Analysis
-
max time kernel
63s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
26/02/2025, 12:11
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_25d94481f4967537d4b75902827e1948.exe
Resource
win7-20240729-en
General
-
Target
JaffaCakes118_25d94481f4967537d4b75902827e1948.exe
-
Size
1.1MB
-
MD5
25d94481f4967537d4b75902827e1948
-
SHA1
71f72e4679f9918c506b6479870ebf5701d418dc
-
SHA256
69ec29e540120ba091110e2ff51bddd3b67c5de8eb466959d2bb24316f5e813c
-
SHA512
608af79380dc6bfb0c42ab07f99346ca0fc1a2ff338382b9ab0de9b359e0165720f08b0e81538eacd5a0a97fef968994253f1f3fdc88ad20cd63fcb11a0cf2ca
-
SSDEEP
12288:JMmG1c2JW3zHBkdTYHvCicPmvpItUBLZsJ7KLctBhhoeThzvF1pVQ2KO43s9ub45:JCZV+jBItRTVF1dNqhH7jmbyU+ergU
Malware Config
Extracted
darkcomet
Guest16
127.0.0.1:1604
DC_MUTEX-46MKRG6
-
InstallPath
Windupdt\winupdate.exe
-
gencode
SsSbby=wZDXq
-
install
true
-
offline_keylogger
true
-
password
dreamh4ck
-
persistence
true
-
reg_key
winupdater
Extracted
darkcomet
- gencode
-
install
false
-
offline_keylogger
false
-
persistence
false
Signatures
-
Darkcomet family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windupdt\\winupdate.exe" vbc.exe -
Executes dropped EXE 1 IoCs
pid Process 2824 winupdate.exe -
Loads dropped DLL 1 IoCs
pid Process 2892 vbc.exe -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" vbc.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1096 set thread context of 2892 1096 JaffaCakes118_25d94481f4967537d4b75902827e1948.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_25d94481f4967537d4b75902827e1948.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winupdate.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2740 cmd.exe 3000 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3000 PING.EXE -
Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2892 vbc.exe Token: SeSecurityPrivilege 2892 vbc.exe Token: SeTakeOwnershipPrivilege 2892 vbc.exe Token: SeLoadDriverPrivilege 2892 vbc.exe Token: SeSystemProfilePrivilege 2892 vbc.exe Token: SeSystemtimePrivilege 2892 vbc.exe Token: SeProfSingleProcessPrivilege 2892 vbc.exe Token: SeIncBasePriorityPrivilege 2892 vbc.exe Token: SeCreatePagefilePrivilege 2892 vbc.exe Token: SeBackupPrivilege 2892 vbc.exe Token: SeRestorePrivilege 2892 vbc.exe Token: SeShutdownPrivilege 2892 vbc.exe Token: SeDebugPrivilege 2892 vbc.exe Token: SeSystemEnvironmentPrivilege 2892 vbc.exe Token: SeChangeNotifyPrivilege 2892 vbc.exe Token: SeRemoteShutdownPrivilege 2892 vbc.exe Token: SeUndockPrivilege 2892 vbc.exe Token: SeManageVolumePrivilege 2892 vbc.exe Token: SeImpersonatePrivilege 2892 vbc.exe Token: SeCreateGlobalPrivilege 2892 vbc.exe Token: 33 2892 vbc.exe Token: 34 2892 vbc.exe Token: 35 2892 vbc.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1096 wrote to memory of 2892 1096 JaffaCakes118_25d94481f4967537d4b75902827e1948.exe 30 PID 1096 wrote to memory of 2892 1096 JaffaCakes118_25d94481f4967537d4b75902827e1948.exe 30 PID 1096 wrote to memory of 2892 1096 JaffaCakes118_25d94481f4967537d4b75902827e1948.exe 30 PID 1096 wrote to memory of 2892 1096 JaffaCakes118_25d94481f4967537d4b75902827e1948.exe 30 PID 1096 wrote to memory of 2892 1096 JaffaCakes118_25d94481f4967537d4b75902827e1948.exe 30 PID 1096 wrote to memory of 2892 1096 JaffaCakes118_25d94481f4967537d4b75902827e1948.exe 30 PID 1096 wrote to memory of 2892 1096 JaffaCakes118_25d94481f4967537d4b75902827e1948.exe 30 PID 1096 wrote to memory of 2892 1096 JaffaCakes118_25d94481f4967537d4b75902827e1948.exe 30 PID 1096 wrote to memory of 2892 1096 JaffaCakes118_25d94481f4967537d4b75902827e1948.exe 30 PID 1096 wrote to memory of 2892 1096 JaffaCakes118_25d94481f4967537d4b75902827e1948.exe 30 PID 1096 wrote to memory of 2892 1096 JaffaCakes118_25d94481f4967537d4b75902827e1948.exe 30 PID 1096 wrote to memory of 2892 1096 JaffaCakes118_25d94481f4967537d4b75902827e1948.exe 30 PID 1096 wrote to memory of 2892 1096 JaffaCakes118_25d94481f4967537d4b75902827e1948.exe 30 PID 2892 wrote to memory of 2824 2892 vbc.exe 31 PID 2892 wrote to memory of 2824 2892 vbc.exe 31 PID 2892 wrote to memory of 2824 2892 vbc.exe 31 PID 2892 wrote to memory of 2824 2892 vbc.exe 31 PID 2892 wrote to memory of 2824 2892 vbc.exe 31 PID 2892 wrote to memory of 2824 2892 vbc.exe 31 PID 2892 wrote to memory of 2824 2892 vbc.exe 31 PID 2892 wrote to memory of 2740 2892 vbc.exe 32 PID 2892 wrote to memory of 2740 2892 vbc.exe 32 PID 2892 wrote to memory of 2740 2892 vbc.exe 32 PID 2892 wrote to memory of 2740 2892 vbc.exe 32 PID 2740 wrote to memory of 3000 2740 cmd.exe 35 PID 2740 wrote to memory of 3000 2740 cmd.exe 35 PID 2740 wrote to memory of 3000 2740 cmd.exe 35 PID 2740 wrote to memory of 3000 2740 cmd.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_25d94481f4967537d4b75902827e1948.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_25d94481f4967537d4b75902827e1948.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe2⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Windupdt\winupdate.exe"C:\Windupdt\winupdate.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2824
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"3⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 54⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3000
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98