Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
01/03/2025, 20:17
Behavioral task
behavioral1
Sample
JaffaCakes118_3b549ca77da9836e659cff04c765cba0.exe
Resource
win7-20240729-en
General
-
Target
JaffaCakes118_3b549ca77da9836e659cff04c765cba0.exe
-
Size
658KB
-
MD5
3b549ca77da9836e659cff04c765cba0
-
SHA1
d9a9ad224df713d00242284c6409c225c1e5e9f6
-
SHA256
94b18bddde9eab999dfa8877ea093db4780e5e5e73b53e727290e145e93af37c
-
SHA512
fc836ebb4fa0f4fff813bbd349cd5fcdbb5248acede03a38f6b5c0f4d04e0bbf2506cfb16c6883a5b99978946aeae8d6a407e0b08f7be47a98d2c612266de06b
-
SSDEEP
12288:a9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/h0:WZ1xuVVjfFoynPaVBUR8f+kN10EBm
Malware Config
Extracted
darkcomet
Guest16
hackertoday.no-ip.biz:1604
DC_MUTEX-L7PC5P8
-
gencode
25KoFNG9yLPg
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Darkcomet family
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_3b549ca77da9836e659cff04c765cba0.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4216 JaffaCakes118_3b549ca77da9836e659cff04c765cba0.exe Token: SeSecurityPrivilege 4216 JaffaCakes118_3b549ca77da9836e659cff04c765cba0.exe Token: SeTakeOwnershipPrivilege 4216 JaffaCakes118_3b549ca77da9836e659cff04c765cba0.exe Token: SeLoadDriverPrivilege 4216 JaffaCakes118_3b549ca77da9836e659cff04c765cba0.exe Token: SeSystemProfilePrivilege 4216 JaffaCakes118_3b549ca77da9836e659cff04c765cba0.exe Token: SeSystemtimePrivilege 4216 JaffaCakes118_3b549ca77da9836e659cff04c765cba0.exe Token: SeProfSingleProcessPrivilege 4216 JaffaCakes118_3b549ca77da9836e659cff04c765cba0.exe Token: SeIncBasePriorityPrivilege 4216 JaffaCakes118_3b549ca77da9836e659cff04c765cba0.exe Token: SeCreatePagefilePrivilege 4216 JaffaCakes118_3b549ca77da9836e659cff04c765cba0.exe Token: SeBackupPrivilege 4216 JaffaCakes118_3b549ca77da9836e659cff04c765cba0.exe Token: SeRestorePrivilege 4216 JaffaCakes118_3b549ca77da9836e659cff04c765cba0.exe Token: SeShutdownPrivilege 4216 JaffaCakes118_3b549ca77da9836e659cff04c765cba0.exe Token: SeDebugPrivilege 4216 JaffaCakes118_3b549ca77da9836e659cff04c765cba0.exe Token: SeSystemEnvironmentPrivilege 4216 JaffaCakes118_3b549ca77da9836e659cff04c765cba0.exe Token: SeChangeNotifyPrivilege 4216 JaffaCakes118_3b549ca77da9836e659cff04c765cba0.exe Token: SeRemoteShutdownPrivilege 4216 JaffaCakes118_3b549ca77da9836e659cff04c765cba0.exe Token: SeUndockPrivilege 4216 JaffaCakes118_3b549ca77da9836e659cff04c765cba0.exe Token: SeManageVolumePrivilege 4216 JaffaCakes118_3b549ca77da9836e659cff04c765cba0.exe Token: SeImpersonatePrivilege 4216 JaffaCakes118_3b549ca77da9836e659cff04c765cba0.exe Token: SeCreateGlobalPrivilege 4216 JaffaCakes118_3b549ca77da9836e659cff04c765cba0.exe Token: 33 4216 JaffaCakes118_3b549ca77da9836e659cff04c765cba0.exe Token: 34 4216 JaffaCakes118_3b549ca77da9836e659cff04c765cba0.exe Token: 35 4216 JaffaCakes118_3b549ca77da9836e659cff04c765cba0.exe Token: 36 4216 JaffaCakes118_3b549ca77da9836e659cff04c765cba0.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4216 JaffaCakes118_3b549ca77da9836e659cff04c765cba0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3b549ca77da9836e659cff04c765cba0.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3b549ca77da9836e659cff04c765cba0.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4216