Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
19-12-2024 01:59
Behavioral task
behavioral1
Sample
fdfd30f62f5acfa786fa6c3683483ed0_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
General
-
Target
fdfd30f62f5acfa786fa6c3683483ed0_JaffaCakes118.exe
-
Size
764KB
-
MD5
fdfd30f62f5acfa786fa6c3683483ed0
-
SHA1
a18da8343bed1fc3afa2b8a61dbe920adea96008
-
SHA256
b7f66d90407d2c446d179d3e0c224311b7d23c2f2079a9ea038074a016a850d1
-
SHA512
fda68da06dbd7d8ddb4dd45102c2216e0d2bf5e581a975d006ea2e58d3819163a7d29b42f733c1a702f0bff6cef3f6383a16875593aa520d4fab6abfd8c0cacc
-
SSDEEP
12288:Bfbh3edoSdPDze9LBApPsKNoeP313umLcUmyqC+N/jXI0:NR8oYzS12PVaA3LLRHqC+ljX
Malware Config
Signatures
-
Darkcomet family
-
Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 3552 attrib.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation fdfd30f62f5acfa786fa6c3683483ed0_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4688 set thread context of 4736 4688 fdfd30f62f5acfa786fa6c3683483ed0_JaffaCakes118.exe 84 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fdfd30f62f5acfa786fa6c3683483ed0_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4688 fdfd30f62f5acfa786fa6c3683483ed0_JaffaCakes118.exe Token: SeSecurityPrivilege 4688 fdfd30f62f5acfa786fa6c3683483ed0_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 4688 fdfd30f62f5acfa786fa6c3683483ed0_JaffaCakes118.exe Token: SeLoadDriverPrivilege 4688 fdfd30f62f5acfa786fa6c3683483ed0_JaffaCakes118.exe Token: SeSystemProfilePrivilege 4688 fdfd30f62f5acfa786fa6c3683483ed0_JaffaCakes118.exe Token: SeSystemtimePrivilege 4688 fdfd30f62f5acfa786fa6c3683483ed0_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 4688 fdfd30f62f5acfa786fa6c3683483ed0_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4688 fdfd30f62f5acfa786fa6c3683483ed0_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 4688 fdfd30f62f5acfa786fa6c3683483ed0_JaffaCakes118.exe Token: SeBackupPrivilege 4688 fdfd30f62f5acfa786fa6c3683483ed0_JaffaCakes118.exe Token: SeRestorePrivilege 4688 fdfd30f62f5acfa786fa6c3683483ed0_JaffaCakes118.exe Token: SeShutdownPrivilege 4688 fdfd30f62f5acfa786fa6c3683483ed0_JaffaCakes118.exe Token: SeDebugPrivilege 4688 fdfd30f62f5acfa786fa6c3683483ed0_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 4688 fdfd30f62f5acfa786fa6c3683483ed0_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 4688 fdfd30f62f5acfa786fa6c3683483ed0_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 4688 fdfd30f62f5acfa786fa6c3683483ed0_JaffaCakes118.exe Token: SeUndockPrivilege 4688 fdfd30f62f5acfa786fa6c3683483ed0_JaffaCakes118.exe Token: SeManageVolumePrivilege 4688 fdfd30f62f5acfa786fa6c3683483ed0_JaffaCakes118.exe Token: SeImpersonatePrivilege 4688 fdfd30f62f5acfa786fa6c3683483ed0_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 4688 fdfd30f62f5acfa786fa6c3683483ed0_JaffaCakes118.exe Token: 33 4688 fdfd30f62f5acfa786fa6c3683483ed0_JaffaCakes118.exe Token: 34 4688 fdfd30f62f5acfa786fa6c3683483ed0_JaffaCakes118.exe Token: 35 4688 fdfd30f62f5acfa786fa6c3683483ed0_JaffaCakes118.exe Token: 36 4688 fdfd30f62f5acfa786fa6c3683483ed0_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 4736 iexplore.exe Token: SeSecurityPrivilege 4736 iexplore.exe Token: SeTakeOwnershipPrivilege 4736 iexplore.exe Token: SeLoadDriverPrivilege 4736 iexplore.exe Token: SeSystemProfilePrivilege 4736 iexplore.exe Token: SeSystemtimePrivilege 4736 iexplore.exe Token: SeProfSingleProcessPrivilege 4736 iexplore.exe Token: SeIncBasePriorityPrivilege 4736 iexplore.exe Token: SeCreatePagefilePrivilege 4736 iexplore.exe Token: SeBackupPrivilege 4736 iexplore.exe Token: SeRestorePrivilege 4736 iexplore.exe Token: SeShutdownPrivilege 4736 iexplore.exe Token: SeDebugPrivilege 4736 iexplore.exe Token: SeSystemEnvironmentPrivilege 4736 iexplore.exe Token: SeChangeNotifyPrivilege 4736 iexplore.exe Token: SeRemoteShutdownPrivilege 4736 iexplore.exe Token: SeUndockPrivilege 4736 iexplore.exe Token: SeManageVolumePrivilege 4736 iexplore.exe Token: SeImpersonatePrivilege 4736 iexplore.exe Token: SeCreateGlobalPrivilege 4736 iexplore.exe Token: 33 4736 iexplore.exe Token: 34 4736 iexplore.exe Token: 35 4736 iexplore.exe Token: 36 4736 iexplore.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 4688 wrote to memory of 2368 4688 fdfd30f62f5acfa786fa6c3683483ed0_JaffaCakes118.exe 83 PID 4688 wrote to memory of 2368 4688 fdfd30f62f5acfa786fa6c3683483ed0_JaffaCakes118.exe 83 PID 4688 wrote to memory of 2368 4688 fdfd30f62f5acfa786fa6c3683483ed0_JaffaCakes118.exe 83 PID 4688 wrote to memory of 4736 4688 fdfd30f62f5acfa786fa6c3683483ed0_JaffaCakes118.exe 84 PID 4688 wrote to memory of 4736 4688 fdfd30f62f5acfa786fa6c3683483ed0_JaffaCakes118.exe 84 PID 4688 wrote to memory of 4736 4688 fdfd30f62f5acfa786fa6c3683483ed0_JaffaCakes118.exe 84 PID 4688 wrote to memory of 4736 4688 fdfd30f62f5acfa786fa6c3683483ed0_JaffaCakes118.exe 84 PID 4688 wrote to memory of 4736 4688 fdfd30f62f5acfa786fa6c3683483ed0_JaffaCakes118.exe 84 PID 2368 wrote to memory of 3552 2368 cmd.exe 86 PID 2368 wrote to memory of 3552 2368 cmd.exe 86 PID 2368 wrote to memory of 3552 2368 cmd.exe 86 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 3552 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fdfd30f62f5acfa786fa6c3683483ed0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fdfd30f62f5acfa786fa6c3683483ed0_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:3552
-
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4736
-