Analysis
-
max time kernel
94s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
10-01-2025 06:34
General
-
Target
JaffaCakes118_dd5d99624481537c7a861118199327e1.exe
-
Size
2.4MB
-
MD5
dd5d99624481537c7a861118199327e1
-
SHA1
b05527ae0d68e4f49b6c3928b861c5b32651b8ef
-
SHA256
a8b290c2a6e1f47e8d40dd37226ca96c05b442125dd920fe59c70ee4355e1f1a
-
SHA512
f4ffa4e158820654cf4a1f5d53c575eb3e91954ac07389baa139e3a4cd8f3960a54af8f69f041b76bb301aa993e96159f4eafbfe57eba730476ceff14737eb7f
-
SSDEEP
49152:UbA30qHwLrdtkbaCwcp4RXL7D764zB2qH+:UbtZiaYeL7DxB3+
Malware Config
Signatures
-
DcRat 4 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
DCRat payload 2 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Adds Run key to start application 2 TTPs 6 IoCs
-
Drops file in System32 directory 2 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 2 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 14 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_dd5d99624481537c7a861118199327e1.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_dd5d99624481537c7a861118199327e1.exe"1⤵
- DcRat
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\savesrefhostperf\HNc6hztBPgbs1a3w.vbe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\savesrefhostperf\ddPYL2Gm.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\savesrefhostperf\savesrefhostperfreviewCommon.exe"C:\savesrefhostperf\savesrefhostperfreviewCommon.exe"4⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\MJ8p4rIas4.bat"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:26⤵
-
-
C:\ProgramData\Documents\services.exe"C:\ProgramData\Documents\services.exe"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\ProgramData\Documents\services.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\Registry.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\System32\ntprint\conhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
201B
MD5ec20867dbe4db45c2bc9172d7f5f9b15
SHA1f24300dcc90ceb8552b17198c463de4a21136db9
SHA256a3f37164df73bd7dc1ac3ed2d60cad01d4a60181005b22b8de860fe71c7e2ad7
SHA5125d99e211e947ab9c5d042cfa7c0babbb34381c336bf69dd3d84b8ae8ac196c5ec5299e89e6f9265f2322a62cecc3d7137f6f13c6a3ad4b3b5884337fb49f78cd
-
Filesize
201B
MD5b1fa6a6c60cddab53af4e426e3486669
SHA10bd6dc89ac3327029eda2d3478be3c1a0800f4c2
SHA25616f2aea74639cf8bf6770d5a0428d45abf5166d7069fc6b93039952bab766d8a
SHA512a9c003fbc17de1fb7583f7533b638c481252c382fa4c33d02020974a1e60c4c491e4c8b19dcb140ab845f5381309270cdd67955a18c2172b19a476ba9fa07297
-
Filesize
54B
MD5c89cd8b8fc20253c58cef5be1008b660
SHA12b58141e268446086b824a29d04c1b2d6225a894
SHA25689f28132bcfca8cf0c22c870cf985895550420299e1ba6e2aef0a8d1c4237147
SHA512ac7c2281abfa0bcd15573864a56e52822b4c18e4a6804bada2819fa44c42cbb29f9e7f6f3a834e315a4e0e00f780e60f2b755663aef8b28c7c824442abd60ca0
-
Filesize
2.1MB
MD506e81061c598651b896d425bd9095b0a
SHA196ba3dc60b59ca30c55f37f0fa579c515d9f4a91
SHA256e376a9c32697b91fb02f68b18d641b5c2419ffbba5801f2c83110a68cbffa094
SHA512c2b775092b436848b45170ec98acefd3504aa170b09a654b28b7e1f4a916fcfd58c60a992a09f3cc5b79dc3b4ee33fc48fbdb9790f18905626fa9c9f2097e322
-
Filesize
8KB
-
Filesize
2.1MB
-
Filesize
48KB
-
Filesize
32KB
-
Filesize
56KB
-
Filesize
344KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
48KB
-
Filesize
32KB