Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
14-12-2024 20:31
Static task
static1
Behavioral task
behavioral1
Sample
f08fc211cf36e9c208f2cad5ede21d3a_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f08fc211cf36e9c208f2cad5ede21d3a_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
f08fc211cf36e9c208f2cad5ede21d3a_JaffaCakes118.exe
-
Size
1.2MB
-
MD5
f08fc211cf36e9c208f2cad5ede21d3a
-
SHA1
ef4a55a144149190d96fb3cbad17b1b558fda025
-
SHA256
566f253412379e3b506b9140357109128b4fbda71bebcdcefdf479b1215a7647
-
SHA512
a984a3a58512ef16ab42bdc8d1f97003da459300f5826a1de07cf99c07118ea387bde72c386785fabad0d279a5d74c71235b0be55573a18db750eb87211fd7af
-
SSDEEP
24576:+ICEgHEFDPPBMQSzIp4CQOHcLLxzLc9Qi/Qtv4jNAM8cAFhVlrYzv5/kxIq47:mIM7OmzLc9zQ+jCJZDlrYd/kOq47
Malware Config
Extracted
darkcomet
Were all gonna miss you.
thepwnman.no-ip.biz:3131
Goodbye DC </3
-
gencode
JY7xRluxnMpG
-
install
false
-
offline_keylogger
false
-
persistence
false
Signatures
-
Darkcomet family
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation f08fc211cf36e9c208f2cad5ede21d3a_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation ins5.exe -
Executes dropped EXE 4 IoCs
pid Process 3832 1674352229.exe 3900 vbc.exe 3064 ins5.exe 3392 515ea7b2-cf8c-475e-aa01-18d35bc06f2f.exe -
Loads dropped DLL 1 IoCs
pid Process 3832 1674352229.exe -
Uses the VBS compiler for execution 1 TTPs
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Windows\assembly\Desktop.ini ins5.exe File opened for modification C:\Windows\assembly\Desktop.ini ins5.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3896 set thread context of 3900 3896 f08fc211cf36e9c208f2cad5ede21d3a_JaffaCakes118.exe 86 -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\assembly ins5.exe File created C:\Windows\assembly\Desktop.ini ins5.exe File opened for modification C:\Windows\assembly\Desktop.ini ins5.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ins5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 515ea7b2-cf8c-475e-aa01-18d35bc06f2f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f08fc211cf36e9c208f2cad5ede21d3a_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1674352229.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe -
NSIS installer 1 IoCs
resource yara_rule behavioral2/files/0x0008000000023c91-7.dat nsis_installer_2 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 3392 515ea7b2-cf8c-475e-aa01-18d35bc06f2f.exe -
Suspicious use of AdjustPrivilegeToken 26 IoCs
description pid Process Token: SeDebugPrivilege 3896 f08fc211cf36e9c208f2cad5ede21d3a_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 3900 vbc.exe Token: SeSecurityPrivilege 3900 vbc.exe Token: SeTakeOwnershipPrivilege 3900 vbc.exe Token: SeLoadDriverPrivilege 3900 vbc.exe Token: SeSystemProfilePrivilege 3900 vbc.exe Token: SeSystemtimePrivilege 3900 vbc.exe Token: SeProfSingleProcessPrivilege 3900 vbc.exe Token: SeIncBasePriorityPrivilege 3900 vbc.exe Token: SeCreatePagefilePrivilege 3900 vbc.exe Token: SeBackupPrivilege 3900 vbc.exe Token: SeRestorePrivilege 3900 vbc.exe Token: SeShutdownPrivilege 3900 vbc.exe Token: SeDebugPrivilege 3900 vbc.exe Token: SeSystemEnvironmentPrivilege 3900 vbc.exe Token: SeChangeNotifyPrivilege 3900 vbc.exe Token: SeRemoteShutdownPrivilege 3900 vbc.exe Token: SeUndockPrivilege 3900 vbc.exe Token: SeManageVolumePrivilege 3900 vbc.exe Token: SeImpersonatePrivilege 3900 vbc.exe Token: SeCreateGlobalPrivilege 3900 vbc.exe Token: 33 3900 vbc.exe Token: 34 3900 vbc.exe Token: 35 3900 vbc.exe Token: 36 3900 vbc.exe Token: SeDebugPrivilege 3392 515ea7b2-cf8c-475e-aa01-18d35bc06f2f.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3392 515ea7b2-cf8c-475e-aa01-18d35bc06f2f.exe 3392 515ea7b2-cf8c-475e-aa01-18d35bc06f2f.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 3896 wrote to memory of 3832 3896 f08fc211cf36e9c208f2cad5ede21d3a_JaffaCakes118.exe 85 PID 3896 wrote to memory of 3832 3896 f08fc211cf36e9c208f2cad5ede21d3a_JaffaCakes118.exe 85 PID 3896 wrote to memory of 3832 3896 f08fc211cf36e9c208f2cad5ede21d3a_JaffaCakes118.exe 85 PID 3896 wrote to memory of 3900 3896 f08fc211cf36e9c208f2cad5ede21d3a_JaffaCakes118.exe 86 PID 3896 wrote to memory of 3900 3896 f08fc211cf36e9c208f2cad5ede21d3a_JaffaCakes118.exe 86 PID 3896 wrote to memory of 3900 3896 f08fc211cf36e9c208f2cad5ede21d3a_JaffaCakes118.exe 86 PID 3896 wrote to memory of 3900 3896 f08fc211cf36e9c208f2cad5ede21d3a_JaffaCakes118.exe 86 PID 3896 wrote to memory of 3900 3896 f08fc211cf36e9c208f2cad5ede21d3a_JaffaCakes118.exe 86 PID 3896 wrote to memory of 3900 3896 f08fc211cf36e9c208f2cad5ede21d3a_JaffaCakes118.exe 86 PID 3896 wrote to memory of 3900 3896 f08fc211cf36e9c208f2cad5ede21d3a_JaffaCakes118.exe 86 PID 3896 wrote to memory of 3900 3896 f08fc211cf36e9c208f2cad5ede21d3a_JaffaCakes118.exe 86 PID 3896 wrote to memory of 3900 3896 f08fc211cf36e9c208f2cad5ede21d3a_JaffaCakes118.exe 86 PID 3896 wrote to memory of 3900 3896 f08fc211cf36e9c208f2cad5ede21d3a_JaffaCakes118.exe 86 PID 3896 wrote to memory of 3900 3896 f08fc211cf36e9c208f2cad5ede21d3a_JaffaCakes118.exe 86 PID 3896 wrote to memory of 3900 3896 f08fc211cf36e9c208f2cad5ede21d3a_JaffaCakes118.exe 86 PID 3896 wrote to memory of 3900 3896 f08fc211cf36e9c208f2cad5ede21d3a_JaffaCakes118.exe 86 PID 3896 wrote to memory of 3900 3896 f08fc211cf36e9c208f2cad5ede21d3a_JaffaCakes118.exe 86 PID 3832 wrote to memory of 3064 3832 1674352229.exe 87 PID 3832 wrote to memory of 3064 3832 1674352229.exe 87 PID 3832 wrote to memory of 3064 3832 1674352229.exe 87 PID 3064 wrote to memory of 3392 3064 ins5.exe 89 PID 3064 wrote to memory of 3392 3064 ins5.exe 89 PID 3064 wrote to memory of 3392 3064 ins5.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\f08fc211cf36e9c208f2cad5ede21d3a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f08fc211cf36e9c208f2cad5ede21d3a_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\1674352229.exe"C:\Users\Admin\AppData\Local\Temp\1674352229.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\nsm97FC.tmp\ins5.exeC:\Users\Admin\AppData\Local\Temp\nsm97FC.tmp\ins5.exe 515ea7b2-cf8c-475e-aa01-18d35bc06f2f.exe /t /dT131981425S /e10111414 /u515ea7b2-cf8c-475e-aa01-18d35bc06f2f3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\nsm97FC.tmp\515ea7b2-cf8c-475e-aa01-18d35bc06f2f.exe"C:\Users\Admin\AppData\Local\Temp\nsm97FC.tmp\515ea7b2-cf8c-475e-aa01-18d35bc06f2f.exe" /t /dT131981425S /e10111414 /u515ea7b2-cf8c-475e-aa01-18d35bc06f2f4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3392
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\temp_mhVwYcvTGr\vbc.exe"C:\Users\Admin\AppData\Local\Temp\temp_mhVwYcvTGr\vbc.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3900
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
270KB
MD5b45b5fc64a61707e0e490d1e2c54e931
SHA1eca8079aaf349e100a2852e2fbc6bbdc57d49f1f
SHA2562769b2c94dadea227bc4a13af827007613185f3febeebd42cd501ffaeb5f595b
SHA512ed7f31cd5ae1691fe7d90ae5110b841d56651935b16e1f3637cb05a0500c6cd7b67f78abfd6c5f4c09bdc4b8bb79d0352e4346c891255344b9b8469611b8ffc9
-
Filesize
250KB
MD5035e4f28801f8a2f5c9a51750b1d8bc0
SHA16083a072e75b146941dc759796e1b539fd4846db
SHA25646dd0dcd46ed04a5819e21810339dc160a28c6d77a12661549d4a6875c4312be
SHA512b5f0b19672c425d5025411bb0bfb9f604723bf11ba0a04b202330d2675655e1b7cb31bd51314d77f000edb668307fcf9661e20d12238e2095961cb0b1277d945
-
Filesize
214KB
MD5081f1ef743489a25c99fdd25f6d4f70d
SHA1dfdbd1caf714644f6c1b1b383f717028c39a2db0
SHA256ed6b25ef9345aa31303cdc1cad322b1607eda3bf7bfefe7445105baddd59c635
SHA512bf2962affa9ffb92cbaa17389a71b6ecf548cf6629237444a4b078bdcbd29cdd825055e2fe49530053c864bb1ad42726c083bb7db6d20b0afc939363365ec4ca
-
Filesize
8KB
MD5249ae678f0dac4c625c6de6aca53823a
SHA16ac2b9e90e8445fed4c45c5dbf2d0227cd3b5201
SHA2567298024a36310b7c4c112be87b61b62a0b1be493e2d5252a19e5e976daf674ce
SHA51266e4081a40f3191bf28b810cf8411cb3c8c3e3ec5943e18d6672414fb5e7b4364f862cba44c9115c599ac90890ef02a773e254e7c979e930946bc52b0693aad7
-
Filesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34