Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-06-2024 05:49
Static task
static1
Behavioral task
behavioral1
Sample
19032a633afb59d6a619f5f9cc1158a2_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
19032a633afb59d6a619f5f9cc1158a2_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
19032a633afb59d6a619f5f9cc1158a2_JaffaCakes118.exe
-
Size
865KB
-
MD5
19032a633afb59d6a619f5f9cc1158a2
-
SHA1
200eaa035a9caaf10cbbfb6a49208dd006babdf6
-
SHA256
35bc08c80902a5f572582183c9b89891cccf2a80b5527e9a00a573e30a0883bb
-
SHA512
82a77646c6b1171fcaa311a7408f4a1178cbb8b980c7f030beb6a58766642b68dfdefa0a00f426ce333b11ee7017702f83dacf391ac7b05baf498df2b27b27bd
-
SSDEEP
24576:HjmyKIeu4p0/h/2C/LCWWwwndeJNW24sbtv4SPJ:HjZKIeu4p0/52C/+WPwndcNW24sJv4SB
Malware Config
Extracted
darkcomet
Skymike2DC_1337
skymike2dc.no-ip.biz:1604
DC_MUTEX-F2H6DRH
-
gencode
lpra1CCJYwgT
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
winini.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "expstart.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\winini.exe" winini.exe -
Executes dropped EXE 2 IoCs
Processes:
winini.execvtres.exepid process 2544 winini.exe 2680 cvtres.exe -
Loads dropped DLL 3 IoCs
Processes:
19032a633afb59d6a619f5f9cc1158a2_JaffaCakes118.exewinini.exepid process 2728 19032a633afb59d6a619f5f9cc1158a2_JaffaCakes118.exe 2728 19032a633afb59d6a619f5f9cc1158a2_JaffaCakes118.exe 2544 winini.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
winini.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Live = "C:\\Users\\Admin\\AppData\\Local\\Temp\\winini.exe" winini.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
winini.exedescription pid process target process PID 2544 set thread context of 2680 2544 winini.exe cvtres.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
winini.exepid process 2544 winini.exe 2544 winini.exe -
Suspicious use of AdjustPrivilegeToken 25 IoCs
Processes:
winini.execvtres.exedescription pid process Token: SeDebugPrivilege 2544 winini.exe Token: SeDebugPrivilege 2544 winini.exe Token: SeIncreaseQuotaPrivilege 2680 cvtres.exe Token: SeSecurityPrivilege 2680 cvtres.exe Token: SeTakeOwnershipPrivilege 2680 cvtres.exe Token: SeLoadDriverPrivilege 2680 cvtres.exe Token: SeSystemProfilePrivilege 2680 cvtres.exe Token: SeSystemtimePrivilege 2680 cvtres.exe Token: SeProfSingleProcessPrivilege 2680 cvtres.exe Token: SeIncBasePriorityPrivilege 2680 cvtres.exe Token: SeCreatePagefilePrivilege 2680 cvtres.exe Token: SeBackupPrivilege 2680 cvtres.exe Token: SeRestorePrivilege 2680 cvtres.exe Token: SeShutdownPrivilege 2680 cvtres.exe Token: SeDebugPrivilege 2680 cvtres.exe Token: SeSystemEnvironmentPrivilege 2680 cvtres.exe Token: SeChangeNotifyPrivilege 2680 cvtres.exe Token: SeRemoteShutdownPrivilege 2680 cvtres.exe Token: SeUndockPrivilege 2680 cvtres.exe Token: SeManageVolumePrivilege 2680 cvtres.exe Token: SeImpersonatePrivilege 2680 cvtres.exe Token: SeCreateGlobalPrivilege 2680 cvtres.exe Token: 33 2680 cvtres.exe Token: 34 2680 cvtres.exe Token: 35 2680 cvtres.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
cvtres.exepid process 2680 cvtres.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
19032a633afb59d6a619f5f9cc1158a2_JaffaCakes118.exewinini.exedescription pid process target process PID 2728 wrote to memory of 2544 2728 19032a633afb59d6a619f5f9cc1158a2_JaffaCakes118.exe winini.exe PID 2728 wrote to memory of 2544 2728 19032a633afb59d6a619f5f9cc1158a2_JaffaCakes118.exe winini.exe PID 2728 wrote to memory of 2544 2728 19032a633afb59d6a619f5f9cc1158a2_JaffaCakes118.exe winini.exe PID 2728 wrote to memory of 2544 2728 19032a633afb59d6a619f5f9cc1158a2_JaffaCakes118.exe winini.exe PID 2544 wrote to memory of 2680 2544 winini.exe cvtres.exe PID 2544 wrote to memory of 2680 2544 winini.exe cvtres.exe PID 2544 wrote to memory of 2680 2544 winini.exe cvtres.exe PID 2544 wrote to memory of 2680 2544 winini.exe cvtres.exe PID 2544 wrote to memory of 2680 2544 winini.exe cvtres.exe PID 2544 wrote to memory of 2680 2544 winini.exe cvtres.exe PID 2544 wrote to memory of 2680 2544 winini.exe cvtres.exe PID 2544 wrote to memory of 2680 2544 winini.exe cvtres.exe PID 2544 wrote to memory of 2680 2544 winini.exe cvtres.exe PID 2544 wrote to memory of 2680 2544 winini.exe cvtres.exe PID 2544 wrote to memory of 2680 2544 winini.exe cvtres.exe PID 2544 wrote to memory of 2680 2544 winini.exe cvtres.exe PID 2544 wrote to memory of 2680 2544 winini.exe cvtres.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\19032a633afb59d6a619f5f9cc1158a2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\19032a633afb59d6a619f5f9cc1158a2_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\winini.exe"C:\Users\Admin\AppData\Local\Temp\winini.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cvtres.exeC:\Users\Admin\AppData\Local\Temp\\cvtres.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\cvtres.exeFilesize
31KB
MD5ed797d8dc2c92401985d162e42ffa450
SHA10f02fc517c7facc4baefde4fe9467fb6488ebabe
SHA256b746362010a101cb5931bc066f0f4d3fc740c02a68c1f37fc3c8e6c87fd7cb1e
SHA512e831a6ff987f3ef29982da16afad06938b68eddd43c234ba88d1c96a1b5547f2284baf35cbb3a5bfd75e7f0445d14daa014e0ba00b4db72c67f83f0a314c80c2
-
\Users\Admin\AppData\Local\Temp\winini.exeFilesize
456KB
MD50fdd1f2655c96e1657379dce2a5d67c0
SHA17cb5f6556682da965021c9c483b1d2360705ba15
SHA256b1597e64ac73a4170a751c055e882123e99441b7449ff4bafb6ca5f64e465d11
SHA51284593ca9872e5a23fa090075d3dc665c81962bef1acfd2b43d2607ab42daa43f7e5f5195bb62669cba053c4cc01f7e23a258fdaf4662a96cc507c7c2a36cf03b
-
memory/2544-16-0x0000000074B70000-0x000000007511B000-memory.dmpFilesize
5.7MB
-
memory/2544-42-0x0000000074B70000-0x000000007511B000-memory.dmpFilesize
5.7MB
-
memory/2544-15-0x0000000074B70000-0x000000007511B000-memory.dmpFilesize
5.7MB
-
memory/2544-14-0x0000000074B70000-0x000000007511B000-memory.dmpFilesize
5.7MB
-
memory/2680-23-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2680-41-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2680-56-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2680-21-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2680-36-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2680-34-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2680-32-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2680-30-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2680-29-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2680-28-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2680-26-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2680-25-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2680-55-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2680-37-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2680-31-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2680-38-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2680-40-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2680-54-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2680-53-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2680-43-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2680-44-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2680-45-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2680-46-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2680-47-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2680-48-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2680-49-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2680-50-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2680-51-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2680-52-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/2728-1-0x0000000074B70000-0x000000007511B000-memory.dmpFilesize
5.7MB
-
memory/2728-13-0x0000000074B70000-0x000000007511B000-memory.dmpFilesize
5.7MB
-
memory/2728-0-0x0000000074B71000-0x0000000074B72000-memory.dmpFilesize
4KB
-
memory/2728-2-0x0000000074B70000-0x000000007511B000-memory.dmpFilesize
5.7MB