Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
28-06-2024 05:49
Static task
static1
Behavioral task
behavioral1
Sample
19032a633afb59d6a619f5f9cc1158a2_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
19032a633afb59d6a619f5f9cc1158a2_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
19032a633afb59d6a619f5f9cc1158a2_JaffaCakes118.exe
-
Size
865KB
-
MD5
19032a633afb59d6a619f5f9cc1158a2
-
SHA1
200eaa035a9caaf10cbbfb6a49208dd006babdf6
-
SHA256
35bc08c80902a5f572582183c9b89891cccf2a80b5527e9a00a573e30a0883bb
-
SHA512
82a77646c6b1171fcaa311a7408f4a1178cbb8b980c7f030beb6a58766642b68dfdefa0a00f426ce333b11ee7017702f83dacf391ac7b05baf498df2b27b27bd
-
SSDEEP
24576:HjmyKIeu4p0/h/2C/LCWWwwndeJNW24sbtv4SPJ:HjZKIeu4p0/52C/+WPwndcNW24sJv4SB
Malware Config
Extracted
darkcomet
Skymike2DC_1337
skymike2dc.no-ip.biz:1604
DC_MUTEX-F2H6DRH
-
gencode
lpra1CCJYwgT
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
winini.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "expstart.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\winini.exe" winini.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
19032a633afb59d6a619f5f9cc1158a2_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\Control Panel\International\Geo\Nation 19032a633afb59d6a619f5f9cc1158a2_JaffaCakes118.exe -
Executes dropped EXE 2 IoCs
Processes:
winini.execvtres.exepid process 1784 winini.exe 4996 cvtres.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
winini.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Live = "C:\\Users\\Admin\\AppData\\Local\\Temp\\winini.exe" winini.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
winini.exedescription pid process target process PID 1784 set thread context of 4996 1784 winini.exe cvtres.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
winini.exepid process 1784 winini.exe 1784 winini.exe -
Suspicious use of AdjustPrivilegeToken 26 IoCs
Processes:
cvtres.exewinini.exedescription pid process Token: SeIncreaseQuotaPrivilege 4996 cvtres.exe Token: SeSecurityPrivilege 4996 cvtres.exe Token: SeTakeOwnershipPrivilege 4996 cvtres.exe Token: SeLoadDriverPrivilege 4996 cvtres.exe Token: SeSystemProfilePrivilege 4996 cvtres.exe Token: SeSystemtimePrivilege 4996 cvtres.exe Token: SeProfSingleProcessPrivilege 4996 cvtres.exe Token: SeIncBasePriorityPrivilege 4996 cvtres.exe Token: SeCreatePagefilePrivilege 4996 cvtres.exe Token: SeBackupPrivilege 4996 cvtres.exe Token: SeRestorePrivilege 4996 cvtres.exe Token: SeShutdownPrivilege 4996 cvtres.exe Token: SeDebugPrivilege 4996 cvtres.exe Token: SeSystemEnvironmentPrivilege 4996 cvtres.exe Token: SeChangeNotifyPrivilege 4996 cvtres.exe Token: SeRemoteShutdownPrivilege 4996 cvtres.exe Token: SeUndockPrivilege 4996 cvtres.exe Token: SeManageVolumePrivilege 4996 cvtres.exe Token: SeImpersonatePrivilege 4996 cvtres.exe Token: SeCreateGlobalPrivilege 4996 cvtres.exe Token: 33 4996 cvtres.exe Token: 34 4996 cvtres.exe Token: 35 4996 cvtres.exe Token: 36 4996 cvtres.exe Token: SeDebugPrivilege 1784 winini.exe Token: SeDebugPrivilege 1784 winini.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
cvtres.exepid process 4996 cvtres.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
19032a633afb59d6a619f5f9cc1158a2_JaffaCakes118.exewinini.exedescription pid process target process PID 1340 wrote to memory of 1784 1340 19032a633afb59d6a619f5f9cc1158a2_JaffaCakes118.exe winini.exe PID 1340 wrote to memory of 1784 1340 19032a633afb59d6a619f5f9cc1158a2_JaffaCakes118.exe winini.exe PID 1340 wrote to memory of 1784 1340 19032a633afb59d6a619f5f9cc1158a2_JaffaCakes118.exe winini.exe PID 1784 wrote to memory of 4996 1784 winini.exe cvtres.exe PID 1784 wrote to memory of 4996 1784 winini.exe cvtres.exe PID 1784 wrote to memory of 4996 1784 winini.exe cvtres.exe PID 1784 wrote to memory of 4996 1784 winini.exe cvtres.exe PID 1784 wrote to memory of 4996 1784 winini.exe cvtres.exe PID 1784 wrote to memory of 4996 1784 winini.exe cvtres.exe PID 1784 wrote to memory of 4996 1784 winini.exe cvtres.exe PID 1784 wrote to memory of 4996 1784 winini.exe cvtres.exe PID 1784 wrote to memory of 4996 1784 winini.exe cvtres.exe PID 1784 wrote to memory of 4996 1784 winini.exe cvtres.exe PID 1784 wrote to memory of 4996 1784 winini.exe cvtres.exe PID 1784 wrote to memory of 4996 1784 winini.exe cvtres.exe PID 1784 wrote to memory of 4996 1784 winini.exe cvtres.exe PID 1784 wrote to memory of 4996 1784 winini.exe cvtres.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\19032a633afb59d6a619f5f9cc1158a2_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\19032a633afb59d6a619f5f9cc1158a2_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\winini.exe"C:\Users\Admin\AppData\Local\Temp\winini.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cvtres.exeC:\Users\Admin\AppData\Local\Temp\\cvtres.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\cvtres.exeFilesize
34KB
MD5e118330b4629b12368d91b9df6488be0
SHA1ce90218c7e3b90df2a3409ec253048bb6472c2fd
SHA2563a0f2936b8c45e8ba3458d69d7859a63844469e698652e15fb56639d32f40cc9
SHA512ac91c04cb20223dbaaf594440cb778dff36e857921be427c8528ba4c6cdb3e8bf8e71e1ae8af7bde9c04ff5b97b379231625bc1a2b66aba2f98cd340cd8a94b0
-
C:\Users\Admin\AppData\Local\Temp\winini.exeFilesize
456KB
MD50fdd1f2655c96e1657379dce2a5d67c0
SHA17cb5f6556682da965021c9c483b1d2360705ba15
SHA256b1597e64ac73a4170a751c055e882123e99441b7449ff4bafb6ca5f64e465d11
SHA51284593ca9872e5a23fa090075d3dc665c81962bef1acfd2b43d2607ab42daa43f7e5f5195bb62669cba053c4cc01f7e23a258fdaf4662a96cc507c7c2a36cf03b
-
memory/1340-0-0x0000000074642000-0x0000000074643000-memory.dmpFilesize
4KB
-
memory/1340-1-0x0000000074640000-0x0000000074BF1000-memory.dmpFilesize
5.7MB
-
memory/1340-2-0x0000000074640000-0x0000000074BF1000-memory.dmpFilesize
5.7MB
-
memory/1340-15-0x0000000074640000-0x0000000074BF1000-memory.dmpFilesize
5.7MB
-
memory/1784-16-0x0000000074640000-0x0000000074BF1000-memory.dmpFilesize
5.7MB
-
memory/1784-17-0x0000000074640000-0x0000000074BF1000-memory.dmpFilesize
5.7MB
-
memory/1784-31-0x0000000074640000-0x0000000074BF1000-memory.dmpFilesize
5.7MB
-
memory/4996-29-0x00000000022D0000-0x00000000022D1000-memory.dmpFilesize
4KB
-
memory/4996-36-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/4996-24-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/4996-28-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/4996-27-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/4996-23-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/4996-20-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/4996-32-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/4996-33-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/4996-34-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/4996-35-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/4996-26-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/4996-37-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/4996-38-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/4996-39-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/4996-40-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/4996-41-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/4996-42-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/4996-43-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/4996-44-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/4996-45-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB