darkcomet | 4b259a4d6a566836a4e511b7ca5d0bd5775360fd52eaf89b03035d4e602431c5

Analysis

max time kernel
151s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 00:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
Size

1.3MB
MD5

1816dd0f974fecd01a3aee390593de19
SHA1

67c477675af6dfd5fca81669a58daae9fa8ddc8c
SHA256

4b259a4d6a566836a4e511b7ca5d0bd5775360fd52eaf89b03035d4e602431c5
SHA512

2488732d171cbd43f283cf423d493b1294439a5a4e200b6454a24267eb8f2a815058ef4798c16198b9b6bd4dbbb5442adaf103f483b02935b098bd9fa5fe966a
SSDEEP

24576:KdWfwUBOzQKW8d4UR/tqhnyMIo0eyauZUKctbFPZX46fJ6dVUqhkNvaWJ6Uq:q0p6pR/mndIoxyPU/btmVUqyRTq

Score

10^/10

darkcomet metin2-gio evasion persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

metin2-gio

127.0.0.1:1604

hepter.dyndns.biz:8211

hepter.no-ip.org:8211

127.0.0.1:8211

Mutex

DC_MUTEX-C50UDX6

Attributes

InstallPath
Resimlerim\Profiles\chrome.exe
gencode
ja8PAQUAvm4V
install
true
offline_keylogger
true
password
hepter
persistence
true
reg_key
GoogleUpdate

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\Resimlerim\\Profiles\\chrome.exe"	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe

Modifies firewall policy service 3 TTPs 3 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	chrome.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	chrome.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	chrome.exe

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Windows Service
T1543.003

Processes:

chrome.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" chrome.exe
Windows security bypass 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

chrome.exe

description ioc process

Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" chrome.exe
Disables RegEdit via registry modification 1 IoCs
evasion

Processes:

chrome.exe

description ioc process

Set value (int) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" chrome.exe
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

656 attrib.exe
376 attrib.exe
Deletes itself 1 IoCs

Processes:

notepad.exe

pid process

1616 notepad.exe
Executes dropped EXE 3 IoCs

Processes:

chrome.exechrome.exechrome.exe

pid process

1940 chrome.exe
1036 chrome.exe
2824 chrome.exe
Loads dropped DLL 4 IoCs

Processes:

1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exechrome.exe

pid process

840 1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
2612 1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
2612 1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
1940 chrome.exe
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

chrome.exe

description ioc process

Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" chrome.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	chrome.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	chrome.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	chrome.exe

pid	process
656	attrib.exe
376	attrib.exe

pid	process
1616	notepad.exe

pid	process
1940	chrome.exe
1036	chrome.exe
2824	chrome.exe

pid	process
840	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
2612	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
2612	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
1940	chrome.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	chrome.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exechrome.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\GoogleUpdate = "C:\\Users\\Admin\\Documents\\Resimlerim\\Profiles\\chrome.exe"	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\GoogleUpdate = "C:\\Users\\Admin\\Documents\\Resimlerim\\Profiles\\chrome.exe"	chrome.exe

Drops file in System32 directory 1 IoCs

Processes:

1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe

description ioc process

File created C:\Windows\SysWOW64\0c0c0c0c.dll 1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\SysWOW64\0c0c0c0c.dll	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exechrome.exechrome.exe

description	pid	process	target process
PID 840 set thread context of 2656	840	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
PID 2656 set thread context of 2612	2656	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
PID 1940 set thread context of 1036	1940	chrome.exe	chrome.exe
PID 1036 set thread context of 2824	1036	chrome.exe	chrome.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

chrome.exe

pid process

2824 chrome.exe

pid	process
2824	chrome.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exechrome.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2612	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
Token: SeSecurityPrivilege	2612	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2612	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	2612	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	2612	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
Token: SeSystemtimePrivilege	2612	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	2612	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2612	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	2612	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
Token: SeBackupPrivilege	2612	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
Token: SeRestorePrivilege	2612	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
Token: SeShutdownPrivilege	2612	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
Token: SeDebugPrivilege	2612	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	2612	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	2612	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	2612	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
Token: SeUndockPrivilege	2612	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
Token: SeManageVolumePrivilege	2612	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
Token: SeImpersonatePrivilege	2612	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	2612	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
Token: 33	2612	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
Token: 34	2612	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
Token: 35	2612	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	2824	chrome.exe
Token: SeSecurityPrivilege	2824	chrome.exe
Token: SeTakeOwnershipPrivilege	2824	chrome.exe
Token: SeLoadDriverPrivilege	2824	chrome.exe
Token: SeSystemProfilePrivilege	2824	chrome.exe
Token: SeSystemtimePrivilege	2824	chrome.exe
Token: SeProfSingleProcessPrivilege	2824	chrome.exe
Token: SeIncBasePriorityPrivilege	2824	chrome.exe
Token: SeCreatePagefilePrivilege	2824	chrome.exe
Token: SeBackupPrivilege	2824	chrome.exe
Token: SeRestorePrivilege	2824	chrome.exe
Token: SeShutdownPrivilege	2824	chrome.exe
Token: SeDebugPrivilege	2824	chrome.exe
Token: SeSystemEnvironmentPrivilege	2824	chrome.exe
Token: SeChangeNotifyPrivilege	2824	chrome.exe
Token: SeRemoteShutdownPrivilege	2824	chrome.exe
Token: SeUndockPrivilege	2824	chrome.exe
Token: SeManageVolumePrivilege	2824	chrome.exe
Token: SeImpersonatePrivilege	2824	chrome.exe
Token: SeCreateGlobalPrivilege	2824	chrome.exe
Token: 33	2824	chrome.exe
Token: 34	2824	chrome.exe
Token: 35	2824	chrome.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exechrome.exechrome.exechrome.exe

pid process

840 1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
2656 1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
1940 chrome.exe
1036 chrome.exe
2824 chrome.exe

pid	process
840	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
2656	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
1940	chrome.exe
1036	chrome.exe
2824	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe1816dd0f974fecd01a3aee390593de19_JaffaCakes118.execmd.execmd.exechrome.exe

description	pid	process	target process
PID 840 wrote to memory of 2656	840	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
PID 840 wrote to memory of 2656	840	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
PID 840 wrote to memory of 2656	840	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
PID 840 wrote to memory of 2656	840	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
PID 840 wrote to memory of 2656	840	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
PID 840 wrote to memory of 2656	840	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
PID 840 wrote to memory of 2656	840	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
PID 840 wrote to memory of 2656	840	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
PID 840 wrote to memory of 2656	840	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
PID 2656 wrote to memory of 2612	2656	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
PID 2656 wrote to memory of 2612	2656	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
PID 2656 wrote to memory of 2612	2656	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
PID 2656 wrote to memory of 2612	2656	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
PID 2656 wrote to memory of 2612	2656	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
PID 2656 wrote to memory of 2612	2656	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
PID 2656 wrote to memory of 2612	2656	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
PID 2656 wrote to memory of 2612	2656	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
PID 2656 wrote to memory of 2612	2656	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
PID 2656 wrote to memory of 2612	2656	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
PID 2656 wrote to memory of 2612	2656	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
PID 2656 wrote to memory of 2612	2656	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
PID 2656 wrote to memory of 2612	2656	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
PID 2612 wrote to memory of 2568	2612	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe	cmd.exe
PID 2612 wrote to memory of 2568	2612	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe	cmd.exe
PID 2612 wrote to memory of 2568	2612	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe	cmd.exe
PID 2612 wrote to memory of 2568	2612	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe	cmd.exe
PID 2612 wrote to memory of 2416	2612	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe	cmd.exe
PID 2612 wrote to memory of 2416	2612	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe	cmd.exe
PID 2612 wrote to memory of 2416	2612	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe	cmd.exe
PID 2612 wrote to memory of 2416	2612	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe	cmd.exe
PID 2612 wrote to memory of 1616	2612	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe	notepad.exe
PID 2612 wrote to memory of 1616	2612	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe	notepad.exe
PID 2612 wrote to memory of 1616	2612	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe	notepad.exe
PID 2612 wrote to memory of 1616	2612	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe	notepad.exe
PID 2612 wrote to memory of 1616	2612	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe	notepad.exe
PID 2612 wrote to memory of 1616	2612	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe	notepad.exe
PID 2612 wrote to memory of 1616	2612	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe	notepad.exe
PID 2612 wrote to memory of 1616	2612	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe	notepad.exe
PID 2612 wrote to memory of 1616	2612	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe	notepad.exe
PID 2612 wrote to memory of 1616	2612	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe	notepad.exe
PID 2612 wrote to memory of 1616	2612	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe	notepad.exe
PID 2612 wrote to memory of 1616	2612	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe	notepad.exe
PID 2612 wrote to memory of 1616	2612	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe	notepad.exe
PID 2612 wrote to memory of 1616	2612	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe	notepad.exe
PID 2612 wrote to memory of 1616	2612	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe	notepad.exe
PID 2612 wrote to memory of 1616	2612	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe	notepad.exe
PID 2612 wrote to memory of 1616	2612	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe	notepad.exe
PID 2612 wrote to memory of 1616	2612	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe	notepad.exe
PID 2568 wrote to memory of 376	2568	cmd.exe	attrib.exe
PID 2568 wrote to memory of 376	2568	cmd.exe	attrib.exe
PID 2568 wrote to memory of 376	2568	cmd.exe	attrib.exe
PID 2568 wrote to memory of 376	2568	cmd.exe	attrib.exe
PID 2416 wrote to memory of 656	2416	cmd.exe	attrib.exe
PID 2416 wrote to memory of 656	2416	cmd.exe	attrib.exe
PID 2416 wrote to memory of 656	2416	cmd.exe	attrib.exe
PID 2416 wrote to memory of 656	2416	cmd.exe	attrib.exe
PID 2612 wrote to memory of 1940	2612	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe	chrome.exe
PID 2612 wrote to memory of 1940	2612	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe	chrome.exe
PID 2612 wrote to memory of 1940	2612	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe	chrome.exe
PID 2612 wrote to memory of 1940	2612	1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe	chrome.exe
PID 1940 wrote to memory of 1036	1940	chrome.exe	chrome.exe
PID 1940 wrote to memory of 1036	1940	chrome.exe	chrome.exe
PID 1940 wrote to memory of 1036	1940	chrome.exe	chrome.exe
PID 1940 wrote to memory of 1036	1940	chrome.exe	chrome.exe

Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

656 attrib.exe
376 attrib.exe

pid	process
656	attrib.exe
376	attrib.exe

C:\Users\Admin\AppData\Local\Temp\1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:840

C:\Users\Admin\AppData\Local\Temp\1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2656

C:\Users\Admin\AppData\Local\Temp\1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe"
3⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2612

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe" +s +h
4⤵
- Suspicious use of WriteProcessMemory
PID:2568

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp\1816dd0f974fecd01a3aee390593de19_JaffaCakes118.exe" +s +h
5⤵
- Sets file to hidden
- Views/modifies file attributes
PID:376

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
4⤵
- Suspicious use of WriteProcessMemory
PID:2416

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
5⤵
- Sets file to hidden
- Views/modifies file attributes
PID:656

C:\Windows\SysWOW64\notepad.exe
notepad
4⤵
- Deletes itself
PID:1616

C:\Users\Admin\Documents\Resimlerim\Profiles\chrome.exe
"C:\Users\Admin\Documents\Resimlerim\Profiles\chrome.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1940

C:\Users\Admin\Documents\Resimlerim\Profiles\chrome.exe
"C:\Users\Admin\Documents\Resimlerim\Profiles\chrome.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1036

C:\Users\Admin\Documents\Resimlerim\Profiles\chrome.exe
"C:\Users\Admin\Documents\Resimlerim\Profiles\chrome.exe"
6⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2824

C:\Windows\SysWOW64\notepad.exe
notepad
7⤵
PID:1840

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Disable or Modify System Firewall

T1562.004

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-39690363-730359138-1046745555-1000\88603cb2913a7df3fbd16b5f958e6447_793829ab-9e00-42f6-8ab9-a6ffde9cf44a
Filesize
51B

MD5
5fc2ac2a310f49c14d195230b91a8885

SHA1
90855cc11136ba31758fe33b5cf9571f9a104879

SHA256
374e0e2897a7a82e0e44794cad89df0f3cdd7703886239c1fe06d625efd48092

SHA512
ab46554df9174b9fe9beba50a640f67534c3812f64d96a1fb8adfdc136dfe730ca2370825cd45b7f87a544d6a58dd868cb5a3a7f42e2789f6d679dbc0fdd52c3

Download Submit
C:\Users\Admin\Documents\Resimlerim\Profiles\chrome.exe
Filesize
1.3MB

MD5
1816dd0f974fecd01a3aee390593de19

SHA1
67c477675af6dfd5fca81669a58daae9fa8ddc8c

SHA256
4b259a4d6a566836a4e511b7ca5d0bd5775360fd52eaf89b03035d4e602431c5

SHA512
2488732d171cbd43f283cf423d493b1294439a5a4e200b6454a24267eb8f2a815058ef4798c16198b9b6bd4dbbb5442adaf103f483b02935b098bd9fa5fe966a

Download Submit
\Windows\SysWOW64\0c0c0c0c.dll
Filesize
1.3MB

MD5
df5c622697dc8c743f3884914a9e4d99

SHA1
cdfc6345080dfa9c45d323f15532ad9274385d2f

SHA256
0ca52bc5cf854e274e15ba07df97b2e75ec4e1fc2d90f23676da7fa3c95da089

SHA512
59867bb9608c250661a6eb823f06c907d334eb4f638b04f21cf10213e5163035c37261f5213642c703dd382871a5d3ae764839c1b93e18e833d85ac0e3409f90

Download Submit
memory/840-0-0x0000000000400000-0x00000000005D4000-memory.dmp

Filesize
1.8MB

Download
memory/840-1-0x0000000000020000-0x0000000000023000-memory.dmp

Filesize
12KB

Download
memory/840-11-0x0000000000400000-0x00000000005D4000-memory.dmp

Filesize
1.8MB

Download
memory/840-12-0x0000000002CC0000-0x0000000002E94000-memory.dmp

Filesize
1.8MB

Download
memory/1616-67-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/1616-43-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/1940-79-0x0000000000400000-0x00000000005D4000-memory.dmp

Filesize
1.8MB

Download
memory/1940-88-0x0000000000400000-0x00000000005D4000-memory.dmp

Filesize
1.8MB

Download
memory/2612-26-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2612-17-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2612-28-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2612-32-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2612-24-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2612-23-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2612-21-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2612-20-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2612-33-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2612-30-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2612-22-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2612-34-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2612-78-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2612-39-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2612-38-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2656-7-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2656-10-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2656-37-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download