Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12-12-2024 03:42
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
e48a3de9365109d242dce7d56aea8ca9_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
20 signatures
150 seconds
General
-
Target
e48a3de9365109d242dce7d56aea8ca9_JaffaCakes118.exe
-
Size
1.5MB
-
MD5
e48a3de9365109d242dce7d56aea8ca9
-
SHA1
4ceb09ec07de94bb8fcca3bcc13883f67238a440
-
SHA256
f1a52769d9973e677f52e12229735354c22432d6f61894053a3b24d0b8121b93
-
SHA512
98ee169551954446b622060e4259ee00bec72e9447d685f81b32fae616ac11fd8572f45429035c71f99d315423cec6760a439ac77cc445ff22a380934eabb645
-
SSDEEP
24576:saHMv6CorjqnyC8xlDg/r0vLPzVFFw5/bDBxU8YPEBniQVKet4:s1vqjdC8PDg/4v33Fo/b7WK7/4
Malware Config
Signatures
-
Darkcomet family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\AdobeReader\\AdobeReaderUpdater.exe" uncrypted.exe -
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile AdobeReaderUpdater.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" AdobeReaderUpdater.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" AdobeReaderUpdater.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile iexplore.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" iexplore.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" iexplore.exe -
Modifies security service 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" iexplore.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" AdobeReaderUpdater.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" AdobeReaderUpdater.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" AdobeReaderUpdater.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" iexplore.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 4796 attrib.exe 3520 attrib.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation e48a3de9365109d242dce7d56aea8ca9_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation uncrypted.exe -
Executes dropped EXE 2 IoCs
pid Process 2916 uncrypted.exe 3596 AdobeReaderUpdater.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" AdobeReaderUpdater.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" AdobeReaderUpdater.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AdobeReaderUpdater = "C:\\Users\\Admin\\Documents\\AdobeReader\\AdobeReaderUpdater.exe" uncrypted.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AdobeReaderUpdater = "C:\\Users\\Admin\\Documents\\AdobeReader\\AdobeReaderUpdater.exe" AdobeReaderUpdater.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AdobeReaderUpdater = "C:\\Users\\Admin\\Documents\\AdobeReader\\AdobeReaderUpdater.exe" iexplore.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/3436-0-0x0000000000400000-0x00000000004D3000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3596 set thread context of 4812 3596 AdobeReaderUpdater.exe 91 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uncrypted.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AdobeReaderUpdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e48a3de9365109d242dce7d56aea8ca9_JaffaCakes118.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ uncrypted.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4812 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2916 uncrypted.exe Token: SeSecurityPrivilege 2916 uncrypted.exe Token: SeTakeOwnershipPrivilege 2916 uncrypted.exe Token: SeLoadDriverPrivilege 2916 uncrypted.exe Token: SeSystemProfilePrivilege 2916 uncrypted.exe Token: SeSystemtimePrivilege 2916 uncrypted.exe Token: SeProfSingleProcessPrivilege 2916 uncrypted.exe Token: SeIncBasePriorityPrivilege 2916 uncrypted.exe Token: SeCreatePagefilePrivilege 2916 uncrypted.exe Token: SeBackupPrivilege 2916 uncrypted.exe Token: SeRestorePrivilege 2916 uncrypted.exe Token: SeShutdownPrivilege 2916 uncrypted.exe Token: SeDebugPrivilege 2916 uncrypted.exe Token: SeSystemEnvironmentPrivilege 2916 uncrypted.exe Token: SeChangeNotifyPrivilege 2916 uncrypted.exe Token: SeRemoteShutdownPrivilege 2916 uncrypted.exe Token: SeUndockPrivilege 2916 uncrypted.exe Token: SeManageVolumePrivilege 2916 uncrypted.exe Token: SeImpersonatePrivilege 2916 uncrypted.exe Token: SeCreateGlobalPrivilege 2916 uncrypted.exe Token: 33 2916 uncrypted.exe Token: 34 2916 uncrypted.exe Token: 35 2916 uncrypted.exe Token: 36 2916 uncrypted.exe Token: SeIncreaseQuotaPrivilege 3596 AdobeReaderUpdater.exe Token: SeSecurityPrivilege 3596 AdobeReaderUpdater.exe Token: SeTakeOwnershipPrivilege 3596 AdobeReaderUpdater.exe Token: SeLoadDriverPrivilege 3596 AdobeReaderUpdater.exe Token: SeSystemProfilePrivilege 3596 AdobeReaderUpdater.exe Token: SeSystemtimePrivilege 3596 AdobeReaderUpdater.exe Token: SeProfSingleProcessPrivilege 3596 AdobeReaderUpdater.exe Token: SeIncBasePriorityPrivilege 3596 AdobeReaderUpdater.exe Token: SeCreatePagefilePrivilege 3596 AdobeReaderUpdater.exe Token: SeBackupPrivilege 3596 AdobeReaderUpdater.exe Token: SeRestorePrivilege 3596 AdobeReaderUpdater.exe Token: SeShutdownPrivilege 3596 AdobeReaderUpdater.exe Token: SeDebugPrivilege 3596 AdobeReaderUpdater.exe Token: SeSystemEnvironmentPrivilege 3596 AdobeReaderUpdater.exe Token: SeChangeNotifyPrivilege 3596 AdobeReaderUpdater.exe Token: SeRemoteShutdownPrivilege 3596 AdobeReaderUpdater.exe Token: SeUndockPrivilege 3596 AdobeReaderUpdater.exe Token: SeManageVolumePrivilege 3596 AdobeReaderUpdater.exe Token: SeImpersonatePrivilege 3596 AdobeReaderUpdater.exe Token: SeCreateGlobalPrivilege 3596 AdobeReaderUpdater.exe Token: 33 3596 AdobeReaderUpdater.exe Token: 34 3596 AdobeReaderUpdater.exe Token: 35 3596 AdobeReaderUpdater.exe Token: 36 3596 AdobeReaderUpdater.exe Token: SeIncreaseQuotaPrivilege 4812 iexplore.exe Token: SeSecurityPrivilege 4812 iexplore.exe Token: SeTakeOwnershipPrivilege 4812 iexplore.exe Token: SeLoadDriverPrivilege 4812 iexplore.exe Token: SeSystemProfilePrivilege 4812 iexplore.exe Token: SeSystemtimePrivilege 4812 iexplore.exe Token: SeProfSingleProcessPrivilege 4812 iexplore.exe Token: SeIncBasePriorityPrivilege 4812 iexplore.exe Token: SeCreatePagefilePrivilege 4812 iexplore.exe Token: SeBackupPrivilege 4812 iexplore.exe Token: SeRestorePrivilege 4812 iexplore.exe Token: SeShutdownPrivilege 4812 iexplore.exe Token: SeDebugPrivilege 4812 iexplore.exe Token: SeSystemEnvironmentPrivilege 4812 iexplore.exe Token: SeChangeNotifyPrivilege 4812 iexplore.exe Token: SeRemoteShutdownPrivilege 4812 iexplore.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4812 iexplore.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 3436 wrote to memory of 2916 3436 e48a3de9365109d242dce7d56aea8ca9_JaffaCakes118.exe 82 PID 3436 wrote to memory of 2916 3436 e48a3de9365109d242dce7d56aea8ca9_JaffaCakes118.exe 82 PID 3436 wrote to memory of 2916 3436 e48a3de9365109d242dce7d56aea8ca9_JaffaCakes118.exe 82 PID 2916 wrote to memory of 680 2916 uncrypted.exe 84 PID 2916 wrote to memory of 680 2916 uncrypted.exe 84 PID 2916 wrote to memory of 680 2916 uncrypted.exe 84 PID 2916 wrote to memory of 1460 2916 uncrypted.exe 85 PID 2916 wrote to memory of 1460 2916 uncrypted.exe 85 PID 2916 wrote to memory of 1460 2916 uncrypted.exe 85 PID 680 wrote to memory of 4796 680 cmd.exe 88 PID 680 wrote to memory of 4796 680 cmd.exe 88 PID 680 wrote to memory of 4796 680 cmd.exe 88 PID 1460 wrote to memory of 3520 1460 cmd.exe 89 PID 1460 wrote to memory of 3520 1460 cmd.exe 89 PID 1460 wrote to memory of 3520 1460 cmd.exe 89 PID 2916 wrote to memory of 3596 2916 uncrypted.exe 90 PID 2916 wrote to memory of 3596 2916 uncrypted.exe 90 PID 2916 wrote to memory of 3596 2916 uncrypted.exe 90 PID 3596 wrote to memory of 4812 3596 AdobeReaderUpdater.exe 91 PID 3596 wrote to memory of 4812 3596 AdobeReaderUpdater.exe 91 PID 3596 wrote to memory of 4812 3596 AdobeReaderUpdater.exe 91 PID 3596 wrote to memory of 4812 3596 AdobeReaderUpdater.exe 91 PID 3596 wrote to memory of 4812 3596 AdobeReaderUpdater.exe 91 -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 4796 attrib.exe 3520 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e48a3de9365109d242dce7d56aea8ca9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e48a3de9365109d242dce7d56aea8ca9_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\uncrypted.exe"C:\Users\Admin\AppData\Local\Temp\uncrypted.exe"2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:4796
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:3520
-
-
-
C:\Users\Admin\Documents\AdobeReader\AdobeReaderUpdater.exe"C:\Users\Admin\Documents\AdobeReader\AdobeReaderUpdater.exe"3⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"4⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4812
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
756KB
MD50bf6f7e8e7cf9074177fdfd7153434b2
SHA1c288137598c45341e478e2e56d2b1e8c50bbc2cb
SHA2562c656c7dd943dfe91fa85f2c9c2975d737295a9f76f433f312cf2dd8e90cfc4b
SHA5120abe7fa0c383c49f99239c36e7971d1774d7ee1a73cdd9c0523fbfb5932c35da0143b8698c0e41d07d1c5dad8298350bb475777f8b7366394fe40d67b09a9b9a
-
Filesize
50B
MD5b774ae3fb1da087e1f83b4f7b2060e5a
SHA197eb9be49ac3af9c851c9e1e84e32bfd53e325a8
SHA256adaf4a84b41e410b02e261cfd0fe7739d98647eab73c3badd32ac6e39f26351b
SHA512f75d0f95f7306d26a12b414bfe37b97fbd37546cb3c6e403def7077329ddffb4b45d5c5f0ba0e7bb6d72851d2d691b0a85267beead42f7cbf2e8c3d45a3b4701
-
Filesize
756KB
MD5dd0fadb191c79418d7fca232054ceb65
SHA16f2f9f6012e93f6a0fff1d538952f7d5e8548d3e
SHA2562a0a41812289886daec154ef1950b47b60d8f99ca99dfa58946d9ecbbab4cda2
SHA512fb2e05eb3250b1f227a7668c838c2b78ebb4479fcd960a2e96d292c101d57359dc62147fad9cc5d8a970b986ae248a26d4c4447f6729d1d60e9d818eb5d0f66f