Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08-12-2024 06:38
Static task
static1
Behavioral task
behavioral1
Sample
d5b85283195556e522c8b5627369aba1_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
d5b85283195556e522c8b5627369aba1_JaffaCakes118.exe
-
Size
627KB
-
MD5
d5b85283195556e522c8b5627369aba1
-
SHA1
efbf8a337eb8acbcd2e844cc37a9792a36d55123
-
SHA256
e6af143bd96b2d461248f6a9116375f0179faff9c7a4b146dc2d34f41eda34e3
-
SHA512
e8ad79ab0593919fd6a7c592232496a0859ae29b61b1a7cfedd31fb334c3b557f6ab39b51110458df13b2f713f936f2e27564ff74888e793005c2b5cdfe6e6a6
-
SSDEEP
12288:YbRL99DE+UxcqH4siLPndzMo+RV7+d1mDT0t9P9KD8A/hJaF:qRRx7qHyvdzVM7W1BfP95C0
Malware Config
Extracted
darkcomet
Slave
katygarismova123.no-ip.biz:200
DC_MUTEX-MBWJM88
-
gencode
JMUmoo8nTYeT
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Darkcomet family
-
Executes dropped EXE 1 IoCs
pid Process 1692 Service -
Loads dropped DLL 1 IoCs
pid Process 2960 d5b85283195556e522c8b5627369aba1_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\rundll32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\rundll32.exe" d5b85283195556e522c8b5627369aba1_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2960 set thread context of 1692 2960 d5b85283195556e522c8b5627369aba1_JaffaCakes118.exe 30 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d5b85283195556e522c8b5627369aba1_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Service Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2960 d5b85283195556e522c8b5627369aba1_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1692 Service -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeDebugPrivilege 2960 d5b85283195556e522c8b5627369aba1_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 1692 Service Token: SeSecurityPrivilege 1692 Service Token: SeTakeOwnershipPrivilege 1692 Service Token: SeLoadDriverPrivilege 1692 Service Token: SeSystemProfilePrivilege 1692 Service Token: SeSystemtimePrivilege 1692 Service Token: SeProfSingleProcessPrivilege 1692 Service Token: SeIncBasePriorityPrivilege 1692 Service Token: SeCreatePagefilePrivilege 1692 Service Token: SeBackupPrivilege 1692 Service Token: SeRestorePrivilege 1692 Service Token: SeShutdownPrivilege 1692 Service Token: SeDebugPrivilege 1692 Service Token: SeSystemEnvironmentPrivilege 1692 Service Token: SeChangeNotifyPrivilege 1692 Service Token: SeRemoteShutdownPrivilege 1692 Service Token: SeUndockPrivilege 1692 Service Token: SeManageVolumePrivilege 1692 Service Token: SeImpersonatePrivilege 1692 Service Token: SeCreateGlobalPrivilege 1692 Service Token: 33 1692 Service Token: 34 1692 Service Token: 35 1692 Service -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1692 Service -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 2960 wrote to memory of 1692 2960 d5b85283195556e522c8b5627369aba1_JaffaCakes118.exe 30 PID 2960 wrote to memory of 1692 2960 d5b85283195556e522c8b5627369aba1_JaffaCakes118.exe 30 PID 2960 wrote to memory of 1692 2960 d5b85283195556e522c8b5627369aba1_JaffaCakes118.exe 30 PID 2960 wrote to memory of 1692 2960 d5b85283195556e522c8b5627369aba1_JaffaCakes118.exe 30 PID 2960 wrote to memory of 1692 2960 d5b85283195556e522c8b5627369aba1_JaffaCakes118.exe 30 PID 2960 wrote to memory of 1692 2960 d5b85283195556e522c8b5627369aba1_JaffaCakes118.exe 30 PID 2960 wrote to memory of 1692 2960 d5b85283195556e522c8b5627369aba1_JaffaCakes118.exe 30 PID 2960 wrote to memory of 1692 2960 d5b85283195556e522c8b5627369aba1_JaffaCakes118.exe 30 PID 2960 wrote to memory of 1692 2960 d5b85283195556e522c8b5627369aba1_JaffaCakes118.exe 30 PID 2960 wrote to memory of 1692 2960 d5b85283195556e522c8b5627369aba1_JaffaCakes118.exe 30 PID 2960 wrote to memory of 1692 2960 d5b85283195556e522c8b5627369aba1_JaffaCakes118.exe 30 PID 2960 wrote to memory of 1692 2960 d5b85283195556e522c8b5627369aba1_JaffaCakes118.exe 30 PID 2960 wrote to memory of 1692 2960 d5b85283195556e522c8b5627369aba1_JaffaCakes118.exe 30 PID 1692 wrote to memory of 2276 1692 Service 31 PID 1692 wrote to memory of 2276 1692 Service 31 PID 1692 wrote to memory of 2276 1692 Service 31 PID 1692 wrote to memory of 2276 1692 Service 31 PID 1692 wrote to memory of 2276 1692 Service 31 PID 1692 wrote to memory of 2276 1692 Service 31 PID 1692 wrote to memory of 2276 1692 Service 31 PID 1692 wrote to memory of 2276 1692 Service 31 PID 1692 wrote to memory of 2276 1692 Service 31 PID 1692 wrote to memory of 2276 1692 Service 31 PID 1692 wrote to memory of 2276 1692 Service 31 PID 1692 wrote to memory of 2276 1692 Service 31 PID 1692 wrote to memory of 2276 1692 Service 31 PID 1692 wrote to memory of 2276 1692 Service 31 PID 1692 wrote to memory of 2276 1692 Service 31 PID 1692 wrote to memory of 2276 1692 Service 31 PID 1692 wrote to memory of 2276 1692 Service 31 PID 1692 wrote to memory of 2276 1692 Service 31 PID 1692 wrote to memory of 2276 1692 Service 31 PID 1692 wrote to memory of 2276 1692 Service 31 PID 1692 wrote to memory of 2276 1692 Service 31 PID 1692 wrote to memory of 2276 1692 Service 31 PID 1692 wrote to memory of 2276 1692 Service 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\d5b85283195556e522c8b5627369aba1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d5b85283195556e522c8b5627369aba1_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\App\ServiceC:\Users\Admin\AppData\Local\Temp\\App\Service2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\SysWOW64\notepad.exenotepad3⤵
- System Location Discovery: System Language Discovery
PID:2276
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98