Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
27-06-2024 03:11
Behavioral task
behavioral1
Sample
14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe
-
Size
661KB
-
MD5
14778af23a015e14c365e2e3f99128b7
-
SHA1
963f99b8f67478c1d35344a191db4e8d05401ca9
-
SHA256
37ef6ca609a8b945cdcb5f40fe3f2c06fcfb7df107af8890332503b66392a2e6
-
SHA512
7457c570cad97d99483b5b6a109e64432d18dde875a843bdfae951c2efb33fd1d78a4f0dc2a6c3472a802e7f185fb83b0838a1b8f9c1487af5e2fae7d9928752
-
SSDEEP
12288:IXhpvNWw276S/DuoeFcfbmiJ99VPhYR5MTSHvLenELrWv1lZw4JuMkMh/fy452U2:unAw2WWeFcfbP9VPSPMTSPL/rWvzq4Jm
Malware Config
Extracted
darkcomet
Furkan
furkian.zapto.org:1604
DC_MUTEX-VDNJCF8
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
XDKisQrYB60J
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 15 IoCs
Processes:
msdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exe14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" 14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe,C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\msdcsc.exe" msdcsc.exe -
Modifies firewall policy service 3 TTPs 3 IoCs
Processes:
msdcsc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" msdcsc.exe -
Modifies security service 2 TTPs 1 IoCs
Processes:
msdcsc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" msdcsc.exe -
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
msdcsc.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" msdcsc.exe -
Sets file to hidden 1 TTPs 15 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exepid process 2288 attrib.exe 2532 attrib.exe 2276 attrib.exe 768 attrib.exe 2716 attrib.exe 2324 attrib.exe 1576 attrib.exe 356 attrib.exe 1108 attrib.exe 2276 attrib.exe 1920 attrib.exe 288 attrib.exe 1520 attrib.exe 2672 attrib.exe 1988 attrib.exe -
Deletes itself 1 IoCs
Processes:
notepad.exepid process 3052 notepad.exe -
Executes dropped EXE 14 IoCs
Processes:
msdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exepid process 2844 msdcsc.exe 2924 msdcsc.exe 2424 msdcsc.exe 2768 msdcsc.exe 1408 msdcsc.exe 1480 msdcsc.exe 1640 msdcsc.exe 276 msdcsc.exe 2432 msdcsc.exe 320 msdcsc.exe 1688 msdcsc.exe 2208 msdcsc.exe 2736 msdcsc.exe 1592 msdcsc.exe -
Loads dropped DLL 26 IoCs
Processes:
14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exepid process 1844 14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe 1844 14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe 2844 msdcsc.exe 2844 msdcsc.exe 2924 msdcsc.exe 2924 msdcsc.exe 2424 msdcsc.exe 2424 msdcsc.exe 2768 msdcsc.exe 2768 msdcsc.exe 1408 msdcsc.exe 1408 msdcsc.exe 1480 msdcsc.exe 1480 msdcsc.exe 1640 msdcsc.exe 1640 msdcsc.exe 276 msdcsc.exe 276 msdcsc.exe 2432 msdcsc.exe 2432 msdcsc.exe 320 msdcsc.exe 320 msdcsc.exe 2208 msdcsc.exe 2208 msdcsc.exe 2736 msdcsc.exe 2736 msdcsc.exe -
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Adds Run key to start application 2 TTPs 15 IoCs
Processes:
msdcsc.exemsdcsc.exemsdcsc.exe14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" 14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\XDKisQrYB60J\\XDKisQrYB60J\\msdcsc.exe" msdcsc.exe -
Drops file in System32 directory 64 IoCs
Processes:
msdcsc.exemsdcsc.exeattrib.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exemsdcsc.exe14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exemsdcsc.exemsdcsc.exeattrib.exemsdcsc.exemsdcsc.exeattrib.exeattrib.exeattrib.exeattrib.exemsdcsc.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exedescription ioc process File opened for modification C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\ msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\XDKisQrYB60J\ msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\XDKisQrYB60J\msdcsc.exe attrib.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\msdcsc.exe msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\XDKisQrYB60J\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\XDKisQrYB60J\ msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\XDKisQrYB60J\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\XDKisQrYB60J\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\XDKisQrYB60J\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\ msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\XDKisQrYB60J\msdcsc.exe msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\msdcsc.exe msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\msdcsc.exe 14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\XDKisQrYB60J\msdcsc.exe msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\msdcsc.exe msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\msdcsc.exe attrib.exe File created C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\XDKisQrYB60J\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\XDKisQrYB60J\ msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\XDKisQrYB60J\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\ msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\ 14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe File created C:\Windows\SysWOW64\MSDCSC\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\msdcsc.exe attrib.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\XDKisQrYB60J\msdcsc.exe attrib.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\XDKisQrYB60J\msdcsc.exe attrib.exe File created C:\Windows\SysWOW64\MSDCSC\msdcsc.exe 14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe File created C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\XDKisQrYB60J\msdcsc.exe msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\XDKisQrYB60J\msdcsc.exe attrib.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\XDKisQrYB60J\msdcsc.exe attrib.exe File created C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\XDKisQrYB60J\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\XDKisQrYB60J\msdcsc.exe attrib.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\ msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\msdcsc.exe attrib.exe File created C:\Windows\SysWOW64\MSDCSC\msdcsc.exe msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\XDKisQrYB60J\ msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\msdcsc.exe msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\msdcsc.exe attrib.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\XDKisQrYB60J\msdcsc.exe msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\XDKisQrYB60J\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\XDKisQrYB60J\ msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\msdcsc.exe attrib.exe File created C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\XDKisQrYB60J\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\XDKisQrYB60J\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\XDKisQrYB60J\ msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\XDKisQrYB60J\ msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\msdcsc.exe msdcsc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\ msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\XDKisQrYB60J\msdcsc.exe msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\msdcsc.exe msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\msdcsc.exe msdcsc.exe File created C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\XDKisQrYB60J\msdcsc.exe msdcsc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
msdcsc.exepid process 1592 msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exemsdcsc.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 1844 14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe Token: SeSecurityPrivilege 1844 14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 1844 14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe Token: SeLoadDriverPrivilege 1844 14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe Token: SeSystemProfilePrivilege 1844 14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe Token: SeSystemtimePrivilege 1844 14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 1844 14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1844 14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 1844 14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe Token: SeBackupPrivilege 1844 14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe Token: SeRestorePrivilege 1844 14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe Token: SeShutdownPrivilege 1844 14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe Token: SeDebugPrivilege 1844 14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 1844 14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 1844 14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 1844 14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe Token: SeUndockPrivilege 1844 14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe Token: SeManageVolumePrivilege 1844 14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe Token: SeImpersonatePrivilege 1844 14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 1844 14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe Token: 33 1844 14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe Token: 34 1844 14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe Token: 35 1844 14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 2844 msdcsc.exe Token: SeSecurityPrivilege 2844 msdcsc.exe Token: SeTakeOwnershipPrivilege 2844 msdcsc.exe Token: SeLoadDriverPrivilege 2844 msdcsc.exe Token: SeSystemProfilePrivilege 2844 msdcsc.exe Token: SeSystemtimePrivilege 2844 msdcsc.exe Token: SeProfSingleProcessPrivilege 2844 msdcsc.exe Token: SeIncBasePriorityPrivilege 2844 msdcsc.exe Token: SeCreatePagefilePrivilege 2844 msdcsc.exe Token: SeBackupPrivilege 2844 msdcsc.exe Token: SeRestorePrivilege 2844 msdcsc.exe Token: SeShutdownPrivilege 2844 msdcsc.exe Token: SeDebugPrivilege 2844 msdcsc.exe Token: SeSystemEnvironmentPrivilege 2844 msdcsc.exe Token: SeChangeNotifyPrivilege 2844 msdcsc.exe Token: SeRemoteShutdownPrivilege 2844 msdcsc.exe Token: SeUndockPrivilege 2844 msdcsc.exe Token: SeManageVolumePrivilege 2844 msdcsc.exe Token: SeImpersonatePrivilege 2844 msdcsc.exe Token: SeCreateGlobalPrivilege 2844 msdcsc.exe Token: 33 2844 msdcsc.exe Token: 34 2844 msdcsc.exe Token: 35 2844 msdcsc.exe Token: SeIncreaseQuotaPrivilege 2924 msdcsc.exe Token: SeSecurityPrivilege 2924 msdcsc.exe Token: SeTakeOwnershipPrivilege 2924 msdcsc.exe Token: SeLoadDriverPrivilege 2924 msdcsc.exe Token: SeSystemProfilePrivilege 2924 msdcsc.exe Token: SeSystemtimePrivilege 2924 msdcsc.exe Token: SeProfSingleProcessPrivilege 2924 msdcsc.exe Token: SeIncBasePriorityPrivilege 2924 msdcsc.exe Token: SeCreatePagefilePrivilege 2924 msdcsc.exe Token: SeBackupPrivilege 2924 msdcsc.exe Token: SeRestorePrivilege 2924 msdcsc.exe Token: SeShutdownPrivilege 2924 msdcsc.exe Token: SeDebugPrivilege 2924 msdcsc.exe Token: SeSystemEnvironmentPrivilege 2924 msdcsc.exe Token: SeChangeNotifyPrivilege 2924 msdcsc.exe Token: SeRemoteShutdownPrivilege 2924 msdcsc.exe Token: SeUndockPrivilege 2924 msdcsc.exe Token: SeManageVolumePrivilege 2924 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
msdcsc.exepid process 1592 msdcsc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exemsdcsc.exemsdcsc.exedescription pid process target process PID 1844 wrote to memory of 2268 1844 14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe cmd.exe PID 1844 wrote to memory of 2268 1844 14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe cmd.exe PID 1844 wrote to memory of 2268 1844 14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe cmd.exe PID 1844 wrote to memory of 2268 1844 14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe cmd.exe PID 1844 wrote to memory of 3052 1844 14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe notepad.exe PID 1844 wrote to memory of 3052 1844 14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe notepad.exe PID 1844 wrote to memory of 3052 1844 14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe notepad.exe PID 1844 wrote to memory of 3052 1844 14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe notepad.exe PID 1844 wrote to memory of 3052 1844 14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe notepad.exe PID 1844 wrote to memory of 3052 1844 14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe notepad.exe PID 1844 wrote to memory of 3052 1844 14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe notepad.exe PID 1844 wrote to memory of 3052 1844 14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe notepad.exe PID 1844 wrote to memory of 3052 1844 14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe notepad.exe PID 1844 wrote to memory of 3052 1844 14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe notepad.exe PID 1844 wrote to memory of 3052 1844 14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe notepad.exe PID 1844 wrote to memory of 3052 1844 14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe notepad.exe PID 1844 wrote to memory of 3052 1844 14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe notepad.exe PID 1844 wrote to memory of 3052 1844 14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe notepad.exe PID 1844 wrote to memory of 3052 1844 14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe notepad.exe PID 1844 wrote to memory of 3052 1844 14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe notepad.exe PID 1844 wrote to memory of 3052 1844 14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe notepad.exe PID 1844 wrote to memory of 3052 1844 14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe notepad.exe PID 1844 wrote to memory of 2844 1844 14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe msdcsc.exe PID 1844 wrote to memory of 2844 1844 14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe msdcsc.exe PID 1844 wrote to memory of 2844 1844 14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe msdcsc.exe PID 1844 wrote to memory of 2844 1844 14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe msdcsc.exe PID 2844 wrote to memory of 2484 2844 msdcsc.exe cmd.exe PID 2844 wrote to memory of 2484 2844 msdcsc.exe cmd.exe PID 2844 wrote to memory of 2484 2844 msdcsc.exe cmd.exe PID 2844 wrote to memory of 2484 2844 msdcsc.exe cmd.exe PID 2844 wrote to memory of 2812 2844 msdcsc.exe notepad.exe PID 2844 wrote to memory of 2812 2844 msdcsc.exe notepad.exe PID 2844 wrote to memory of 2812 2844 msdcsc.exe notepad.exe PID 2844 wrote to memory of 2812 2844 msdcsc.exe notepad.exe PID 2844 wrote to memory of 2812 2844 msdcsc.exe notepad.exe PID 2844 wrote to memory of 2812 2844 msdcsc.exe notepad.exe PID 2844 wrote to memory of 2812 2844 msdcsc.exe notepad.exe PID 2844 wrote to memory of 2812 2844 msdcsc.exe notepad.exe PID 2844 wrote to memory of 2812 2844 msdcsc.exe notepad.exe PID 2844 wrote to memory of 2812 2844 msdcsc.exe notepad.exe PID 2844 wrote to memory of 2812 2844 msdcsc.exe notepad.exe PID 2844 wrote to memory of 2812 2844 msdcsc.exe notepad.exe PID 2844 wrote to memory of 2812 2844 msdcsc.exe notepad.exe PID 2844 wrote to memory of 2812 2844 msdcsc.exe notepad.exe PID 2844 wrote to memory of 2812 2844 msdcsc.exe notepad.exe PID 2844 wrote to memory of 2812 2844 msdcsc.exe notepad.exe PID 2844 wrote to memory of 2812 2844 msdcsc.exe notepad.exe PID 2844 wrote to memory of 2812 2844 msdcsc.exe notepad.exe PID 2844 wrote to memory of 2924 2844 msdcsc.exe msdcsc.exe PID 2844 wrote to memory of 2924 2844 msdcsc.exe msdcsc.exe PID 2844 wrote to memory of 2924 2844 msdcsc.exe msdcsc.exe PID 2844 wrote to memory of 2924 2844 msdcsc.exe msdcsc.exe PID 2924 wrote to memory of 1252 2924 msdcsc.exe cmd.exe PID 2924 wrote to memory of 1252 2924 msdcsc.exe cmd.exe PID 2924 wrote to memory of 1252 2924 msdcsc.exe cmd.exe PID 2924 wrote to memory of 1252 2924 msdcsc.exe cmd.exe PID 2924 wrote to memory of 1248 2924 msdcsc.exe notepad.exe PID 2924 wrote to memory of 1248 2924 msdcsc.exe notepad.exe PID 2924 wrote to memory of 1248 2924 msdcsc.exe notepad.exe PID 2924 wrote to memory of 1248 2924 msdcsc.exe notepad.exe PID 2924 wrote to memory of 1248 2924 msdcsc.exe notepad.exe PID 2924 wrote to memory of 1248 2924 msdcsc.exe notepad.exe PID 2924 wrote to memory of 1248 2924 msdcsc.exe notepad.exe PID 2924 wrote to memory of 1248 2924 msdcsc.exe notepad.exe -
Views/modifies file attributes 1 TTPs 15 IoCs
Processes:
attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exepid process 1520 attrib.exe 2324 attrib.exe 1920 attrib.exe 1988 attrib.exe 2716 attrib.exe 356 attrib.exe 1108 attrib.exe 2288 attrib.exe 768 attrib.exe 1576 attrib.exe 2276 attrib.exe 2672 attrib.exe 2276 attrib.exe 288 attrib.exe 2532 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe" +s +h2⤵PID:2268
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\14778af23a015e14c365e2e3f99128b7_JaffaCakes118.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:288 -
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Deletes itself
PID:3052 -
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h3⤵PID:2484
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h4⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:1520 -
C:\Windows\SysWOW64\notepad.exenotepad3⤵PID:2812
-
C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\msdcsc.exe"C:\Windows\system32\MSDCSC\XDKisQrYB60J\msdcsc.exe"3⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\msdcsc.exe" +s +h4⤵PID:1252
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\msdcsc.exe" +s +h5⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:356 -
C:\Windows\SysWOW64\notepad.exenotepad4⤵PID:1248
-
C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\XDKisQrYB60J\msdcsc.exe"C:\Windows\system32\MSDCSC\XDKisQrYB60J\XDKisQrYB60J\msdcsc.exe"4⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:2424 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\XDKisQrYB60J\msdcsc.exe" +s +h5⤵PID:2188
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\XDKisQrYB60J\msdcsc.exe" +s +h6⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:2276 -
C:\Windows\SysWOW64\notepad.exenotepad5⤵PID:236
-
C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\XDKisQrYB60J\msdcsc.exe"C:\Windows\system32\MSDCSC\XDKisQrYB60J\XDKisQrYB60J\msdcsc.exe"5⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:2768 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\XDKisQrYB60J\msdcsc.exe" +s +h6⤵PID:1128
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\XDKisQrYB60J\msdcsc.exe" +s +h7⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:1108 -
C:\Windows\SysWOW64\notepad.exenotepad6⤵PID:2632
-
C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\XDKisQrYB60J\msdcsc.exe"C:\Windows\system32\MSDCSC\XDKisQrYB60J\XDKisQrYB60J\msdcsc.exe"6⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:1408 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\XDKisQrYB60J\msdcsc.exe" +s +h7⤵PID:376
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\XDKisQrYB60J\msdcsc.exe" +s +h8⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:2288 -
C:\Windows\SysWOW64\notepad.exenotepad7⤵PID:832
-
C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\XDKisQrYB60J\msdcsc.exe"C:\Windows\system32\MSDCSC\XDKisQrYB60J\XDKisQrYB60J\msdcsc.exe"7⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:1480 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\XDKisQrYB60J\msdcsc.exe" +s +h8⤵PID:1112
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\XDKisQrYB60J\msdcsc.exe" +s +h9⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2672 -
C:\Windows\SysWOW64\notepad.exenotepad8⤵PID:3008
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"8⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:1640 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h9⤵PID:2700
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h10⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:2532 -
C:\Windows\SysWOW64\notepad.exenotepad9⤵PID:2704
-
C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\msdcsc.exe"C:\Windows\system32\MSDCSC\XDKisQrYB60J\msdcsc.exe"9⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:276 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\msdcsc.exe" +s +h10⤵PID:304
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\msdcsc.exe" +s +h11⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:2276 -
C:\Windows\SysWOW64\notepad.exenotepad10⤵PID:2444
-
C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\XDKisQrYB60J\msdcsc.exe"C:\Windows\system32\MSDCSC\XDKisQrYB60J\XDKisQrYB60J\msdcsc.exe"10⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:2432 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\XDKisQrYB60J\msdcsc.exe" +s +h11⤵PID:1368
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\XDKisQrYB60J\msdcsc.exe" +s +h12⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:768 -
C:\Windows\SysWOW64\notepad.exenotepad11⤵PID:1464
-
C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\XDKisQrYB60J\msdcsc.exe"C:\Windows\system32\MSDCSC\XDKisQrYB60J\XDKisQrYB60J\msdcsc.exe"11⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:320 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\XDKisQrYB60J\msdcsc.exe" +s +h12⤵PID:584
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\XDKisQrYB60J\msdcsc.exe" +s +h13⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:1988 -
C:\Windows\SysWOW64\notepad.exenotepad12⤵PID:1312
-
C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\msdcsc.exe"C:\Windows\system32\MSDCSC\XDKisQrYB60J\msdcsc.exe"12⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
PID:1688 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\msdcsc.exe" +s +h13⤵PID:2436
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\msdcsc.exe" +s +h14⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2716 -
C:\Windows\SysWOW64\notepad.exenotepad13⤵PID:2916
-
C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\XDKisQrYB60J\msdcsc.exe"C:\Windows\system32\MSDCSC\XDKisQrYB60J\XDKisQrYB60J\msdcsc.exe"13⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:2208 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\XDKisQrYB60J\msdcsc.exe" +s +h14⤵PID:1436
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\XDKisQrYB60J\msdcsc.exe" +s +h15⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:2324 -
C:\Windows\SysWOW64\notepad.exenotepad14⤵PID:1984
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"14⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
PID:2736 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h15⤵PID:2472
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\msdcsc.exe" +s +h16⤵
- Sets file to hidden
- Drops file in System32 directory
- Views/modifies file attributes
PID:1576 -
C:\Windows\SysWOW64\notepad.exenotepad15⤵PID:1716
-
C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\msdcsc.exe"C:\Windows\system32\MSDCSC\XDKisQrYB60J\msdcsc.exe"15⤵
- Modifies WinLogon for persistence
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1592 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\msdcsc.exe" +s +h16⤵PID:352
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\SysWOW64\MSDCSC\XDKisQrYB60J\msdcsc.exe" +s +h17⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1920 -
C:\Windows\SysWOW64\notepad.exenotepad16⤵PID:2912
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
661KB
MD514778af23a015e14c365e2e3f99128b7
SHA1963f99b8f67478c1d35344a191db4e8d05401ca9
SHA25637ef6ca609a8b945cdcb5f40fe3f2c06fcfb7df107af8890332503b66392a2e6
SHA5127457c570cad97d99483b5b6a109e64432d18dde875a843bdfae951c2efb33fd1d78a4f0dc2a6c3472a802e7f185fb83b0838a1b8f9c1487af5e2fae7d9928752