Analysis
-
max time kernel
134s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
28-06-2024 14:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe
Resource
win7-20231129-en
6 signatures
150 seconds
General
-
Target
1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe
-
Size
522KB
-
MD5
1a711246b276ce21ea055b041b4a777e
-
SHA1
408b34c29da8cdb6cbf04d64b096c64e3c864b43
-
SHA256
7a2b40243923cd5f7976e346b65a265bd2eac7c209ed722488fb63a1c882b06c
-
SHA512
ae4875168a26eda43afdd65aebe7e22bd51492e2d2c088e0174ec72d9d6b0ae36a14d40ea0675da84538c26bdd16f100ff0999476b48ea6faa84080761477bd4
-
SSDEEP
12288:UmBvjkh9HLCmWltxoJngJn5Ivg49A6eM6MT9c769k:nvgnGmm95IICtX6MJK6W
Malware Config
Extracted
Family
darkcomet
Botnet
TARGETS
C2
darkjordan.zapto.org:99
Mutex
DC_MUTEX-6FPXA9V
Attributes
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
Z1MR6HYJYTTL
-
install
true
-
offline_keylogger
true
-
password
1983
-
persistence
false
-
reg_key
MicroUpdate
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exedescription pid process target process PID 3252 set thread context of 4144 3252 1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe 1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4432 4144 WerFault.exe 1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe -
Modifies registry class 4 IoCs
Processes:
1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key 1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" 1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key 1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" 1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exepid process 3252 1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exedescription pid process target process PID 3252 wrote to memory of 4144 3252 1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe 1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe PID 3252 wrote to memory of 4144 3252 1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe 1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe PID 3252 wrote to memory of 4144 3252 1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe 1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe PID 3252 wrote to memory of 4144 3252 1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe 1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe PID 3252 wrote to memory of 4144 3252 1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe 1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe PID 3252 wrote to memory of 4144 3252 1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe 1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe PID 3252 wrote to memory of 4144 3252 1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe 1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe PID 3252 wrote to memory of 4144 3252 1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe 1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe PID 3252 wrote to memory of 4144 3252 1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe 1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe PID 3252 wrote to memory of 4144 3252 1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe 1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe PID 3252 wrote to memory of 4144 3252 1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe 1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe PID 3252 wrote to memory of 4144 3252 1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe 1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe PID 3252 wrote to memory of 4144 3252 1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe 1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe PID 3252 wrote to memory of 4144 3252 1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe 1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe PID 3252 wrote to memory of 4144 3252 1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe 1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe PID 3252 wrote to memory of 4144 3252 1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe 1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1a711246b276ce21ea055b041b4a777e_JaffaCakes118.exe"2⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 5283⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4144 -ip 41441⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3252-4-0x0000000000400000-0x0000000000570000-memory.dmpFilesize
1.4MB
-
memory/4144-2-0x0000000000400000-0x00000000004C5000-memory.dmpFilesize
788KB
-
memory/4144-3-0x0000000000400000-0x00000000004C5000-memory.dmpFilesize
788KB
-
memory/4144-5-0x0000000000400000-0x00000000004C5000-memory.dmpFilesize
788KB
-
memory/4144-6-0x0000000000400000-0x00000000004C5000-memory.dmpFilesize
788KB
-
memory/4144-7-0x0000000000400000-0x00000000004C5000-memory.dmpFilesize
788KB