Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26/02/2025, 19:05
Behavioral task
behavioral1
Sample
JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe
-
Size
1.0MB
-
MD5
27f6e79bf04f1af7f41f50760c597893
-
SHA1
d52d80ccb437c2cc652b98c504f7a0ee1b0136d4
-
SHA256
ce10c10d0a415c12551d2b8273a351d33afac796203bb50cf4d4d2c8d57b8a04
-
SHA512
c062fff700338354c31395cd1f7a63615ffb34ac743286fcd1e3664551032db331d97065dfbf4ef5289c1a8ab2d9733695b8f0c91aee4a366a996c22030636ad
-
SSDEEP
12288:17Ibrt7GShRkOjsjIJ4JMLfodW/hazQ9UcA1kWUktNbgZyyaw6x94n1icb5zMQIp:17MPEQtnFVzIw3lKk1SKTWReDPs
Malware Config
Extracted
darkcomet
Guest16
moodi1231.no-ip.info:1604
DC_MUTEX-FCHAXEB
-
gencode
3DtAFWPacedK
-
install
false
-
offline_keylogger
true
-
persistence
false
Extracted
darkcomet
- gencode
-
install
false
-
offline_keylogger
false
-
persistence
false
Signatures
-
Darkcomet family
-
Executes dropped EXE 2 IoCs
pid Process 2748 MsCtfMonitor.exe 2620 rtscom.exe -
Loads dropped DLL 2 IoCs
pid Process 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2748 MsCtfMonitor.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\Activex Application Updater = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\MsCtfMonitor.exe" MsCtfMonitor.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2372 set thread context of 2792 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 31 PID 2620 set thread context of 1480 2620 rtscom.exe 34 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rtscom.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AppLaunch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AppLaunch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsCtfMonitor.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2748 MsCtfMonitor.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe -
Suspicious use of AdjustPrivilegeToken 49 IoCs
description pid Process Token: SeDebugPrivilege 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe Token: SeIncreaseQuotaPrivilege 2792 AppLaunch.exe Token: SeSecurityPrivilege 2792 AppLaunch.exe Token: SeTakeOwnershipPrivilege 2792 AppLaunch.exe Token: SeLoadDriverPrivilege 2792 AppLaunch.exe Token: SeSystemProfilePrivilege 2792 AppLaunch.exe Token: SeSystemtimePrivilege 2792 AppLaunch.exe Token: SeProfSingleProcessPrivilege 2792 AppLaunch.exe Token: SeIncBasePriorityPrivilege 2792 AppLaunch.exe Token: SeCreatePagefilePrivilege 2792 AppLaunch.exe Token: SeBackupPrivilege 2792 AppLaunch.exe Token: SeRestorePrivilege 2792 AppLaunch.exe Token: SeShutdownPrivilege 2792 AppLaunch.exe Token: SeDebugPrivilege 2792 AppLaunch.exe Token: SeSystemEnvironmentPrivilege 2792 AppLaunch.exe Token: SeChangeNotifyPrivilege 2792 AppLaunch.exe Token: SeRemoteShutdownPrivilege 2792 AppLaunch.exe Token: SeUndockPrivilege 2792 AppLaunch.exe Token: SeManageVolumePrivilege 2792 AppLaunch.exe Token: SeImpersonatePrivilege 2792 AppLaunch.exe Token: SeCreateGlobalPrivilege 2792 AppLaunch.exe Token: 33 2792 AppLaunch.exe Token: 34 2792 AppLaunch.exe Token: 35 2792 AppLaunch.exe Token: SeDebugPrivilege 2748 MsCtfMonitor.exe Token: SeDebugPrivilege 2620 rtscom.exe Token: SeIncreaseQuotaPrivilege 1480 AppLaunch.exe Token: SeSecurityPrivilege 1480 AppLaunch.exe Token: SeTakeOwnershipPrivilege 1480 AppLaunch.exe Token: SeLoadDriverPrivilege 1480 AppLaunch.exe Token: SeSystemProfilePrivilege 1480 AppLaunch.exe Token: SeSystemtimePrivilege 1480 AppLaunch.exe Token: SeProfSingleProcessPrivilege 1480 AppLaunch.exe Token: SeIncBasePriorityPrivilege 1480 AppLaunch.exe Token: SeCreatePagefilePrivilege 1480 AppLaunch.exe Token: SeBackupPrivilege 1480 AppLaunch.exe Token: SeRestorePrivilege 1480 AppLaunch.exe Token: SeShutdownPrivilege 1480 AppLaunch.exe Token: SeDebugPrivilege 1480 AppLaunch.exe Token: SeSystemEnvironmentPrivilege 1480 AppLaunch.exe Token: SeChangeNotifyPrivilege 1480 AppLaunch.exe Token: SeRemoteShutdownPrivilege 1480 AppLaunch.exe Token: SeUndockPrivilege 1480 AppLaunch.exe Token: SeManageVolumePrivilege 1480 AppLaunch.exe Token: SeImpersonatePrivilege 1480 AppLaunch.exe Token: SeCreateGlobalPrivilege 1480 AppLaunch.exe Token: 33 1480 AppLaunch.exe Token: 34 1480 AppLaunch.exe Token: 35 1480 AppLaunch.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2792 AppLaunch.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 2372 wrote to memory of 2792 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 31 PID 2372 wrote to memory of 2792 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 31 PID 2372 wrote to memory of 2792 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 31 PID 2372 wrote to memory of 2792 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 31 PID 2372 wrote to memory of 2792 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 31 PID 2372 wrote to memory of 2792 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 31 PID 2372 wrote to memory of 2792 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 31 PID 2372 wrote to memory of 2792 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 31 PID 2372 wrote to memory of 2792 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 31 PID 2372 wrote to memory of 2792 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 31 PID 2372 wrote to memory of 2792 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 31 PID 2372 wrote to memory of 2792 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 31 PID 2372 wrote to memory of 2792 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 31 PID 2372 wrote to memory of 2792 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 31 PID 2372 wrote to memory of 2792 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 31 PID 2372 wrote to memory of 2792 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 31 PID 2372 wrote to memory of 2748 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 32 PID 2372 wrote to memory of 2748 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 32 PID 2372 wrote to memory of 2748 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 32 PID 2372 wrote to memory of 2748 2372 JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe 32 PID 2748 wrote to memory of 2620 2748 MsCtfMonitor.exe 33 PID 2748 wrote to memory of 2620 2748 MsCtfMonitor.exe 33 PID 2748 wrote to memory of 2620 2748 MsCtfMonitor.exe 33 PID 2748 wrote to memory of 2620 2748 MsCtfMonitor.exe 33 PID 2620 wrote to memory of 1480 2620 rtscom.exe 34 PID 2620 wrote to memory of 1480 2620 rtscom.exe 34 PID 2620 wrote to memory of 1480 2620 rtscom.exe 34 PID 2620 wrote to memory of 1480 2620 rtscom.exe 34 PID 2620 wrote to memory of 1480 2620 rtscom.exe 34 PID 2620 wrote to memory of 1480 2620 rtscom.exe 34 PID 2620 wrote to memory of 1480 2620 rtscom.exe 34 PID 2620 wrote to memory of 1480 2620 rtscom.exe 34 PID 2620 wrote to memory of 1480 2620 rtscom.exe 34 PID 2620 wrote to memory of 1480 2620 rtscom.exe 34 PID 2620 wrote to memory of 1480 2620 rtscom.exe 34 PID 2620 wrote to memory of 1480 2620 rtscom.exe 34 PID 2620 wrote to memory of 1480 2620 rtscom.exe 34 PID 2620 wrote to memory of 1480 2620 rtscom.exe 34 PID 2620 wrote to memory of 1480 2620 rtscom.exe 34 PID 2620 wrote to memory of 1480 2620 rtscom.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_27f6e79bf04f1af7f41f50760c597893.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2792
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MsCtfMonitor.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\MsCtfMonitor.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\rtscom.exe"C:\Users\Admin\AppData\Local\Temp\rtscom.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1480
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD527f6e79bf04f1af7f41f50760c597893
SHA1d52d80ccb437c2cc652b98c504f7a0ee1b0136d4
SHA256ce10c10d0a415c12551d2b8273a351d33afac796203bb50cf4d4d2c8d57b8a04
SHA512c062fff700338354c31395cd1f7a63615ffb34ac743286fcd1e3664551032db331d97065dfbf4ef5289c1a8ab2d9733695b8f0c91aee4a366a996c22030636ad
-
Filesize
9KB
MD5647877b85c58069ec029be692f92b5a9
SHA183992787b164769fd57db74a6aa76592d1d1ac36
SHA2568c4782baeaa123cec28fdae782020122adfdba8bee767bc3c19f6293b8c88fa4
SHA5126b7bca094fc5f4541ef77cdaf7aaa298661057f7ee60a11bcb7c5dc784d72eecbdbcefdbd69286c259fa4517286f810ee2281c3441a591aedd68ed43afa24ec2