Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
11/05/2024, 05:52
Behavioral task
behavioral1
Sample
330ccba4a7ebf89c3f94b8c5ca9aa60f_JaffaCakes118.exe
Resource
win7-20240220-en
General
-
Target
330ccba4a7ebf89c3f94b8c5ca9aa60f_JaffaCakes118.exe
-
Size
252KB
-
MD5
330ccba4a7ebf89c3f94b8c5ca9aa60f
-
SHA1
00997a2cd5afcfad10383d64de7b080537cfc463
-
SHA256
831e0c164298c0335e968e6aa43f0f6d2f145d54ff0ece88a5c8ff697b9ba082
-
SHA512
a47dad8c0433aa631238b8c9eaa5e2eef5442cb377fc08333a3b66443d2163d13ee9a40f45b2ecc47be33b681578aa93d96d220a6b21263aec3ab64b14a07357
-
SSDEEP
6144:PcNYk1yuwEDBum3qYWnl0pd0EX3Zq2b6wfIDYm0PHQEJdb:PcWkbgTYWnYnt/IDYhPRd
Malware Config
Extracted
darkcomet
Guest16
127.0.0.1:8888
DC_MUTEX-3X4JR93
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
oFinH4tKuPGN
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 330ccba4a7ebf89c3f94b8c5ca9aa60f_JaffaCakes118.exe -
Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" msdcsc.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" msdcsc.exe -
Disables Task Manager via registry modification
-
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 4444 attrib.exe 2300 attrib.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation 330ccba4a7ebf89c3f94b8c5ca9aa60f_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 452 msdcsc.exe -
resource yara_rule behavioral2/memory/2028-0-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/files/0x0007000000023407-6.dat upx behavioral2/memory/452-62-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/2028-66-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/452-67-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/452-68-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/452-69-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/452-70-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/452-73-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/452-74-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/452-75-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/452-76-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/452-77-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/452-79-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/452-81-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 330ccba4a7ebf89c3f94b8c5ca9aa60f_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 330ccba4a7ebf89c3f94b8c5ca9aa60f_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 452 msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2028 330ccba4a7ebf89c3f94b8c5ca9aa60f_JaffaCakes118.exe Token: SeSecurityPrivilege 2028 330ccba4a7ebf89c3f94b8c5ca9aa60f_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2028 330ccba4a7ebf89c3f94b8c5ca9aa60f_JaffaCakes118.exe Token: SeLoadDriverPrivilege 2028 330ccba4a7ebf89c3f94b8c5ca9aa60f_JaffaCakes118.exe Token: SeSystemProfilePrivilege 2028 330ccba4a7ebf89c3f94b8c5ca9aa60f_JaffaCakes118.exe Token: SeSystemtimePrivilege 2028 330ccba4a7ebf89c3f94b8c5ca9aa60f_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 2028 330ccba4a7ebf89c3f94b8c5ca9aa60f_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2028 330ccba4a7ebf89c3f94b8c5ca9aa60f_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 2028 330ccba4a7ebf89c3f94b8c5ca9aa60f_JaffaCakes118.exe Token: SeBackupPrivilege 2028 330ccba4a7ebf89c3f94b8c5ca9aa60f_JaffaCakes118.exe Token: SeRestorePrivilege 2028 330ccba4a7ebf89c3f94b8c5ca9aa60f_JaffaCakes118.exe Token: SeShutdownPrivilege 2028 330ccba4a7ebf89c3f94b8c5ca9aa60f_JaffaCakes118.exe Token: SeDebugPrivilege 2028 330ccba4a7ebf89c3f94b8c5ca9aa60f_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 2028 330ccba4a7ebf89c3f94b8c5ca9aa60f_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 2028 330ccba4a7ebf89c3f94b8c5ca9aa60f_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 2028 330ccba4a7ebf89c3f94b8c5ca9aa60f_JaffaCakes118.exe Token: SeUndockPrivilege 2028 330ccba4a7ebf89c3f94b8c5ca9aa60f_JaffaCakes118.exe Token: SeManageVolumePrivilege 2028 330ccba4a7ebf89c3f94b8c5ca9aa60f_JaffaCakes118.exe Token: SeImpersonatePrivilege 2028 330ccba4a7ebf89c3f94b8c5ca9aa60f_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 2028 330ccba4a7ebf89c3f94b8c5ca9aa60f_JaffaCakes118.exe Token: 33 2028 330ccba4a7ebf89c3f94b8c5ca9aa60f_JaffaCakes118.exe Token: 34 2028 330ccba4a7ebf89c3f94b8c5ca9aa60f_JaffaCakes118.exe Token: 35 2028 330ccba4a7ebf89c3f94b8c5ca9aa60f_JaffaCakes118.exe Token: 36 2028 330ccba4a7ebf89c3f94b8c5ca9aa60f_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 452 msdcsc.exe Token: SeSecurityPrivilege 452 msdcsc.exe Token: SeTakeOwnershipPrivilege 452 msdcsc.exe Token: SeLoadDriverPrivilege 452 msdcsc.exe Token: SeSystemProfilePrivilege 452 msdcsc.exe Token: SeSystemtimePrivilege 452 msdcsc.exe Token: SeProfSingleProcessPrivilege 452 msdcsc.exe Token: SeIncBasePriorityPrivilege 452 msdcsc.exe Token: SeCreatePagefilePrivilege 452 msdcsc.exe Token: SeBackupPrivilege 452 msdcsc.exe Token: SeRestorePrivilege 452 msdcsc.exe Token: SeShutdownPrivilege 452 msdcsc.exe Token: SeDebugPrivilege 452 msdcsc.exe Token: SeSystemEnvironmentPrivilege 452 msdcsc.exe Token: SeChangeNotifyPrivilege 452 msdcsc.exe Token: SeRemoteShutdownPrivilege 452 msdcsc.exe Token: SeUndockPrivilege 452 msdcsc.exe Token: SeManageVolumePrivilege 452 msdcsc.exe Token: SeImpersonatePrivilege 452 msdcsc.exe Token: SeCreateGlobalPrivilege 452 msdcsc.exe Token: 33 452 msdcsc.exe Token: 34 452 msdcsc.exe Token: 35 452 msdcsc.exe Token: 36 452 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 452 msdcsc.exe -
Suspicious use of WriteProcessMemory 37 IoCs
description pid Process procid_target PID 2028 wrote to memory of 2400 2028 330ccba4a7ebf89c3f94b8c5ca9aa60f_JaffaCakes118.exe 82 PID 2028 wrote to memory of 2400 2028 330ccba4a7ebf89c3f94b8c5ca9aa60f_JaffaCakes118.exe 82 PID 2028 wrote to memory of 2400 2028 330ccba4a7ebf89c3f94b8c5ca9aa60f_JaffaCakes118.exe 82 PID 2028 wrote to memory of 3252 2028 330ccba4a7ebf89c3f94b8c5ca9aa60f_JaffaCakes118.exe 84 PID 2028 wrote to memory of 3252 2028 330ccba4a7ebf89c3f94b8c5ca9aa60f_JaffaCakes118.exe 84 PID 2028 wrote to memory of 3252 2028 330ccba4a7ebf89c3f94b8c5ca9aa60f_JaffaCakes118.exe 84 PID 2400 wrote to memory of 4444 2400 cmd.exe 86 PID 2400 wrote to memory of 4444 2400 cmd.exe 86 PID 2400 wrote to memory of 4444 2400 cmd.exe 86 PID 3252 wrote to memory of 2300 3252 cmd.exe 87 PID 3252 wrote to memory of 2300 3252 cmd.exe 87 PID 3252 wrote to memory of 2300 3252 cmd.exe 87 PID 2028 wrote to memory of 452 2028 330ccba4a7ebf89c3f94b8c5ca9aa60f_JaffaCakes118.exe 88 PID 2028 wrote to memory of 452 2028 330ccba4a7ebf89c3f94b8c5ca9aa60f_JaffaCakes118.exe 88 PID 2028 wrote to memory of 452 2028 330ccba4a7ebf89c3f94b8c5ca9aa60f_JaffaCakes118.exe 88 PID 452 wrote to memory of 4024 452 msdcsc.exe 89 PID 452 wrote to memory of 4024 452 msdcsc.exe 89 PID 452 wrote to memory of 4024 452 msdcsc.exe 89 PID 452 wrote to memory of 4024 452 msdcsc.exe 89 PID 452 wrote to memory of 4024 452 msdcsc.exe 89 PID 452 wrote to memory of 4024 452 msdcsc.exe 89 PID 452 wrote to memory of 4024 452 msdcsc.exe 89 PID 452 wrote to memory of 4024 452 msdcsc.exe 89 PID 452 wrote to memory of 4024 452 msdcsc.exe 89 PID 452 wrote to memory of 4024 452 msdcsc.exe 89 PID 452 wrote to memory of 4024 452 msdcsc.exe 89 PID 452 wrote to memory of 4024 452 msdcsc.exe 89 PID 452 wrote to memory of 4024 452 msdcsc.exe 89 PID 452 wrote to memory of 4024 452 msdcsc.exe 89 PID 452 wrote to memory of 4024 452 msdcsc.exe 89 PID 452 wrote to memory of 4024 452 msdcsc.exe 89 PID 452 wrote to memory of 4024 452 msdcsc.exe 89 PID 452 wrote to memory of 4024 452 msdcsc.exe 89 PID 452 wrote to memory of 4024 452 msdcsc.exe 89 PID 452 wrote to memory of 4024 452 msdcsc.exe 89 PID 452 wrote to memory of 4024 452 msdcsc.exe 89 PID 452 wrote to memory of 4024 452 msdcsc.exe 89 -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 4444 attrib.exe 2300 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\330ccba4a7ebf89c3f94b8c5ca9aa60f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\330ccba4a7ebf89c3f94b8c5ca9aa60f_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\330ccba4a7ebf89c3f94b8c5ca9aa60f_JaffaCakes118.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\330ccba4a7ebf89c3f94b8c5ca9aa60f_JaffaCakes118.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:4444
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2300
-
-
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Modifies firewall policy service
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Windows\SysWOW64\notepad.exenotepad3⤵PID:4024
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
252KB
MD5330ccba4a7ebf89c3f94b8c5ca9aa60f
SHA100997a2cd5afcfad10383d64de7b080537cfc463
SHA256831e0c164298c0335e968e6aa43f0f6d2f145d54ff0ece88a5c8ff697b9ba082
SHA512a47dad8c0433aa631238b8c9eaa5e2eef5442cb377fc08333a3b66443d2163d13ee9a40f45b2ecc47be33b681578aa93d96d220a6b21263aec3ab64b14a07357