Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
08-12-2024 03:10
Static task
static1
Behavioral task
behavioral1
Sample
d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe
-
Size
1.5MB
-
MD5
d4f8d53ffbf0c21128a5c2953f67a0e5
-
SHA1
a2e9410274669cd1c7fc8937975394feb1a93012
-
SHA256
a1e9d6e9b4eb9058d81ab0a6b5beb6da485968c3a112c697f5f0ff3df84cd7de
-
SHA512
14f4163e0f379def6c98dcdf2d1251b4aa404eae3ba402e52a658b66f162d669b722c82c9cbe9aeff9bf192a38ff9c1f616bf47befe8b0ab4e50d41779b01075
-
SSDEEP
24576:TOj2AnBRfgw+ssVfvTcH561xxnGlsoXmMKIFQJvya1nB2FYqSw1AlMzz7QCoEEMW:TOrfgGs9vTcHo7Gg9nD2F9S3gz7toEEm
Malware Config
Signatures
-
Darkcomet family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\Windupdt\\google.exe" d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate google.exe -
Executes dropped EXE 2 IoCs
pid Process 2604 google.exe 2972 google.exe -
Loads dropped DLL 3 IoCs
pid Process 2640 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe 2640 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe 2604 google.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Users\\Admin\\AppData\\Roaming\\Windupdt\\google.exe" d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Users\\Admin\\AppData\\Roaming\\Windupdt\\google.exe" notepad.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2624 set thread context of 2640 2624 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe 30 PID 2604 set thread context of 2972 2604 google.exe 34 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language google.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language google.exe -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 google.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString google.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier google.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier google.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier google.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2972 google.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2640 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe Token: SeSecurityPrivilege 2640 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2640 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe Token: SeLoadDriverPrivilege 2640 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe Token: SeSystemProfilePrivilege 2640 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe Token: SeSystemtimePrivilege 2640 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 2640 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2640 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 2640 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe Token: SeBackupPrivilege 2640 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe Token: SeRestorePrivilege 2640 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe Token: SeShutdownPrivilege 2640 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe Token: SeDebugPrivilege 2640 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 2640 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 2640 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 2640 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe Token: SeUndockPrivilege 2640 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe Token: SeManageVolumePrivilege 2640 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe Token: SeImpersonatePrivilege 2640 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 2640 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe Token: 33 2640 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe Token: 34 2640 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe Token: 35 2640 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 2972 google.exe Token: SeSecurityPrivilege 2972 google.exe Token: SeTakeOwnershipPrivilege 2972 google.exe Token: SeLoadDriverPrivilege 2972 google.exe Token: SeSystemProfilePrivilege 2972 google.exe Token: SeSystemtimePrivilege 2972 google.exe Token: SeProfSingleProcessPrivilege 2972 google.exe Token: SeIncBasePriorityPrivilege 2972 google.exe Token: SeCreatePagefilePrivilege 2972 google.exe Token: SeBackupPrivilege 2972 google.exe Token: SeRestorePrivilege 2972 google.exe Token: SeShutdownPrivilege 2972 google.exe Token: SeDebugPrivilege 2972 google.exe Token: SeSystemEnvironmentPrivilege 2972 google.exe Token: SeChangeNotifyPrivilege 2972 google.exe Token: SeRemoteShutdownPrivilege 2972 google.exe Token: SeUndockPrivilege 2972 google.exe Token: SeManageVolumePrivilege 2972 google.exe Token: SeImpersonatePrivilege 2972 google.exe Token: SeCreateGlobalPrivilege 2972 google.exe Token: 33 2972 google.exe Token: 34 2972 google.exe Token: 35 2972 google.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2624 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe 2604 google.exe 2972 google.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2624 wrote to memory of 2640 2624 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe 30 PID 2624 wrote to memory of 2640 2624 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe 30 PID 2624 wrote to memory of 2640 2624 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe 30 PID 2624 wrote to memory of 2640 2624 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe 30 PID 2624 wrote to memory of 2640 2624 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe 30 PID 2624 wrote to memory of 2640 2624 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe 30 PID 2624 wrote to memory of 2640 2624 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe 30 PID 2624 wrote to memory of 2640 2624 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe 30 PID 2624 wrote to memory of 2640 2624 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe 30 PID 2624 wrote to memory of 2640 2624 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe 30 PID 2624 wrote to memory of 2640 2624 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe 30 PID 2624 wrote to memory of 2640 2624 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe 30 PID 2624 wrote to memory of 2640 2624 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe 30 PID 2640 wrote to memory of 2880 2640 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe 31 PID 2640 wrote to memory of 2880 2640 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe 31 PID 2640 wrote to memory of 2880 2640 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe 31 PID 2640 wrote to memory of 2880 2640 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe 31 PID 2640 wrote to memory of 2880 2640 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe 31 PID 2640 wrote to memory of 2880 2640 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe 31 PID 2640 wrote to memory of 2880 2640 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe 31 PID 2640 wrote to memory of 2880 2640 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe 31 PID 2640 wrote to memory of 2880 2640 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe 31 PID 2640 wrote to memory of 2880 2640 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe 31 PID 2640 wrote to memory of 2880 2640 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe 31 PID 2640 wrote to memory of 2880 2640 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe 31 PID 2640 wrote to memory of 2880 2640 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe 31 PID 2640 wrote to memory of 2880 2640 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe 31 PID 2640 wrote to memory of 2880 2640 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe 31 PID 2640 wrote to memory of 2880 2640 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe 31 PID 2640 wrote to memory of 2880 2640 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe 31 PID 2640 wrote to memory of 2880 2640 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe 31 PID 2640 wrote to memory of 2880 2640 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe 31 PID 2640 wrote to memory of 2880 2640 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe 31 PID 2640 wrote to memory of 2880 2640 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe 31 PID 2640 wrote to memory of 2880 2640 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe 31 PID 2640 wrote to memory of 2880 2640 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe 31 PID 2640 wrote to memory of 2880 2640 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe 31 PID 2640 wrote to memory of 2544 2640 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe 32 PID 2640 wrote to memory of 2544 2640 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe 32 PID 2640 wrote to memory of 2544 2640 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe 32 PID 2640 wrote to memory of 2544 2640 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe 32 PID 2640 wrote to memory of 2604 2640 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe 33 PID 2640 wrote to memory of 2604 2640 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe 33 PID 2640 wrote to memory of 2604 2640 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe 33 PID 2640 wrote to memory of 2604 2640 d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe 33 PID 2604 wrote to memory of 2972 2604 google.exe 34 PID 2604 wrote to memory of 2972 2604 google.exe 34 PID 2604 wrote to memory of 2972 2604 google.exe 34 PID 2604 wrote to memory of 2972 2604 google.exe 34 PID 2604 wrote to memory of 2972 2604 google.exe 34 PID 2604 wrote to memory of 2972 2604 google.exe 34 PID 2604 wrote to memory of 2972 2604 google.exe 34 PID 2604 wrote to memory of 2972 2604 google.exe 34 PID 2604 wrote to memory of 2972 2604 google.exe 34 PID 2604 wrote to memory of 2972 2604 google.exe 34 PID 2604 wrote to memory of 2972 2604 google.exe 34 PID 2604 wrote to memory of 2972 2604 google.exe 34 PID 2604 wrote to memory of 2972 2604 google.exe 34 PID 2972 wrote to memory of 2516 2972 google.exe 35 PID 2972 wrote to memory of 2516 2972 google.exe 35 PID 2972 wrote to memory of 2516 2972 google.exe 35 PID 2972 wrote to memory of 2516 2972 google.exe 35 PID 2972 wrote to memory of 2516 2972 google.exe 35 PID 2972 wrote to memory of 2516 2972 google.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\d4f8d53ffbf0c21128a5c2953f67a0e5_JaffaCakes118.exe2⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\SysWOW64\notepad.exenotepad3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2880
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"3⤵PID:2544
-
-
C:\Users\Admin\AppData\Roaming\Windupdt\google.exe"C:\Users\Admin\AppData\Roaming\Windupdt\google.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Roaming\Windupdt\google.exeC:\Users\Admin\AppData\Roaming\Windupdt\google.exe4⤵
- Checks BIOS information in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Windows\SysWOW64\notepad.exeC:\Windows\SysWOW64\notepad.exe5⤵
- System Location Discovery: System Language Discovery
PID:2516
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD5d4f8d53ffbf0c21128a5c2953f67a0e5
SHA1a2e9410274669cd1c7fc8937975394feb1a93012
SHA256a1e9d6e9b4eb9058d81ab0a6b5beb6da485968c3a112c697f5f0ff3df84cd7de
SHA51214f4163e0f379def6c98dcdf2d1251b4aa404eae3ba402e52a658b66f162d669b722c82c9cbe9aeff9bf192a38ff9c1f616bf47befe8b0ab4e50d41779b01075