Analysis
-
max time kernel
149s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13-12-2024 07:11
Static task
static1
Behavioral task
behavioral1
Sample
ea81a37bc72d306aa5e19b4d71385dc4_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ea81a37bc72d306aa5e19b4d71385dc4_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
ea81a37bc72d306aa5e19b4d71385dc4_JaffaCakes118.exe
-
Size
316KB
-
MD5
ea81a37bc72d306aa5e19b4d71385dc4
-
SHA1
783e2f687548e7fcaa92c03ed4361c4f598cfb54
-
SHA256
359981728f790600cdb124c43633eca94740c41deba296b672c1be6daef0d478
-
SHA512
77539bea7d2303668831bcd45fc7208be1e1be4cc45c08c584a347e5bf0c2d3208a123d39d4410ffef8efe77415a9861bc7e79a791992bfb86e0eb3f4a783eea
-
SSDEEP
6144:iHjwI7Ro8vT91lV7bjFZaChLXMe65ytjsK5Ae5t+R3IIhIIW:2jwARb91lVTFRjaY1WIIhII
Malware Config
Signatures
-
Darkcomet family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Favorites\\Windupdt\\winupd.exe" ea81a37bc72d306aa5e19b4d71385dc4_JaffaCakes118.exe -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate ea81a37bc72d306aa5e19b4d71385dc4_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 2788 winupd.exe -
Loads dropped DLL 2 IoCs
pid Process 1636 ea81a37bc72d306aa5e19b4d71385dc4_JaffaCakes118.exe 1636 ea81a37bc72d306aa5e19b4d71385dc4_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupd = "C:\\Users\\Admin\\Favorites\\Windupdt\\winupd.exe" ea81a37bc72d306aa5e19b4d71385dc4_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2788 set thread context of 2256 2788 winupd.exe 32 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ea81a37bc72d306aa5e19b4d71385dc4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winupd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1852 ping.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ea81a37bc72d306aa5e19b4d71385dc4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ea81a37bc72d306aa5e19b4d71385dc4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier ea81a37bc72d306aa5e19b4d71385dc4_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier ea81a37bc72d306aa5e19b4d71385dc4_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 winupd.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier ea81a37bc72d306aa5e19b4d71385dc4_JaffaCakes118.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1852 ping.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1636 ea81a37bc72d306aa5e19b4d71385dc4_JaffaCakes118.exe Token: SeSecurityPrivilege 1636 ea81a37bc72d306aa5e19b4d71385dc4_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 1636 ea81a37bc72d306aa5e19b4d71385dc4_JaffaCakes118.exe Token: SeLoadDriverPrivilege 1636 ea81a37bc72d306aa5e19b4d71385dc4_JaffaCakes118.exe Token: SeSystemProfilePrivilege 1636 ea81a37bc72d306aa5e19b4d71385dc4_JaffaCakes118.exe Token: SeSystemtimePrivilege 1636 ea81a37bc72d306aa5e19b4d71385dc4_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 1636 ea81a37bc72d306aa5e19b4d71385dc4_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1636 ea81a37bc72d306aa5e19b4d71385dc4_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 1636 ea81a37bc72d306aa5e19b4d71385dc4_JaffaCakes118.exe Token: SeBackupPrivilege 1636 ea81a37bc72d306aa5e19b4d71385dc4_JaffaCakes118.exe Token: SeRestorePrivilege 1636 ea81a37bc72d306aa5e19b4d71385dc4_JaffaCakes118.exe Token: SeShutdownPrivilege 1636 ea81a37bc72d306aa5e19b4d71385dc4_JaffaCakes118.exe Token: SeDebugPrivilege 1636 ea81a37bc72d306aa5e19b4d71385dc4_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 1636 ea81a37bc72d306aa5e19b4d71385dc4_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 1636 ea81a37bc72d306aa5e19b4d71385dc4_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 1636 ea81a37bc72d306aa5e19b4d71385dc4_JaffaCakes118.exe Token: SeUndockPrivilege 1636 ea81a37bc72d306aa5e19b4d71385dc4_JaffaCakes118.exe Token: SeManageVolumePrivilege 1636 ea81a37bc72d306aa5e19b4d71385dc4_JaffaCakes118.exe Token: SeImpersonatePrivilege 1636 ea81a37bc72d306aa5e19b4d71385dc4_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 1636 ea81a37bc72d306aa5e19b4d71385dc4_JaffaCakes118.exe Token: 33 1636 ea81a37bc72d306aa5e19b4d71385dc4_JaffaCakes118.exe Token: 34 1636 ea81a37bc72d306aa5e19b4d71385dc4_JaffaCakes118.exe Token: 35 1636 ea81a37bc72d306aa5e19b4d71385dc4_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 2788 winupd.exe Token: SeSecurityPrivilege 2788 winupd.exe Token: SeTakeOwnershipPrivilege 2788 winupd.exe Token: SeLoadDriverPrivilege 2788 winupd.exe Token: SeSystemProfilePrivilege 2788 winupd.exe Token: SeSystemtimePrivilege 2788 winupd.exe Token: SeProfSingleProcessPrivilege 2788 winupd.exe Token: SeIncBasePriorityPrivilege 2788 winupd.exe Token: SeCreatePagefilePrivilege 2788 winupd.exe Token: SeBackupPrivilege 2788 winupd.exe Token: SeRestorePrivilege 2788 winupd.exe Token: SeShutdownPrivilege 2788 winupd.exe Token: SeDebugPrivilege 2788 winupd.exe Token: SeSystemEnvironmentPrivilege 2788 winupd.exe Token: SeChangeNotifyPrivilege 2788 winupd.exe Token: SeRemoteShutdownPrivilege 2788 winupd.exe Token: SeUndockPrivilege 2788 winupd.exe Token: SeManageVolumePrivilege 2788 winupd.exe Token: SeImpersonatePrivilege 2788 winupd.exe Token: SeCreateGlobalPrivilege 2788 winupd.exe Token: 33 2788 winupd.exe Token: 34 2788 winupd.exe Token: 35 2788 winupd.exe Token: SeIncreaseQuotaPrivilege 2256 explorer.exe Token: SeSecurityPrivilege 2256 explorer.exe Token: SeTakeOwnershipPrivilege 2256 explorer.exe Token: SeLoadDriverPrivilege 2256 explorer.exe Token: SeSystemProfilePrivilege 2256 explorer.exe Token: SeSystemtimePrivilege 2256 explorer.exe Token: SeProfSingleProcessPrivilege 2256 explorer.exe Token: SeIncBasePriorityPrivilege 2256 explorer.exe Token: SeCreatePagefilePrivilege 2256 explorer.exe Token: SeBackupPrivilege 2256 explorer.exe Token: SeRestorePrivilege 2256 explorer.exe Token: SeShutdownPrivilege 2256 explorer.exe Token: SeDebugPrivilege 2256 explorer.exe Token: SeSystemEnvironmentPrivilege 2256 explorer.exe Token: SeChangeNotifyPrivilege 2256 explorer.exe Token: SeRemoteShutdownPrivilege 2256 explorer.exe Token: SeUndockPrivilege 2256 explorer.exe Token: SeManageVolumePrivilege 2256 explorer.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1636 wrote to memory of 2284 1636 ea81a37bc72d306aa5e19b4d71385dc4_JaffaCakes118.exe 28 PID 1636 wrote to memory of 2284 1636 ea81a37bc72d306aa5e19b4d71385dc4_JaffaCakes118.exe 28 PID 1636 wrote to memory of 2284 1636 ea81a37bc72d306aa5e19b4d71385dc4_JaffaCakes118.exe 28 PID 1636 wrote to memory of 2284 1636 ea81a37bc72d306aa5e19b4d71385dc4_JaffaCakes118.exe 28 PID 1636 wrote to memory of 2788 1636 ea81a37bc72d306aa5e19b4d71385dc4_JaffaCakes118.exe 29 PID 1636 wrote to memory of 2788 1636 ea81a37bc72d306aa5e19b4d71385dc4_JaffaCakes118.exe 29 PID 1636 wrote to memory of 2788 1636 ea81a37bc72d306aa5e19b4d71385dc4_JaffaCakes118.exe 29 PID 1636 wrote to memory of 2788 1636 ea81a37bc72d306aa5e19b4d71385dc4_JaffaCakes118.exe 29 PID 1636 wrote to memory of 1852 1636 ea81a37bc72d306aa5e19b4d71385dc4_JaffaCakes118.exe 30 PID 1636 wrote to memory of 1852 1636 ea81a37bc72d306aa5e19b4d71385dc4_JaffaCakes118.exe 30 PID 1636 wrote to memory of 1852 1636 ea81a37bc72d306aa5e19b4d71385dc4_JaffaCakes118.exe 30 PID 1636 wrote to memory of 1852 1636 ea81a37bc72d306aa5e19b4d71385dc4_JaffaCakes118.exe 30 PID 2788 wrote to memory of 2256 2788 winupd.exe 32 PID 2788 wrote to memory of 2256 2788 winupd.exe 32 PID 2788 wrote to memory of 2256 2788 winupd.exe 32 PID 2788 wrote to memory of 2256 2788 winupd.exe 32 PID 2788 wrote to memory of 2256 2788 winupd.exe 32 PID 2788 wrote to memory of 2256 2788 winupd.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea81a37bc72d306aa5e19b4d71385dc4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ea81a37bc72d306aa5e19b4d71385dc4_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵PID:2284
-
-
C:\Users\Admin\Favorites\Windupdt\winupd.exe"C:\Users\Admin\Favorites\Windupdt\winupd.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"3⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2256
-
-
-
C:\Windows\SysWOW64\ping.exeping 127.0.0.1 -n 5 > NUL del "C:\Users\Admin\AppData\Local\Temp\ea81a37bc72d306aa5e19b4d71385dc4_JaffaCakes118.exe"2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1852
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
316KB
MD5ea81a37bc72d306aa5e19b4d71385dc4
SHA1783e2f687548e7fcaa92c03ed4361c4f598cfb54
SHA256359981728f790600cdb124c43633eca94740c41deba296b672c1be6daef0d478
SHA51277539bea7d2303668831bcd45fc7208be1e1be4cc45c08c584a347e5bf0c2d3208a123d39d4410ffef8efe77415a9861bc7e79a791992bfb86e0eb3f4a783eea