Analysis
-
max time kernel
149s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
09-05-2024 02:54
Behavioral task
behavioral1
Sample
27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exe
Resource
win7-20240419-en
General
-
Target
27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exe
-
Size
252KB
-
MD5
27f2bffd80e144f0b738ff6659c3b8c3
-
SHA1
388aff586e3ec2c5c862596ec16abdfdbdfcb98f
-
SHA256
4c9e11389a51bbb1538c3c57a469be9256812e9be5ced4f06ba6c100668ddde1
-
SHA512
a57f5163ef3d35d000b0f9d5caf84a65ebce2d3cdfe61468fb13d976541caab106c9fab32392c4826e5bedd87ae29c9a0eb53e4281bec0f0d0e856b6660be1c2
-
SSDEEP
6144:DcNYk1yuwEDBum3qYWnl0pd0EX3Zq2b6wfIDYm0PHQU:DcWkbgTYWnYnt/IDYhPJ
Malware Config
Extracted
darkcomet
Guest16
127.0.0.1:1604
DC_MUTEX-15PZK2D
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
WXuth936C97A
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe" 27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
msdcsc.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" msdcsc.exe -
Disables Task Manager via registry modification
-
Deletes itself 1 IoCs
Processes:
notepad.exepid process 2136 notepad.exe -
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 2676 msdcsc.exe -
Loads dropped DLL 2 IoCs
Processes:
27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exepid process 2284 27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exe 2284 27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exe -
Processes:
resource yara_rule behavioral1/memory/2284-0-0x0000000000400000-0x00000000004B7000-memory.dmp upx \Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe upx behavioral1/memory/2284-30-0x0000000004070000-0x0000000004127000-memory.dmp upx behavioral1/memory/2284-37-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2676-39-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2676-40-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2676-41-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2676-43-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2676-44-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2676-47-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2676-50-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2676-51-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2676-52-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exemsdcsc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe" 27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe" msdcsc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 2284 27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exe Token: SeSecurityPrivilege 2284 27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2284 27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exe Token: SeLoadDriverPrivilege 2284 27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exe Token: SeSystemProfilePrivilege 2284 27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exe Token: SeSystemtimePrivilege 2284 27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 2284 27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2284 27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 2284 27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exe Token: SeBackupPrivilege 2284 27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exe Token: SeRestorePrivilege 2284 27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exe Token: SeShutdownPrivilege 2284 27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exe Token: SeDebugPrivilege 2284 27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 2284 27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 2284 27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 2284 27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exe Token: SeUndockPrivilege 2284 27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exe Token: SeManageVolumePrivilege 2284 27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exe Token: SeImpersonatePrivilege 2284 27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 2284 27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exe Token: 33 2284 27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exe Token: 34 2284 27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exe Token: 35 2284 27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 2676 msdcsc.exe Token: SeSecurityPrivilege 2676 msdcsc.exe Token: SeTakeOwnershipPrivilege 2676 msdcsc.exe Token: SeLoadDriverPrivilege 2676 msdcsc.exe Token: SeSystemProfilePrivilege 2676 msdcsc.exe Token: SeSystemtimePrivilege 2676 msdcsc.exe Token: SeProfSingleProcessPrivilege 2676 msdcsc.exe Token: SeIncBasePriorityPrivilege 2676 msdcsc.exe Token: SeCreatePagefilePrivilege 2676 msdcsc.exe Token: SeBackupPrivilege 2676 msdcsc.exe Token: SeRestorePrivilege 2676 msdcsc.exe Token: SeShutdownPrivilege 2676 msdcsc.exe Token: SeDebugPrivilege 2676 msdcsc.exe Token: SeSystemEnvironmentPrivilege 2676 msdcsc.exe Token: SeChangeNotifyPrivilege 2676 msdcsc.exe Token: SeRemoteShutdownPrivilege 2676 msdcsc.exe Token: SeUndockPrivilege 2676 msdcsc.exe Token: SeManageVolumePrivilege 2676 msdcsc.exe Token: SeImpersonatePrivilege 2676 msdcsc.exe Token: SeCreateGlobalPrivilege 2676 msdcsc.exe Token: 33 2676 msdcsc.exe Token: 34 2676 msdcsc.exe Token: 35 2676 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
msdcsc.exepid process 2676 msdcsc.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exedescription pid process target process PID 2284 wrote to memory of 2136 2284 27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exe notepad.exe PID 2284 wrote to memory of 2136 2284 27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exe notepad.exe PID 2284 wrote to memory of 2136 2284 27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exe notepad.exe PID 2284 wrote to memory of 2136 2284 27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exe notepad.exe PID 2284 wrote to memory of 2136 2284 27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exe notepad.exe PID 2284 wrote to memory of 2136 2284 27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exe notepad.exe PID 2284 wrote to memory of 2136 2284 27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exe notepad.exe PID 2284 wrote to memory of 2136 2284 27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exe notepad.exe PID 2284 wrote to memory of 2136 2284 27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exe notepad.exe PID 2284 wrote to memory of 2136 2284 27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exe notepad.exe PID 2284 wrote to memory of 2136 2284 27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exe notepad.exe PID 2284 wrote to memory of 2136 2284 27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exe notepad.exe PID 2284 wrote to memory of 2136 2284 27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exe notepad.exe PID 2284 wrote to memory of 2136 2284 27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exe notepad.exe PID 2284 wrote to memory of 2136 2284 27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exe notepad.exe PID 2284 wrote to memory of 2136 2284 27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exe notepad.exe PID 2284 wrote to memory of 2136 2284 27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exe notepad.exe PID 2284 wrote to memory of 2136 2284 27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exe notepad.exe PID 2284 wrote to memory of 2676 2284 27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exe msdcsc.exe PID 2284 wrote to memory of 2676 2284 27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exe msdcsc.exe PID 2284 wrote to memory of 2676 2284 27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exe msdcsc.exe PID 2284 wrote to memory of 2676 2284 27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exe msdcsc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\27f2bffd80e144f0b738ff6659c3b8c3_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Deletes itself
-
C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exeFilesize
252KB
MD527f2bffd80e144f0b738ff6659c3b8c3
SHA1388aff586e3ec2c5c862596ec16abdfdbdfcb98f
SHA2564c9e11389a51bbb1538c3c57a469be9256812e9be5ced4f06ba6c100668ddde1
SHA512a57f5163ef3d35d000b0f9d5caf84a65ebce2d3cdfe61468fb13d976541caab106c9fab32392c4826e5bedd87ae29c9a0eb53e4281bec0f0d0e856b6660be1c2
-
memory/2136-5-0x00000000000C0000-0x00000000000C1000-memory.dmpFilesize
4KB
-
memory/2136-25-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/2284-0-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/2284-1-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/2284-30-0x0000000004070000-0x0000000004127000-memory.dmpFilesize
732KB
-
memory/2284-34-0x0000000004070000-0x0000000004127000-memory.dmpFilesize
732KB
-
memory/2284-37-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/2676-39-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/2676-40-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/2676-41-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/2676-43-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/2676-44-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/2676-47-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/2676-50-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/2676-51-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/2676-52-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB