Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
08-12-2024 06:38
Static task
static1
Behavioral task
behavioral1
Sample
d5b85283195556e522c8b5627369aba1_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
d5b85283195556e522c8b5627369aba1_JaffaCakes118.exe
-
Size
627KB
-
MD5
d5b85283195556e522c8b5627369aba1
-
SHA1
efbf8a337eb8acbcd2e844cc37a9792a36d55123
-
SHA256
e6af143bd96b2d461248f6a9116375f0179faff9c7a4b146dc2d34f41eda34e3
-
SHA512
e8ad79ab0593919fd6a7c592232496a0859ae29b61b1a7cfedd31fb334c3b557f6ab39b51110458df13b2f713f936f2e27564ff74888e793005c2b5cdfe6e6a6
-
SSDEEP
12288:YbRL99DE+UxcqH4siLPndzMo+RV7+d1mDT0t9P9KD8A/hJaF:qRRx7qHyvdzVM7W1BfP95C0
Malware Config
Extracted
darkcomet
Slave
katygarismova123.no-ip.biz:200
DC_MUTEX-MBWJM88
-
gencode
JMUmoo8nTYeT
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Darkcomet family
-
Executes dropped EXE 1 IoCs
pid Process 2172 Service -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rundll32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\rundll32.exe" d5b85283195556e522c8b5627369aba1_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2456 set thread context of 2172 2456 d5b85283195556e522c8b5627369aba1_JaffaCakes118.exe 86 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d5b85283195556e522c8b5627369aba1_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Service Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2456 d5b85283195556e522c8b5627369aba1_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2172 Service -
Suspicious use of AdjustPrivilegeToken 25 IoCs
description pid Process Token: SeDebugPrivilege 2456 d5b85283195556e522c8b5627369aba1_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 2172 Service Token: SeSecurityPrivilege 2172 Service Token: SeTakeOwnershipPrivilege 2172 Service Token: SeLoadDriverPrivilege 2172 Service Token: SeSystemProfilePrivilege 2172 Service Token: SeSystemtimePrivilege 2172 Service Token: SeProfSingleProcessPrivilege 2172 Service Token: SeIncBasePriorityPrivilege 2172 Service Token: SeCreatePagefilePrivilege 2172 Service Token: SeBackupPrivilege 2172 Service Token: SeRestorePrivilege 2172 Service Token: SeShutdownPrivilege 2172 Service Token: SeDebugPrivilege 2172 Service Token: SeSystemEnvironmentPrivilege 2172 Service Token: SeChangeNotifyPrivilege 2172 Service Token: SeRemoteShutdownPrivilege 2172 Service Token: SeUndockPrivilege 2172 Service Token: SeManageVolumePrivilege 2172 Service Token: SeImpersonatePrivilege 2172 Service Token: SeCreateGlobalPrivilege 2172 Service Token: 33 2172 Service Token: 34 2172 Service Token: 35 2172 Service Token: 36 2172 Service -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2172 Service -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 2456 wrote to memory of 2172 2456 d5b85283195556e522c8b5627369aba1_JaffaCakes118.exe 86 PID 2456 wrote to memory of 2172 2456 d5b85283195556e522c8b5627369aba1_JaffaCakes118.exe 86 PID 2456 wrote to memory of 2172 2456 d5b85283195556e522c8b5627369aba1_JaffaCakes118.exe 86 PID 2456 wrote to memory of 2172 2456 d5b85283195556e522c8b5627369aba1_JaffaCakes118.exe 86 PID 2456 wrote to memory of 2172 2456 d5b85283195556e522c8b5627369aba1_JaffaCakes118.exe 86 PID 2456 wrote to memory of 2172 2456 d5b85283195556e522c8b5627369aba1_JaffaCakes118.exe 86 PID 2456 wrote to memory of 2172 2456 d5b85283195556e522c8b5627369aba1_JaffaCakes118.exe 86 PID 2456 wrote to memory of 2172 2456 d5b85283195556e522c8b5627369aba1_JaffaCakes118.exe 86 PID 2456 wrote to memory of 2172 2456 d5b85283195556e522c8b5627369aba1_JaffaCakes118.exe 86 PID 2456 wrote to memory of 2172 2456 d5b85283195556e522c8b5627369aba1_JaffaCakes118.exe 86 PID 2456 wrote to memory of 2172 2456 d5b85283195556e522c8b5627369aba1_JaffaCakes118.exe 86 PID 2456 wrote to memory of 2172 2456 d5b85283195556e522c8b5627369aba1_JaffaCakes118.exe 86 PID 2456 wrote to memory of 2172 2456 d5b85283195556e522c8b5627369aba1_JaffaCakes118.exe 86 PID 2456 wrote to memory of 2172 2456 d5b85283195556e522c8b5627369aba1_JaffaCakes118.exe 86 PID 2172 wrote to memory of 3328 2172 Service 87 PID 2172 wrote to memory of 3328 2172 Service 87 PID 2172 wrote to memory of 3328 2172 Service 87 PID 2172 wrote to memory of 3328 2172 Service 87 PID 2172 wrote to memory of 3328 2172 Service 87 PID 2172 wrote to memory of 3328 2172 Service 87 PID 2172 wrote to memory of 3328 2172 Service 87 PID 2172 wrote to memory of 3328 2172 Service 87 PID 2172 wrote to memory of 3328 2172 Service 87 PID 2172 wrote to memory of 3328 2172 Service 87 PID 2172 wrote to memory of 3328 2172 Service 87 PID 2172 wrote to memory of 3328 2172 Service 87 PID 2172 wrote to memory of 3328 2172 Service 87 PID 2172 wrote to memory of 3328 2172 Service 87 PID 2172 wrote to memory of 3328 2172 Service 87 PID 2172 wrote to memory of 3328 2172 Service 87 PID 2172 wrote to memory of 3328 2172 Service 87 PID 2172 wrote to memory of 3328 2172 Service 87 PID 2172 wrote to memory of 3328 2172 Service 87 PID 2172 wrote to memory of 3328 2172 Service 87 PID 2172 wrote to memory of 3328 2172 Service 87 PID 2172 wrote to memory of 3328 2172 Service 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\d5b85283195556e522c8b5627369aba1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d5b85283195556e522c8b5627369aba1_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\App\ServiceC:\Users\Admin\AppData\Local\Temp\\App\Service2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\SysWOW64\notepad.exenotepad3⤵
- System Location Discovery: System Language Discovery
PID:3328
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34