Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
22/07/2024, 14:36
Static task
static1
Behavioral task
behavioral1
Sample
6390b876f7a9236842427d1aa64c47cb_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
6390b876f7a9236842427d1aa64c47cb_JaffaCakes118.exe
-
Size
763KB
-
MD5
6390b876f7a9236842427d1aa64c47cb
-
SHA1
d5a728fb6f1e8339a61076d499d47d932df3fcf5
-
SHA256
23ec9eebb57bc2df3edcc310629f9320fdd2d5f52026f07fe7a280abe77b57f2
-
SHA512
bb7cfee5576c193c5147b7faae1e390db22a28b942ae4111f10994984bbd8713ce23e29ec93438aa9cd4f3bfe6504192892da5d84570ac203282b0fb7b6e6e8e
-
SSDEEP
12288:ugmEDIvbiPjXLrhW1cKG8fz0hY2lglVCCeOWROCehzXLWgMC9R1Xv9WJhN41gpuv:ugmuITiPj/LKBb0C2ulVClRhozXLW1GT
Malware Config
Extracted
darkcomet
Matt
yuk.no-ip.biz:100
DC_MUTEX-BZJHQWP
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
ACd9Gmmlygjr
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" cvtres.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 1032 attrib.exe 2344 attrib.exe -
Executes dropped EXE 1 IoCs
pid Process 1120 msdcsc.exe -
Loads dropped DLL 1 IoCs
pid Process 2736 cvtres.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\windowshostmanagerupdate.exe = "C:\\Users\\Admin\\AppData\\Roaming\\windowshostmanagerupdate.exe" 6390b876f7a9236842427d1aa64c47cb_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" cvtres.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2680 set thread context of 2736 2680 6390b876f7a9236842427d1aa64c47cb_JaffaCakes118.exe 32 -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727 attrib.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe attrib.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2736 cvtres.exe Token: SeSecurityPrivilege 2736 cvtres.exe Token: SeTakeOwnershipPrivilege 2736 cvtres.exe Token: SeLoadDriverPrivilege 2736 cvtres.exe Token: SeSystemProfilePrivilege 2736 cvtres.exe Token: SeSystemtimePrivilege 2736 cvtres.exe Token: SeProfSingleProcessPrivilege 2736 cvtres.exe Token: SeIncBasePriorityPrivilege 2736 cvtres.exe Token: SeCreatePagefilePrivilege 2736 cvtres.exe Token: SeBackupPrivilege 2736 cvtres.exe Token: SeRestorePrivilege 2736 cvtres.exe Token: SeShutdownPrivilege 2736 cvtres.exe Token: SeDebugPrivilege 2736 cvtres.exe Token: SeSystemEnvironmentPrivilege 2736 cvtres.exe Token: SeChangeNotifyPrivilege 2736 cvtres.exe Token: SeRemoteShutdownPrivilege 2736 cvtres.exe Token: SeUndockPrivilege 2736 cvtres.exe Token: SeManageVolumePrivilege 2736 cvtres.exe Token: SeImpersonatePrivilege 2736 cvtres.exe Token: SeCreateGlobalPrivilege 2736 cvtres.exe Token: 33 2736 cvtres.exe Token: 34 2736 cvtres.exe Token: 35 2736 cvtres.exe -
Suspicious use of WriteProcessMemory 37 IoCs
description pid Process procid_target PID 2680 wrote to memory of 2800 2680 6390b876f7a9236842427d1aa64c47cb_JaffaCakes118.exe 30 PID 2680 wrote to memory of 2800 2680 6390b876f7a9236842427d1aa64c47cb_JaffaCakes118.exe 30 PID 2680 wrote to memory of 2800 2680 6390b876f7a9236842427d1aa64c47cb_JaffaCakes118.exe 30 PID 2680 wrote to memory of 2800 2680 6390b876f7a9236842427d1aa64c47cb_JaffaCakes118.exe 30 PID 2680 wrote to memory of 2736 2680 6390b876f7a9236842427d1aa64c47cb_JaffaCakes118.exe 32 PID 2680 wrote to memory of 2736 2680 6390b876f7a9236842427d1aa64c47cb_JaffaCakes118.exe 32 PID 2680 wrote to memory of 2736 2680 6390b876f7a9236842427d1aa64c47cb_JaffaCakes118.exe 32 PID 2680 wrote to memory of 2736 2680 6390b876f7a9236842427d1aa64c47cb_JaffaCakes118.exe 32 PID 2680 wrote to memory of 2736 2680 6390b876f7a9236842427d1aa64c47cb_JaffaCakes118.exe 32 PID 2680 wrote to memory of 2736 2680 6390b876f7a9236842427d1aa64c47cb_JaffaCakes118.exe 32 PID 2680 wrote to memory of 2736 2680 6390b876f7a9236842427d1aa64c47cb_JaffaCakes118.exe 32 PID 2680 wrote to memory of 2736 2680 6390b876f7a9236842427d1aa64c47cb_JaffaCakes118.exe 32 PID 2680 wrote to memory of 2736 2680 6390b876f7a9236842427d1aa64c47cb_JaffaCakes118.exe 32 PID 2680 wrote to memory of 2736 2680 6390b876f7a9236842427d1aa64c47cb_JaffaCakes118.exe 32 PID 2680 wrote to memory of 2736 2680 6390b876f7a9236842427d1aa64c47cb_JaffaCakes118.exe 32 PID 2680 wrote to memory of 2736 2680 6390b876f7a9236842427d1aa64c47cb_JaffaCakes118.exe 32 PID 2680 wrote to memory of 2736 2680 6390b876f7a9236842427d1aa64c47cb_JaffaCakes118.exe 32 PID 2736 wrote to memory of 2580 2736 cvtres.exe 33 PID 2736 wrote to memory of 2580 2736 cvtres.exe 33 PID 2736 wrote to memory of 2580 2736 cvtres.exe 33 PID 2736 wrote to memory of 2580 2736 cvtres.exe 33 PID 2736 wrote to memory of 2600 2736 cvtres.exe 34 PID 2736 wrote to memory of 2600 2736 cvtres.exe 34 PID 2736 wrote to memory of 2600 2736 cvtres.exe 34 PID 2736 wrote to memory of 2600 2736 cvtres.exe 34 PID 2736 wrote to memory of 1120 2736 cvtres.exe 37 PID 2736 wrote to memory of 1120 2736 cvtres.exe 37 PID 2736 wrote to memory of 1120 2736 cvtres.exe 37 PID 2736 wrote to memory of 1120 2736 cvtres.exe 37 PID 2600 wrote to memory of 1032 2600 cmd.exe 39 PID 2600 wrote to memory of 1032 2600 cmd.exe 39 PID 2600 wrote to memory of 1032 2600 cmd.exe 39 PID 2600 wrote to memory of 1032 2600 cmd.exe 39 PID 2580 wrote to memory of 2344 2580 cmd.exe 40 PID 2580 wrote to memory of 2344 2580 cmd.exe 40 PID 2580 wrote to memory of 2344 2580 cmd.exe 40 PID 2580 wrote to memory of 2344 2580 cmd.exe 40 -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 1032 attrib.exe 2344 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6390b876f7a9236842427d1aa64c47cb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6390b876f7a9236842427d1aa64c47cb_JaffaCakes118.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ren C:\Users\Admin\AppData\Roaming\windowshostmanagerupdate windowshostmanagerupdate.exe && exit2⤵PID:2800
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe2⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe" +s +h3⤵
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe" +s +h4⤵
- Sets file to hidden
- Drops file in Windows directory
- Views/modifies file attributes
PID:2344
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727" +s +h3⤵
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727" +s +h4⤵
- Sets file to hidden
- Drops file in Windows directory
- Views/modifies file attributes
PID:1032
-
-
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"3⤵
- Executes dropped EXE
PID:1120
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
763KB
MD56390b876f7a9236842427d1aa64c47cb
SHA1d5a728fb6f1e8339a61076d499d47d932df3fcf5
SHA25623ec9eebb57bc2df3edcc310629f9320fdd2d5f52026f07fe7a280abe77b57f2
SHA512bb7cfee5576c193c5147b7faae1e390db22a28b942ae4111f10994984bbd8713ce23e29ec93438aa9cd4f3bfe6504192892da5d84570ac203282b0fb7b6e6e8e
-
Filesize
31KB
MD5ed797d8dc2c92401985d162e42ffa450
SHA10f02fc517c7facc4baefde4fe9467fb6488ebabe
SHA256b746362010a101cb5931bc066f0f4d3fc740c02a68c1f37fc3c8e6c87fd7cb1e
SHA512e831a6ff987f3ef29982da16afad06938b68eddd43c234ba88d1c96a1b5547f2284baf35cbb3a5bfd75e7f0445d14daa014e0ba00b4db72c67f83f0a314c80c2