNER.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	DFNER.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	winupdate.exe

Executes dropped EXE 4 IoCs

pid	Process
2376	DFNER.exe
2808	DFNER.exe
2864	winupdate.exe
2656	winupdate.exe

Loads dropped DLL 14 IoCs

pid	Process
3000	afa960d772a3025176774141b7171fac_JaffaCakes118.exe
3000	afa960d772a3025176774141b7171fac_JaffaCakes118.exe
3000	afa960d772a3025176774141b7171fac_JaffaCakes118.exe
3000	afa960d772a3025176774141b7171fac_JaffaCakes118.exe
3000	afa960d772a3025176774141b7171fac_JaffaCakes118.exe
2376	DFNER.exe
2808	DFNER.exe
2864	winupdate.exe
2864	winupdate.exe
2864	winupdate.exe
2864	winupdate.exe
2656	winupdate.exe
2656	winupdate.exe
2656	winupdate.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Users\\Admin\\AppData\\Roaming\\Windupdt\\winupdate.exe"	DFNER.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/3000-29-0x0000000000400000-0x00000000004AC000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2376 set thread context of 2808	2376	DFNER.exe	31
PID 2864 set thread context of 2656	2864	winupdate.exe	35

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3000-0-0x0000000000400000-0x00000000004AC000-memory.dmp	upx
behavioral1/memory/3000-29-0x0000000000400000-0x00000000004AC000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\zqThuSoVPZpYu.rpx	winupdate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DFNER.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winupdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	afa960d772a3025176774141b7171fac_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DFNER.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	winupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	winupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	winupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	winupdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	DFNER.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	DFNER.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	DFNER.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	DFNER.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	DFNER.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	winupdate.exe

Modifies registry class 44 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{11A5EF5F-3700-445F-84EF-391EFC098674}\1.0	DFNER.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{11A5EF5F-3700-445F-84EF-391EFC098674}\1.0\ = "KTBrvKLEhmZrN"	DFNER.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{11A5EF5F-3700-445F-84EF-391EFC098674}\1.0\FLAGS	DFNER.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6C2D265F-E3BA-469D-A1CC-F4901A5D264C}\TypeLib\ = "{11A5EF5F-3700-445F-84EF-391EFC098674}"	DFNER.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B4C7CEAC-2530-4E75-A626-3BDF747C8253}\ = "KTBrvKLEhmZrN.jRPkUyJabSTyj"	DFNER.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B4C7CEAC-2530-4E75-A626-3BDF747C8253}\ProgID\ = "KTBrvKLEhmZrN.jRPkUyJabSTyj"	DFNER.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B4C7CEAC-2530-4E75-A626-3BDF747C8253}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DFNER.exe"	DFNER.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B4C7CEAC-2530-4E75-A626-3BDF747C8253}\TypeLib	DFNER.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6C2D265F-E3BA-469D-A1CC-F4901A5D264C}\ProxyStubClsid	DFNER.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6C2D265F-E3BA-469D-A1CC-F4901A5D264C}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	DFNER.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{11A5EF5F-3700-445F-84EF-391EFC098674}\1.0\HELPDIR	DFNER.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{11A5EF5F-3700-445F-84EF-391EFC098674}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	DFNER.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6C2D265F-E3BA-469D-A1CC-F4901A5D264C}\ = "_jRPkUyJabSTyj"	DFNER.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B4C7CEAC-2530-4E75-A626-3BDF747C8253}\VERSION	DFNER.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B4C7CEAC-2530-4E75-A626-3BDF747C8253}\VERSION\ = "1.0"	DFNER.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{11A5EF5F-3700-445F-84EF-391EFC098674}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DFNER.exe"	DFNER.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6C2D265F-E3BA-469D-A1CC-F4901A5D264C}\TypeLib	DFNER.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6C2D265F-E3BA-469D-A1CC-F4901A5D264C}	DFNER.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6C2D265F-E3BA-469D-A1CC-F4901A5D264C}\ProxyStubClsid32	DFNER.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6C2D265F-E3BA-469D-A1CC-F4901A5D264C}\ = "_jRPkUyJabSTyj"	DFNER.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6C2D265F-E3BA-469D-A1CC-F4901A5D264C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	DFNER.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B4C7CEAC-2530-4E75-A626-3BDF747C8253}\Implemented Categories	DFNER.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{11A5EF5F-3700-445F-84EF-391EFC098674}	DFNER.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6C2D265F-E3BA-469D-A1CC-F4901A5D264C}\ProxyStubClsid32	DFNER.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B4C7CEAC-2530-4E75-A626-3BDF747C8253}\ProgID	DFNER.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\KTBrvKLEhmZrN.jRPkUyJabSTyj	DFNER.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{11A5EF5F-3700-445F-84EF-391EFC098674}\1.0\0	DFNER.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{11A5EF5F-3700-445F-84EF-391EFC098674}\1.0\0\win32	DFNER.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6C2D265F-E3BA-469D-A1CC-F4901A5D264C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	DFNER.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6C2D265F-E3BA-469D-A1CC-F4901A5D264C}\TypeLib\ = "{11A5EF5F-3700-445F-84EF-391EFC098674}"	DFNER.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B4C7CEAC-2530-4E75-A626-3BDF747C8253}	DFNER.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B4C7CEAC-2530-4E75-A626-3BDF747C8253}\LocalServer32	DFNER.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\KTBrvKLEhmZrN.jRPkUyJabSTyj\ = "KTBrvKLEhmZrN.jRPkUyJabSTyj"	DFNER.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\KTBrvKLEhmZrN.jRPkUyJabSTyj\Clsid\ = "{B4C7CEAC-2530-4E75-A626-3BDF747C8253}"	DFNER.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6C2D265F-E3BA-469D-A1CC-F4901A5D264C}\TypeLib\Version = "1.0"	DFNER.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6C2D265F-E3BA-469D-A1CC-F4901A5D264C}\TypeLib\Version = "1.0"	DFNER.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B4C7CEAC-2530-4E75-A626-3BDF747C8253}\TypeLib\ = "{11A5EF5F-3700-445F-84EF-391EFC098674}"	DFNER.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\KTBrvKLEhmZrN.jRPkUyJabSTyj\Clsid	DFNER.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6C2D265F-E3BA-469D-A1CC-F4901A5D264C}\ = "jRPkUyJabSTyj"	DFNER.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B4C7CEAC-2530-4E75-A626-3BDF747C8253}\Programmable	DFNER.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{11A5EF5F-3700-445F-84EF-391EFC098674}\1.0\FLAGS\ = "0"	DFNER.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6C2D265F-E3BA-469D-A1CC-F4901A5D264C}	DFNER.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6C2D265F-E3BA-469D-A1CC-F4901A5D264C}\TypeLib	DFNER.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B4C7CEAC-2530-4E75-A626-3BDF747C8253}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	DFNER.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2808	DFNER.exe
Token: SeSecurityPrivilege	2808	DFNER.exe
Token: SeTakeOwnershipPrivilege	2808	DFNER.exe
Token: SeLoadDriverPrivilege	2808	DFNER.exe
Token: SeSystemProfilePrivilege	2808	DFNER.exe
Token: SeSystemtimePrivilege	2808	DFNER.exe
Token: SeProfSingleProcessPrivilege	2808	DFNER.exe
Token: SeIncBasePriorityPrivilege	2808	DFNER.exe
Token: SeCreatePagefilePrivilege	2808	DFNER.exe
Token: SeBackupPrivilege	2808	DFNER.exe
Token: SeRestorePrivilege	2808	DFNER.exe
Token: SeShutdownPrivilege	2808	DFNER.exe
Token: SeDebugPrivilege	2808	DFNER.exe
Token: SeSystemEnvironmentPrivilege	2808	DFNER.exe
Token: SeChangeNotifyPrivilege	2808	DFNER.exe
Token: SeRemoteShutdownPrivilege	2808	DFNER.exe
Token: SeUndockPrivilege	2808	DFNER.exe
Token: SeManageVolumePrivilege	2808	DFNER.exe
Token: SeImpersonatePrivilege	2808	DFNER.exe
Token: SeCreateGlobalPrivilege	2808	DFNER.exe
Token: 33	2808	DFNER.exe
Token: 34	2808	DFNER.exe
Token: 35	2808	DFNER.exe
Token: SeIncreaseQuotaPrivilege	2656	winupdate.exe
Token: SeSecurityPrivilege	2656	winupdate.exe
Token: SeTakeOwnershipPrivilege	2656	winupdate.exe
Token: SeLoadDriverPrivilege	2656	winupdate.exe
Token: SeSystemProfilePrivilege	2656	winupdate.exe
Token: SeSystemtimePrivilege	2656	winupdate.exe
Token: SeProfSingleProcessPrivilege	2656	winupdate.exe
Token: SeIncBasePriorityPrivilege	2656	winupdate.exe
Token: SeCreatePagefilePrivilege	2656	winupdate.exe
Token: SeBackupPrivilege	2656	winupdate.exe
Token: SeRestorePrivilege	2656	winupdate.exe
Token: SeShutdownPrivilege	2656	winupdate.exe
Token: SeDebugPrivilege	2656	winupdate.exe
Token: SeSystemEnvironmentPrivilege	2656	winupdate.exe
Token: SeChangeNotifyPrivilege	2656	winupdate.exe
Token: SeRemoteShutdownPrivilege	2656	winupdate.exe
Token: SeUndockPrivilege	2656	winupdate.exe
Token: SeManageVolumePrivilege	2656	winupdate.exe
Token: SeImpersonatePrivilege	2656	winupdate.exe
Token: SeCreateGlobalPrivilege	2656	winupdate.exe
Token: 33	2656	winupdate.exe
Token: 34	2656	winupdate.exe
Token: 35	2656	winupdate.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2376	DFNER.exe
2864	winupdate.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 2376	3000	afa960d772a3025176774141b7171fac_JaffaCakes118.exe	30
PID 3000 wrote to memory of 2376	3000	afa960d772a3025176774141b7171fac_JaffaCakes118.exe	30
PID 3000 wrote to memory of 2376	3000	afa960d772a3025176774141b7171fac_JaffaCakes118.exe	30
PID 3000 wrote to memory of 2376	3000	afa960d772a3025176774141b7171fac_JaffaCakes118.exe	30
PID 2376 wrote to memory of 2808	2376	DFNER.exe	31
PID 2376 wrote to memory of 2808	2376	DFNER.exe	31
PID 2376 wrote to memory of 2808	2376	DFNER.exe	31
PID 2376 wrote to memory of 2808	2376	DFNER.exe	31
PID 2376 wrote to memory of 2808	2376	DFNER.exe	31
PID 2376 wrote to memory of 2808	2376	DFNER.exe	31
PID 2376 wrote to memory of 2808	2376	DFNER.exe	31
PID 2376 wrote to memory of 2808	2376	DFNER.exe	31
PID 2376 wrote to memory of 2808	2376	DFNER.exe	31
PID 2376 wrote to memory of 2808	2376	DFNER.exe	31
PID 2376 wrote to memory of 2808	2376	DFNER.exe	31
PID 2376 wrote to memory of 2808	2376	DFNER.exe	31
PID 2376 wrote to memory of 2808	2376	DFNER.exe	31
PID 2376 wrote to memory of 2808	2376	DFNER.exe	31
PID 2376 wrote to memory of 2808	2376	DFNER.exe	31
PID 2376 wrote to memory of 2828	2376	DFNER.exe	32
PID 2376 wrote to memory of 2828	2376	DFNER.exe	32
PID 2376 wrote to memory of 2828	2376	DFNER.exe	32
PID 2376 wrote to memory of 2828	2376	DFNER.exe	32
PID 2808 wrote to memory of 2864	2808	DFNER.exe	34
PID 2808 wrote to memory of 2864	2808	DFNER.exe	34
PID 2808 wrote to memory of 2864	2808	DFNER.exe	34
PID 2808 wrote to memory of 2864	2808	DFNER.exe	34
PID 2808 wrote to memory of 2864	2808	DFNER.exe	34
PID 2808 wrote to memory of 2864	2808	DFNER.exe	34
PID 2808 wrote to memory of 2864	2808	DFNER.exe	34
PID 2864 wrote to memory of 2656	2864	winupdate.exe	35
PID 2864 wrote to memory of 2656	2864	winupdate.exe	35
PID 2864 wrote to memory of 2656	2864	winupdate.exe	35
PID 2864 wrote to memory of 2656	2864	winupdate.exe	35
PID 2864 wrote to memory of 2656	2864	winupdate.exe	35
PID 2864 wrote to memory of 2656	2864	winupdate.exe	35
PID 2864 wrote to memory of 2656	2864	winupdate.exe	35
PID 2864 wrote to memory of 2656	2864	winupdate.exe	35
PID 2864 wrote to memory of 2656	2864	winupdate.exe	35
PID 2864 wrote to memory of 2656	2864	winupdate.exe	35
PID 2864 wrote to memory of 2656	2864	winupdate.exe	35
PID 2864 wrote to memory of 2656	2864	winupdate.exe	35
PID 2864 wrote to memory of 2656	2864	winupdate.exe	35
PID 2864 wrote to memory of 2656	2864	winupdate.exe	35
PID 2864 wrote to memory of 2656	2864	winupdate.exe	35
PID 2864 wrote to memory of 2656	2864	winupdate.exe	35
PID 2864 wrote to memory of 2656	2864	winupdate.exe	35
PID 2864 wrote to memory of 2656	2864	winupdate.exe	35

C:\Users\Admin\AppData\Local\Temp\afa960d772a3025176774141b7171fac_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\afa960d772a3025176774141b7171fac_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Users\Admin\AppData\Local\Temp\DFNER.exe
  "C:\Users\Admin\AppData\Local\Temp\DFNER.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Users\Admin\AppData\Local\Temp\DFNER.exe
    "C:\Users\Admin\AppData\Local\Temp\DFNER.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2808
  - - C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe
      "C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2864
    - - C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe
        
        "C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe"
        5⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious use of AdjustPrivilegeToken
        
        PID:2656
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\rserars.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\log.txt

Filesize
713KB

MD5
e7b749baaaf62f187e1a49871065e9ae

SHA1
e9d8788e73f9ed735bf6f0b96d5355c173e82992

SHA256
2611acbb63970b121fd03ab027c6a3415b5c47a86e1cb9fa556fb1d237c5a3a8

SHA512
6cc3fc1fb930e093c46e4ca6f3d06dc7b6806a051f007e8460b0303b5c4000d38c7170bdc2d7011f7d78e6350fe016f9774c9faaa5849bb7cf0d514fc8c67c72

Download Submit
C:\rserars.bat

Filesize
145B

MD5
457cced7a6b57d29373c684df02b7ce9

SHA1
c56976b326f42de4841369edbc6fb56cf9151723

SHA256
93200aff412fe035ce15e0437bc7f075860fd075a062c7b62bccc431e9d9e015

SHA512
a08dad4af9565898f6813878d93f012203eb5ece4f879bdd563fa84717f300f30fe59b6b5637a24997e3b79ebcb710018d54948cee17d0babb89cd56b722eb99

Download Submit
\Users\Admin\AppData\Local\Temp\DFNER.exe

Filesize
32KB

MD5
67a75cf7cebc7b3d2071e7884f8ebba9

SHA1
ac9de2f53c840dd8a8607eb135b8226272dc7781

SHA256
f321ed896779285be329a541bd4ab435fa9af86337b51f5c2b4479a92e6e9ac2

SHA512
547b19a7afe8ce5bb36da766488363c8aa1c570b6f33aab1d801b7ad2cc85b1555a11fa2adbf852b753f39af5f21c08c30866b75c309541c15805563b1ed8e5a

Download Submit
memory/2656-83-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/2656-84-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/2656-92-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/2656-91-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/2656-90-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/2656-89-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/2656-88-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/2656-87-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/2656-86-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/2656-70-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/2656-75-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/2656-76-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/2656-78-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/2656-77-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/2656-79-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/2656-80-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/2656-81-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/2656-82-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/2656-85-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/2808-35-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/2808-61-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/2808-49-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/2808-48-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/2808-47-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/2808-45-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/2808-43-0x0000000000400000-0x00000000004C0000-memory.dmp

Filesize
768KB

Download
memory/3000-0-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download
memory/3000-29-0x0000000000400000-0x00000000004AC000-memory.dmp

Filesize
688KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads