Analysis
-
max time kernel
114s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
16-01-2025 06:27
Behavioral task
behavioral1
Sample
JaffaCakes118_6dd31b95388aa6d80712445f7799dd98.exe
Resource
win7-20241010-en
windows7-x64
12 signatures
150 seconds
General
-
Target
JaffaCakes118_6dd31b95388aa6d80712445f7799dd98.exe
-
Size
465KB
-
MD5
6dd31b95388aa6d80712445f7799dd98
-
SHA1
bdbee5a847252b60ba879c3fc9d929ce2184a700
-
SHA256
27a42e3d4e6b87107c36171eef8927bf3933121c869c910346c4c875bb2ba6cb
-
SHA512
21ce366cf3509a8ebc0406cd0a593b1ee60029c2bba29a6255fdd710773901e03de21ec5403f7658087cb12b3f96be32119e56686ba62bf917c492f227381970
-
SSDEEP
12288:ii31Crlg0ARjexXk9x4bZ+Z8ymTOV1yzH:iiFylgJYxX+EFymanyzH
Malware Config
Signatures
-
Darkcomet family
-
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" iexplore.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" iexplore.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile JaffaCakes118_6dd31b95388aa6d80712445f7799dd98.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" JaffaCakes118_6dd31b95388aa6d80712445f7799dd98.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" JaffaCakes118_6dd31b95388aa6d80712445f7799dd98.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile iexplore.exe -
Disables RegEdit via registry modification 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" JaffaCakes118_6dd31b95388aa6d80712445f7799dd98.exe Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" iexplore.exe -
Disables Task Manager via registry modification
-
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1492 set thread context of 2824 1492 JaffaCakes118_6dd31b95388aa6d80712445f7799dd98.exe 30 PID 2824 set thread context of 2444 2824 JaffaCakes118_6dd31b95388aa6d80712445f7799dd98.exe 31 PID 2444 set thread context of 2992 2444 iexplore.exe 32 -
resource yara_rule behavioral1/memory/1492-1-0x0000000000400000-0x000000000058F000-memory.dmp upx behavioral1/memory/2824-6-0x0000000000400000-0x00000000004F9000-memory.dmp upx behavioral1/memory/2824-4-0x0000000000400000-0x00000000004F9000-memory.dmp upx behavioral1/memory/2824-3-0x0000000000400000-0x00000000004F9000-memory.dmp upx behavioral1/memory/2824-9-0x0000000000400000-0x00000000004F9000-memory.dmp upx behavioral1/memory/1492-8-0x0000000000400000-0x000000000058F000-memory.dmp upx behavioral1/memory/2824-10-0x0000000000400000-0x00000000004F9000-memory.dmp upx behavioral1/memory/2824-11-0x0000000000400000-0x00000000004F9000-memory.dmp upx behavioral1/memory/2824-12-0x0000000000400000-0x00000000004F9000-memory.dmp upx behavioral1/memory/2824-13-0x0000000000400000-0x00000000004F9000-memory.dmp upx behavioral1/memory/2824-18-0x0000000000400000-0x00000000004F9000-memory.dmp upx behavioral1/memory/2444-14-0x0000000000400000-0x000000000058F000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_6dd31b95388aa6d80712445f7799dd98.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_6dd31b95388aa6d80712445f7799dd98.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2992 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2824 JaffaCakes118_6dd31b95388aa6d80712445f7799dd98.exe Token: SeSecurityPrivilege 2824 JaffaCakes118_6dd31b95388aa6d80712445f7799dd98.exe Token: SeTakeOwnershipPrivilege 2824 JaffaCakes118_6dd31b95388aa6d80712445f7799dd98.exe Token: SeLoadDriverPrivilege 2824 JaffaCakes118_6dd31b95388aa6d80712445f7799dd98.exe Token: SeSystemProfilePrivilege 2824 JaffaCakes118_6dd31b95388aa6d80712445f7799dd98.exe Token: SeSystemtimePrivilege 2824 JaffaCakes118_6dd31b95388aa6d80712445f7799dd98.exe Token: SeProfSingleProcessPrivilege 2824 JaffaCakes118_6dd31b95388aa6d80712445f7799dd98.exe Token: SeIncBasePriorityPrivilege 2824 JaffaCakes118_6dd31b95388aa6d80712445f7799dd98.exe Token: SeCreatePagefilePrivilege 2824 JaffaCakes118_6dd31b95388aa6d80712445f7799dd98.exe Token: SeBackupPrivilege 2824 JaffaCakes118_6dd31b95388aa6d80712445f7799dd98.exe Token: SeRestorePrivilege 2824 JaffaCakes118_6dd31b95388aa6d80712445f7799dd98.exe Token: SeShutdownPrivilege 2824 JaffaCakes118_6dd31b95388aa6d80712445f7799dd98.exe Token: SeDebugPrivilege 2824 JaffaCakes118_6dd31b95388aa6d80712445f7799dd98.exe Token: SeSystemEnvironmentPrivilege 2824 JaffaCakes118_6dd31b95388aa6d80712445f7799dd98.exe Token: SeChangeNotifyPrivilege 2824 JaffaCakes118_6dd31b95388aa6d80712445f7799dd98.exe Token: SeRemoteShutdownPrivilege 2824 JaffaCakes118_6dd31b95388aa6d80712445f7799dd98.exe Token: SeUndockPrivilege 2824 JaffaCakes118_6dd31b95388aa6d80712445f7799dd98.exe Token: SeManageVolumePrivilege 2824 JaffaCakes118_6dd31b95388aa6d80712445f7799dd98.exe Token: SeImpersonatePrivilege 2824 JaffaCakes118_6dd31b95388aa6d80712445f7799dd98.exe Token: SeCreateGlobalPrivilege 2824 JaffaCakes118_6dd31b95388aa6d80712445f7799dd98.exe Token: 33 2824 JaffaCakes118_6dd31b95388aa6d80712445f7799dd98.exe Token: 34 2824 JaffaCakes118_6dd31b95388aa6d80712445f7799dd98.exe Token: 35 2824 JaffaCakes118_6dd31b95388aa6d80712445f7799dd98.exe Token: SeIncreaseQuotaPrivilege 2992 iexplore.exe Token: SeSecurityPrivilege 2992 iexplore.exe Token: SeTakeOwnershipPrivilege 2992 iexplore.exe Token: SeLoadDriverPrivilege 2992 iexplore.exe Token: SeSystemProfilePrivilege 2992 iexplore.exe Token: SeSystemtimePrivilege 2992 iexplore.exe Token: SeProfSingleProcessPrivilege 2992 iexplore.exe Token: SeIncBasePriorityPrivilege 2992 iexplore.exe Token: SeCreatePagefilePrivilege 2992 iexplore.exe Token: SeBackupPrivilege 2992 iexplore.exe Token: SeRestorePrivilege 2992 iexplore.exe Token: SeShutdownPrivilege 2992 iexplore.exe Token: SeDebugPrivilege 2992 iexplore.exe Token: SeSystemEnvironmentPrivilege 2992 iexplore.exe Token: SeChangeNotifyPrivilege 2992 iexplore.exe Token: SeRemoteShutdownPrivilege 2992 iexplore.exe Token: SeUndockPrivilege 2992 iexplore.exe Token: SeManageVolumePrivilege 2992 iexplore.exe Token: SeImpersonatePrivilege 2992 iexplore.exe Token: SeCreateGlobalPrivilege 2992 iexplore.exe Token: 33 2992 iexplore.exe Token: 34 2992 iexplore.exe Token: 35 2992 iexplore.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1492 JaffaCakes118_6dd31b95388aa6d80712445f7799dd98.exe 2444 iexplore.exe 2992 iexplore.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1492 wrote to memory of 2824 1492 JaffaCakes118_6dd31b95388aa6d80712445f7799dd98.exe 30 PID 1492 wrote to memory of 2824 1492 JaffaCakes118_6dd31b95388aa6d80712445f7799dd98.exe 30 PID 1492 wrote to memory of 2824 1492 JaffaCakes118_6dd31b95388aa6d80712445f7799dd98.exe 30 PID 1492 wrote to memory of 2824 1492 JaffaCakes118_6dd31b95388aa6d80712445f7799dd98.exe 30 PID 1492 wrote to memory of 2824 1492 JaffaCakes118_6dd31b95388aa6d80712445f7799dd98.exe 30 PID 1492 wrote to memory of 2824 1492 JaffaCakes118_6dd31b95388aa6d80712445f7799dd98.exe 30 PID 1492 wrote to memory of 2824 1492 JaffaCakes118_6dd31b95388aa6d80712445f7799dd98.exe 30 PID 1492 wrote to memory of 2824 1492 JaffaCakes118_6dd31b95388aa6d80712445f7799dd98.exe 30 PID 1492 wrote to memory of 2824 1492 JaffaCakes118_6dd31b95388aa6d80712445f7799dd98.exe 30 PID 2824 wrote to memory of 2444 2824 JaffaCakes118_6dd31b95388aa6d80712445f7799dd98.exe 31 PID 2824 wrote to memory of 2444 2824 JaffaCakes118_6dd31b95388aa6d80712445f7799dd98.exe 31 PID 2824 wrote to memory of 2444 2824 JaffaCakes118_6dd31b95388aa6d80712445f7799dd98.exe 31 PID 2824 wrote to memory of 2444 2824 JaffaCakes118_6dd31b95388aa6d80712445f7799dd98.exe 31 PID 2824 wrote to memory of 2444 2824 JaffaCakes118_6dd31b95388aa6d80712445f7799dd98.exe 31 PID 2824 wrote to memory of 2444 2824 JaffaCakes118_6dd31b95388aa6d80712445f7799dd98.exe 31 PID 2444 wrote to memory of 2992 2444 iexplore.exe 32 PID 2444 wrote to memory of 2992 2444 iexplore.exe 32 PID 2444 wrote to memory of 2992 2444 iexplore.exe 32 PID 2444 wrote to memory of 2992 2444 iexplore.exe 32 PID 2444 wrote to memory of 2992 2444 iexplore.exe 32 PID 2444 wrote to memory of 2992 2444 iexplore.exe 32 PID 2444 wrote to memory of 2992 2444 iexplore.exe 32 PID 2444 wrote to memory of 2992 2444 iexplore.exe 32 PID 2444 wrote to memory of 2992 2444 iexplore.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6dd31b95388aa6d80712445f7799dd98.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6dd31b95388aa6d80712445f7799dd98.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6dd31b95388aa6d80712445f7799dd98.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6dd31b95388aa6d80712445f7799dd98.exe"2⤵
- Modifies firewall policy service
- Disables RegEdit via registry modification
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"4⤵
- Modifies firewall policy service
- Disables RegEdit via registry modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2992
-
-
-