Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12-12-2024 03:42
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
e48a3de9365109d242dce7d56aea8ca9_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
20 signatures
150 seconds
General
-
Target
e48a3de9365109d242dce7d56aea8ca9_JaffaCakes118.exe
-
Size
1.5MB
-
MD5
e48a3de9365109d242dce7d56aea8ca9
-
SHA1
4ceb09ec07de94bb8fcca3bcc13883f67238a440
-
SHA256
f1a52769d9973e677f52e12229735354c22432d6f61894053a3b24d0b8121b93
-
SHA512
98ee169551954446b622060e4259ee00bec72e9447d685f81b32fae616ac11fd8572f45429035c71f99d315423cec6760a439ac77cc445ff22a380934eabb645
-
SSDEEP
24576:saHMv6CorjqnyC8xlDg/r0vLPzVFFw5/bDBxU8YPEBniQVKet4:s1vqjdC8PDg/4v33Fo/b7WK7/4
Malware Config
Signatures
-
Darkcomet family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\AdobeReader\\AdobeReaderUpdater.exe" uncrypted.exe -
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" iexplore.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile AdobeReaderUpdater.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" AdobeReaderUpdater.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" AdobeReaderUpdater.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile iexplore.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" iexplore.exe -
Modifies security service 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" AdobeReaderUpdater.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" iexplore.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" AdobeReaderUpdater.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" AdobeReaderUpdater.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 2616 attrib.exe 2272 attrib.exe -
Executes dropped EXE 2 IoCs
pid Process 2092 uncrypted.exe 2760 AdobeReaderUpdater.exe -
Loads dropped DLL 9 IoCs
pid Process 3000 e48a3de9365109d242dce7d56aea8ca9_JaffaCakes118.exe 3000 e48a3de9365109d242dce7d56aea8ca9_JaffaCakes118.exe 3000 e48a3de9365109d242dce7d56aea8ca9_JaffaCakes118.exe 3000 e48a3de9365109d242dce7d56aea8ca9_JaffaCakes118.exe 3000 e48a3de9365109d242dce7d56aea8ca9_JaffaCakes118.exe 2092 uncrypted.exe 2760 AdobeReaderUpdater.exe 2760 AdobeReaderUpdater.exe 2760 AdobeReaderUpdater.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" AdobeReaderUpdater.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" AdobeReaderUpdater.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\AdobeReaderUpdater = "C:\\Users\\Admin\\Documents\\AdobeReader\\AdobeReaderUpdater.exe" uncrypted.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\AdobeReaderUpdater = "C:\\Users\\Admin\\Documents\\AdobeReader\\AdobeReaderUpdater.exe" AdobeReaderUpdater.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\AdobeReaderUpdater = "C:\\Users\\Admin\\Documents\\AdobeReader\\AdobeReaderUpdater.exe" iexplore.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/3000-0-0x0000000000400000-0x00000000004D3000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2760 set thread context of 2168 2760 AdobeReaderUpdater.exe 38 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uncrypted.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AdobeReaderUpdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e48a3de9365109d242dce7d56aea8ca9_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2168 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2092 uncrypted.exe Token: SeSecurityPrivilege 2092 uncrypted.exe Token: SeTakeOwnershipPrivilege 2092 uncrypted.exe Token: SeLoadDriverPrivilege 2092 uncrypted.exe Token: SeSystemProfilePrivilege 2092 uncrypted.exe Token: SeSystemtimePrivilege 2092 uncrypted.exe Token: SeProfSingleProcessPrivilege 2092 uncrypted.exe Token: SeIncBasePriorityPrivilege 2092 uncrypted.exe Token: SeCreatePagefilePrivilege 2092 uncrypted.exe Token: SeBackupPrivilege 2092 uncrypted.exe Token: SeRestorePrivilege 2092 uncrypted.exe Token: SeShutdownPrivilege 2092 uncrypted.exe Token: SeDebugPrivilege 2092 uncrypted.exe Token: SeSystemEnvironmentPrivilege 2092 uncrypted.exe Token: SeChangeNotifyPrivilege 2092 uncrypted.exe Token: SeRemoteShutdownPrivilege 2092 uncrypted.exe Token: SeUndockPrivilege 2092 uncrypted.exe Token: SeManageVolumePrivilege 2092 uncrypted.exe Token: SeImpersonatePrivilege 2092 uncrypted.exe Token: SeCreateGlobalPrivilege 2092 uncrypted.exe Token: 33 2092 uncrypted.exe Token: 34 2092 uncrypted.exe Token: 35 2092 uncrypted.exe Token: SeIncreaseQuotaPrivilege 2760 AdobeReaderUpdater.exe Token: SeSecurityPrivilege 2760 AdobeReaderUpdater.exe Token: SeTakeOwnershipPrivilege 2760 AdobeReaderUpdater.exe Token: SeLoadDriverPrivilege 2760 AdobeReaderUpdater.exe Token: SeSystemProfilePrivilege 2760 AdobeReaderUpdater.exe Token: SeSystemtimePrivilege 2760 AdobeReaderUpdater.exe Token: SeProfSingleProcessPrivilege 2760 AdobeReaderUpdater.exe Token: SeIncBasePriorityPrivilege 2760 AdobeReaderUpdater.exe Token: SeCreatePagefilePrivilege 2760 AdobeReaderUpdater.exe Token: SeBackupPrivilege 2760 AdobeReaderUpdater.exe Token: SeRestorePrivilege 2760 AdobeReaderUpdater.exe Token: SeShutdownPrivilege 2760 AdobeReaderUpdater.exe Token: SeDebugPrivilege 2760 AdobeReaderUpdater.exe Token: SeSystemEnvironmentPrivilege 2760 AdobeReaderUpdater.exe Token: SeChangeNotifyPrivilege 2760 AdobeReaderUpdater.exe Token: SeRemoteShutdownPrivilege 2760 AdobeReaderUpdater.exe Token: SeUndockPrivilege 2760 AdobeReaderUpdater.exe Token: SeManageVolumePrivilege 2760 AdobeReaderUpdater.exe Token: SeImpersonatePrivilege 2760 AdobeReaderUpdater.exe Token: SeCreateGlobalPrivilege 2760 AdobeReaderUpdater.exe Token: 33 2760 AdobeReaderUpdater.exe Token: 34 2760 AdobeReaderUpdater.exe Token: 35 2760 AdobeReaderUpdater.exe Token: SeRestorePrivilege 2760 AdobeReaderUpdater.exe Token: SeBackupPrivilege 2760 AdobeReaderUpdater.exe Token: SeIncreaseQuotaPrivilege 2168 iexplore.exe Token: SeSecurityPrivilege 2168 iexplore.exe Token: SeTakeOwnershipPrivilege 2168 iexplore.exe Token: SeLoadDriverPrivilege 2168 iexplore.exe Token: SeSystemProfilePrivilege 2168 iexplore.exe Token: SeSystemtimePrivilege 2168 iexplore.exe Token: SeProfSingleProcessPrivilege 2168 iexplore.exe Token: SeIncBasePriorityPrivilege 2168 iexplore.exe Token: SeCreatePagefilePrivilege 2168 iexplore.exe Token: SeBackupPrivilege 2168 iexplore.exe Token: SeRestorePrivilege 2168 iexplore.exe Token: SeShutdownPrivilege 2168 iexplore.exe Token: SeDebugPrivilege 2168 iexplore.exe Token: SeSystemEnvironmentPrivilege 2168 iexplore.exe Token: SeChangeNotifyPrivilege 2168 iexplore.exe Token: SeRemoteShutdownPrivilege 2168 iexplore.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2168 iexplore.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 3000 wrote to memory of 2092 3000 e48a3de9365109d242dce7d56aea8ca9_JaffaCakes118.exe 30 PID 3000 wrote to memory of 2092 3000 e48a3de9365109d242dce7d56aea8ca9_JaffaCakes118.exe 30 PID 3000 wrote to memory of 2092 3000 e48a3de9365109d242dce7d56aea8ca9_JaffaCakes118.exe 30 PID 3000 wrote to memory of 2092 3000 e48a3de9365109d242dce7d56aea8ca9_JaffaCakes118.exe 30 PID 2092 wrote to memory of 2744 2092 uncrypted.exe 31 PID 2092 wrote to memory of 2744 2092 uncrypted.exe 31 PID 2092 wrote to memory of 2744 2092 uncrypted.exe 31 PID 2092 wrote to memory of 2744 2092 uncrypted.exe 31 PID 2092 wrote to memory of 2852 2092 uncrypted.exe 33 PID 2092 wrote to memory of 2852 2092 uncrypted.exe 33 PID 2092 wrote to memory of 2852 2092 uncrypted.exe 33 PID 2092 wrote to memory of 2852 2092 uncrypted.exe 33 PID 2852 wrote to memory of 2616 2852 cmd.exe 35 PID 2852 wrote to memory of 2616 2852 cmd.exe 35 PID 2852 wrote to memory of 2616 2852 cmd.exe 35 PID 2852 wrote to memory of 2616 2852 cmd.exe 35 PID 2744 wrote to memory of 2272 2744 cmd.exe 36 PID 2744 wrote to memory of 2272 2744 cmd.exe 36 PID 2744 wrote to memory of 2272 2744 cmd.exe 36 PID 2744 wrote to memory of 2272 2744 cmd.exe 36 PID 2092 wrote to memory of 2760 2092 uncrypted.exe 37 PID 2092 wrote to memory of 2760 2092 uncrypted.exe 37 PID 2092 wrote to memory of 2760 2092 uncrypted.exe 37 PID 2092 wrote to memory of 2760 2092 uncrypted.exe 37 PID 2092 wrote to memory of 2760 2092 uncrypted.exe 37 PID 2092 wrote to memory of 2760 2092 uncrypted.exe 37 PID 2092 wrote to memory of 2760 2092 uncrypted.exe 37 PID 2760 wrote to memory of 2168 2760 AdobeReaderUpdater.exe 38 PID 2760 wrote to memory of 2168 2760 AdobeReaderUpdater.exe 38 PID 2760 wrote to memory of 2168 2760 AdobeReaderUpdater.exe 38 PID 2760 wrote to memory of 2168 2760 AdobeReaderUpdater.exe 38 PID 2760 wrote to memory of 2168 2760 AdobeReaderUpdater.exe 38 PID 2760 wrote to memory of 2168 2760 AdobeReaderUpdater.exe 38 PID 2760 wrote to memory of 2168 2760 AdobeReaderUpdater.exe 38 PID 2760 wrote to memory of 2168 2760 AdobeReaderUpdater.exe 38 PID 2760 wrote to memory of 2168 2760 AdobeReaderUpdater.exe 38 -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 2616 attrib.exe 2272 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e48a3de9365109d242dce7d56aea8ca9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e48a3de9365109d242dce7d56aea8ca9_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\uncrypted.exe"C:\Users\Admin\AppData\Local\Temp\uncrypted.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:2272
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:2616
-
-
-
C:\Users\Admin\Documents\AdobeReader\AdobeReaderUpdater.exe"C:\Users\Admin\Documents\AdobeReader\AdobeReaderUpdater.exe"3⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"4⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2168
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
756KB
MD50bf6f7e8e7cf9074177fdfd7153434b2
SHA1c288137598c45341e478e2e56d2b1e8c50bbc2cb
SHA2562c656c7dd943dfe91fa85f2c9c2975d737295a9f76f433f312cf2dd8e90cfc4b
SHA5120abe7fa0c383c49f99239c36e7971d1774d7ee1a73cdd9c0523fbfb5932c35da0143b8698c0e41d07d1c5dad8298350bb475777f8b7366394fe40d67b09a9b9a
-
Filesize
64B
MD5f8955e19af7aa78b3900b2f5210b345b
SHA18fe263c7c65a35ae28e750b100a32953f6515377
SHA25665e39e31167525df865de6feef98245a08d2f611f90d9d9146e46f4129709780
SHA512dd4f9cc333bff66a91ef153d27db90752e8daa6fc4ba32167d679b7a1fb71844dec8226efd70230a1fa95c77fcec44e7d570548b3e64f1057dd4a2d272b075c1
-
Filesize
50B
MD5b774ae3fb1da087e1f83b4f7b2060e5a
SHA197eb9be49ac3af9c851c9e1e84e32bfd53e325a8
SHA256adaf4a84b41e410b02e261cfd0fe7739d98647eab73c3badd32ac6e39f26351b
SHA512f75d0f95f7306d26a12b414bfe37b97fbd37546cb3c6e403def7077329ddffb4b45d5c5f0ba0e7bb6d72851d2d691b0a85267beead42f7cbf2e8c3d45a3b4701
-
Filesize
756KB
MD5dd0fadb191c79418d7fca232054ceb65
SHA16f2f9f6012e93f6a0fff1d538952f7d5e8548d3e
SHA2562a0a41812289886daec154ef1950b47b60d8f99ca99dfa58946d9ecbbab4cda2
SHA512fb2e05eb3250b1f227a7668c838c2b78ebb4479fcd960a2e96d292c101d57359dc62147fad9cc5d8a970b986ae248a26d4c4447f6729d1d60e9d818eb5d0f66f