Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07-12-2024 19:22
Static task
static1
Behavioral task
behavioral1
Sample
d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe
-
Size
688KB
-
MD5
d3398c0f3840bd9f87a7cbc161c7a525
-
SHA1
482006b6d7e63f08376ccb36c0ddcac005ad052d
-
SHA256
1fa7e74c0d21f999c2f9ad0c080e324ac02b667d1b4814e766d55311b919c17f
-
SHA512
eb327bb376b54ee101f94999609bd3f7119edbaf9e5b6e214e1d1dd67349595e8fc67575904892b018fc39267d8d9dd30d4c9184580ec4f620c9e5516ac0b0e6
-
SSDEEP
12288:dzfULRmROHbwBqtOxbvuhgMtS/42LBEKIT87S0+ONA1TPK5LapDZrW:VfaR9GqcuKh/42tE/O+OuuyDZy
Malware Config
Signatures
-
Darkcomet family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windupdt\\winupdate.exe" d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe -
Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate winupdate.exe -
Executes dropped EXE 2 IoCs
pid Process 320 winupdate.exe 2820 winupdate.exe -
Loads dropped DLL 8 IoCs
pid Process 2072 d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe 320 winupdate.exe 320 winupdate.exe 320 winupdate.exe 320 winupdate.exe 2820 winupdate.exe 2820 winupdate.exe 2820 winupdate.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 2384 set thread context of 2072 2384 d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe 30 PID 2072 set thread context of 2124 2072 d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe 31 PID 2124 set thread context of 2376 2124 explorer.exe 32 PID 320 set thread context of 2820 320 winupdate.exe 34 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winupdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winupdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe -
Checks processor information in registry 2 TTPs 12 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 winupdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString winupdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier winupdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier winupdate.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier winupdate.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2072 d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe Token: SeSecurityPrivilege 2072 d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2072 d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe Token: SeLoadDriverPrivilege 2072 d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe Token: SeSystemProfilePrivilege 2072 d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe Token: SeSystemtimePrivilege 2072 d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 2072 d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2072 d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 2072 d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe Token: SeBackupPrivilege 2072 d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe Token: SeRestorePrivilege 2072 d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe Token: SeShutdownPrivilege 2072 d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe Token: SeDebugPrivilege 2072 d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 2072 d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 2072 d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 2072 d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe Token: SeUndockPrivilege 2072 d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe Token: SeManageVolumePrivilege 2072 d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe Token: SeImpersonatePrivilege 2072 d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 2072 d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe Token: 33 2072 d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe Token: 34 2072 d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe Token: 35 2072 d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 2376 explorer.exe Token: SeSecurityPrivilege 2376 explorer.exe Token: SeTakeOwnershipPrivilege 2376 explorer.exe Token: SeLoadDriverPrivilege 2376 explorer.exe Token: SeSystemProfilePrivilege 2376 explorer.exe Token: SeSystemtimePrivilege 2376 explorer.exe Token: SeProfSingleProcessPrivilege 2376 explorer.exe Token: SeIncBasePriorityPrivilege 2376 explorer.exe Token: SeCreatePagefilePrivilege 2376 explorer.exe Token: SeBackupPrivilege 2376 explorer.exe Token: SeRestorePrivilege 2376 explorer.exe Token: SeShutdownPrivilege 2376 explorer.exe Token: SeDebugPrivilege 2376 explorer.exe Token: SeSystemEnvironmentPrivilege 2376 explorer.exe Token: SeChangeNotifyPrivilege 2376 explorer.exe Token: SeRemoteShutdownPrivilege 2376 explorer.exe Token: SeUndockPrivilege 2376 explorer.exe Token: SeManageVolumePrivilege 2376 explorer.exe Token: SeImpersonatePrivilege 2376 explorer.exe Token: SeCreateGlobalPrivilege 2376 explorer.exe Token: 33 2376 explorer.exe Token: 34 2376 explorer.exe Token: 35 2376 explorer.exe Token: SeIncreaseQuotaPrivilege 2820 winupdate.exe Token: SeSecurityPrivilege 2820 winupdate.exe Token: SeTakeOwnershipPrivilege 2820 winupdate.exe Token: SeLoadDriverPrivilege 2820 winupdate.exe Token: SeSystemProfilePrivilege 2820 winupdate.exe Token: SeSystemtimePrivilege 2820 winupdate.exe Token: SeProfSingleProcessPrivilege 2820 winupdate.exe Token: SeIncBasePriorityPrivilege 2820 winupdate.exe Token: SeCreatePagefilePrivilege 2820 winupdate.exe Token: SeBackupPrivilege 2820 winupdate.exe Token: SeRestorePrivilege 2820 winupdate.exe Token: SeShutdownPrivilege 2820 winupdate.exe Token: SeDebugPrivilege 2820 winupdate.exe Token: SeSystemEnvironmentPrivilege 2820 winupdate.exe Token: SeChangeNotifyPrivilege 2820 winupdate.exe Token: SeRemoteShutdownPrivilege 2820 winupdate.exe Token: SeUndockPrivilege 2820 winupdate.exe Token: SeManageVolumePrivilege 2820 winupdate.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2820 winupdate.exe -
Suspicious use of WriteProcessMemory 34 IoCs
description pid Process procid_target PID 2384 wrote to memory of 2072 2384 d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe 30 PID 2384 wrote to memory of 2072 2384 d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe 30 PID 2384 wrote to memory of 2072 2384 d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe 30 PID 2384 wrote to memory of 2072 2384 d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe 30 PID 2384 wrote to memory of 2072 2384 d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe 30 PID 2384 wrote to memory of 2072 2384 d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe 30 PID 2072 wrote to memory of 2124 2072 d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe 31 PID 2072 wrote to memory of 2124 2072 d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe 31 PID 2072 wrote to memory of 2124 2072 d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe 31 PID 2072 wrote to memory of 2124 2072 d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe 31 PID 2072 wrote to memory of 2124 2072 d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe 31 PID 2072 wrote to memory of 2124 2072 d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe 31 PID 2124 wrote to memory of 2376 2124 explorer.exe 32 PID 2124 wrote to memory of 2376 2124 explorer.exe 32 PID 2124 wrote to memory of 2376 2124 explorer.exe 32 PID 2124 wrote to memory of 2376 2124 explorer.exe 32 PID 2124 wrote to memory of 2376 2124 explorer.exe 32 PID 2124 wrote to memory of 2376 2124 explorer.exe 32 PID 2072 wrote to memory of 320 2072 d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe 33 PID 2072 wrote to memory of 320 2072 d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe 33 PID 2072 wrote to memory of 320 2072 d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe 33 PID 2072 wrote to memory of 320 2072 d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe 33 PID 2072 wrote to memory of 320 2072 d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe 33 PID 2072 wrote to memory of 320 2072 d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe 33 PID 2072 wrote to memory of 320 2072 d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe 33 PID 320 wrote to memory of 2820 320 winupdate.exe 34 PID 320 wrote to memory of 2820 320 winupdate.exe 34 PID 320 wrote to memory of 2820 320 winupdate.exe 34 PID 320 wrote to memory of 2820 320 winupdate.exe 34 PID 320 wrote to memory of 2820 320 winupdate.exe 34 PID 320 wrote to memory of 2820 320 winupdate.exe 34 PID 320 wrote to memory of 2820 320 winupdate.exe 34 PID 320 wrote to memory of 2820 320 winupdate.exe 34 PID 320 wrote to memory of 2820 320 winupdate.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d3398c0f3840bd9f87a7cbc161c7a525_JaffaCakes118.exe2⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe4⤵
- Checks BIOS information in registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:2376
-
-
-
C:\Windupdt\winupdate.exe"C:\Windupdt\winupdate.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Windupdt\winupdate.exeC:\Windupdt\winupdate.exe4⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2820
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
688KB
MD5d3398c0f3840bd9f87a7cbc161c7a525
SHA1482006b6d7e63f08376ccb36c0ddcac005ad052d
SHA2561fa7e74c0d21f999c2f9ad0c080e324ac02b667d1b4814e766d55311b919c17f
SHA512eb327bb376b54ee101f94999609bd3f7119edbaf9e5b6e214e1d1dd67349595e8fc67575904892b018fc39267d8d9dd30d4c9184580ec4f620c9e5516ac0b0e6