Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
04-12-2024 12:09
Behavioral task
behavioral1
Sample
c277d0a5a965dce18cd1cbb8d2f3a5e3_JaffaCakes118.exe
Resource
win7-20241010-en
General
-
Target
c277d0a5a965dce18cd1cbb8d2f3a5e3_JaffaCakes118.exe
-
Size
689KB
-
MD5
c277d0a5a965dce18cd1cbb8d2f3a5e3
-
SHA1
82b92c6fe724f1301d29704fed1989b72891ed40
-
SHA256
f6386883708be6c0ac2fc8361a134e5a6df42349dd79dfcc6f52706636952970
-
SHA512
fe4089c12fd45fc0230ff50425f13e595aa185d4563639b6ed9724774fcfde4e63e6910fadf304a0e3dbc5adfbe1f8cd5229ffa2e3123287957e9badc683f299
-
SSDEEP
12288:u9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLd9Ek5C/h7l2:6Z1xuVVjfFoynPaVBUR8f+kN1PEB2
Malware Config
Extracted
darkcomet
Guest16
virus0707.no-ip.org:81
DC_MUTEX-SEKEYCR
-
gencode
8sXT6d4dnuzp
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Darkcomet family
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c277d0a5a965dce18cd1cbb8d2f3a5e3_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4412 c277d0a5a965dce18cd1cbb8d2f3a5e3_JaffaCakes118.exe Token: SeSecurityPrivilege 4412 c277d0a5a965dce18cd1cbb8d2f3a5e3_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 4412 c277d0a5a965dce18cd1cbb8d2f3a5e3_JaffaCakes118.exe Token: SeLoadDriverPrivilege 4412 c277d0a5a965dce18cd1cbb8d2f3a5e3_JaffaCakes118.exe Token: SeSystemProfilePrivilege 4412 c277d0a5a965dce18cd1cbb8d2f3a5e3_JaffaCakes118.exe Token: SeSystemtimePrivilege 4412 c277d0a5a965dce18cd1cbb8d2f3a5e3_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 4412 c277d0a5a965dce18cd1cbb8d2f3a5e3_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4412 c277d0a5a965dce18cd1cbb8d2f3a5e3_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 4412 c277d0a5a965dce18cd1cbb8d2f3a5e3_JaffaCakes118.exe Token: SeBackupPrivilege 4412 c277d0a5a965dce18cd1cbb8d2f3a5e3_JaffaCakes118.exe Token: SeRestorePrivilege 4412 c277d0a5a965dce18cd1cbb8d2f3a5e3_JaffaCakes118.exe Token: SeShutdownPrivilege 4412 c277d0a5a965dce18cd1cbb8d2f3a5e3_JaffaCakes118.exe Token: SeDebugPrivilege 4412 c277d0a5a965dce18cd1cbb8d2f3a5e3_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 4412 c277d0a5a965dce18cd1cbb8d2f3a5e3_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 4412 c277d0a5a965dce18cd1cbb8d2f3a5e3_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 4412 c277d0a5a965dce18cd1cbb8d2f3a5e3_JaffaCakes118.exe Token: SeUndockPrivilege 4412 c277d0a5a965dce18cd1cbb8d2f3a5e3_JaffaCakes118.exe Token: SeManageVolumePrivilege 4412 c277d0a5a965dce18cd1cbb8d2f3a5e3_JaffaCakes118.exe Token: SeImpersonatePrivilege 4412 c277d0a5a965dce18cd1cbb8d2f3a5e3_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 4412 c277d0a5a965dce18cd1cbb8d2f3a5e3_JaffaCakes118.exe Token: 33 4412 c277d0a5a965dce18cd1cbb8d2f3a5e3_JaffaCakes118.exe Token: 34 4412 c277d0a5a965dce18cd1cbb8d2f3a5e3_JaffaCakes118.exe Token: 35 4412 c277d0a5a965dce18cd1cbb8d2f3a5e3_JaffaCakes118.exe Token: 36 4412 c277d0a5a965dce18cd1cbb8d2f3a5e3_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4412 c277d0a5a965dce18cd1cbb8d2f3a5e3_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c277d0a5a965dce18cd1cbb8d2f3a5e3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c277d0a5a965dce18cd1cbb8d2f3a5e3_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4412