Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
22/07/2024, 14:36
Static task
static1
Behavioral task
behavioral1
Sample
6390b876f7a9236842427d1aa64c47cb_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
6390b876f7a9236842427d1aa64c47cb_JaffaCakes118.exe
-
Size
763KB
-
MD5
6390b876f7a9236842427d1aa64c47cb
-
SHA1
d5a728fb6f1e8339a61076d499d47d932df3fcf5
-
SHA256
23ec9eebb57bc2df3edcc310629f9320fdd2d5f52026f07fe7a280abe77b57f2
-
SHA512
bb7cfee5576c193c5147b7faae1e390db22a28b942ae4111f10994984bbd8713ce23e29ec93438aa9cd4f3bfe6504192892da5d84570ac203282b0fb7b6e6e8e
-
SSDEEP
12288:ugmEDIvbiPjXLrhW1cKG8fz0hY2lglVCCeOWROCehzXLWgMC9R1Xv9WJhN41gpuv:ugmuITiPj/LKBb0C2ulVClRhozXLW1GT
Malware Config
Extracted
darkcomet
Matt
yuk.no-ip.biz:100
DC_MUTEX-BZJHQWP
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
ACd9Gmmlygjr
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" cvtres.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 3976 attrib.exe 4632 attrib.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation 6390b876f7a9236842427d1aa64c47cb_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 2600 msdcsc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\windowshostmanagerupdate.exe = "C:\\Users\\Admin\\AppData\\Roaming\\windowshostmanagerupdate.exe" 6390b876f7a9236842427d1aa64c47cb_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" cvtres.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2844 set thread context of 4928 2844 6390b876f7a9236842427d1aa64c47cb_JaffaCakes118.exe 88 -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe attrib.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727 attrib.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4928 cvtres.exe Token: SeSecurityPrivilege 4928 cvtres.exe Token: SeTakeOwnershipPrivilege 4928 cvtres.exe Token: SeLoadDriverPrivilege 4928 cvtres.exe Token: SeSystemProfilePrivilege 4928 cvtres.exe Token: SeSystemtimePrivilege 4928 cvtres.exe Token: SeProfSingleProcessPrivilege 4928 cvtres.exe Token: SeIncBasePriorityPrivilege 4928 cvtres.exe Token: SeCreatePagefilePrivilege 4928 cvtres.exe Token: SeBackupPrivilege 4928 cvtres.exe Token: SeRestorePrivilege 4928 cvtres.exe Token: SeShutdownPrivilege 4928 cvtres.exe Token: SeDebugPrivilege 4928 cvtres.exe Token: SeSystemEnvironmentPrivilege 4928 cvtres.exe Token: SeChangeNotifyPrivilege 4928 cvtres.exe Token: SeRemoteShutdownPrivilege 4928 cvtres.exe Token: SeUndockPrivilege 4928 cvtres.exe Token: SeManageVolumePrivilege 4928 cvtres.exe Token: SeImpersonatePrivilege 4928 cvtres.exe Token: SeCreateGlobalPrivilege 4928 cvtres.exe Token: 33 4928 cvtres.exe Token: 34 4928 cvtres.exe Token: 35 4928 cvtres.exe Token: 36 4928 cvtres.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 2844 wrote to memory of 5088 2844 6390b876f7a9236842427d1aa64c47cb_JaffaCakes118.exe 85 PID 2844 wrote to memory of 5088 2844 6390b876f7a9236842427d1aa64c47cb_JaffaCakes118.exe 85 PID 2844 wrote to memory of 5088 2844 6390b876f7a9236842427d1aa64c47cb_JaffaCakes118.exe 85 PID 2844 wrote to memory of 4928 2844 6390b876f7a9236842427d1aa64c47cb_JaffaCakes118.exe 88 PID 2844 wrote to memory of 4928 2844 6390b876f7a9236842427d1aa64c47cb_JaffaCakes118.exe 88 PID 2844 wrote to memory of 4928 2844 6390b876f7a9236842427d1aa64c47cb_JaffaCakes118.exe 88 PID 2844 wrote to memory of 4928 2844 6390b876f7a9236842427d1aa64c47cb_JaffaCakes118.exe 88 PID 2844 wrote to memory of 4928 2844 6390b876f7a9236842427d1aa64c47cb_JaffaCakes118.exe 88 PID 2844 wrote to memory of 4928 2844 6390b876f7a9236842427d1aa64c47cb_JaffaCakes118.exe 88 PID 2844 wrote to memory of 4928 2844 6390b876f7a9236842427d1aa64c47cb_JaffaCakes118.exe 88 PID 2844 wrote to memory of 4928 2844 6390b876f7a9236842427d1aa64c47cb_JaffaCakes118.exe 88 PID 2844 wrote to memory of 4928 2844 6390b876f7a9236842427d1aa64c47cb_JaffaCakes118.exe 88 PID 2844 wrote to memory of 4928 2844 6390b876f7a9236842427d1aa64c47cb_JaffaCakes118.exe 88 PID 2844 wrote to memory of 4928 2844 6390b876f7a9236842427d1aa64c47cb_JaffaCakes118.exe 88 PID 2844 wrote to memory of 4928 2844 6390b876f7a9236842427d1aa64c47cb_JaffaCakes118.exe 88 PID 2844 wrote to memory of 4928 2844 6390b876f7a9236842427d1aa64c47cb_JaffaCakes118.exe 88 PID 2844 wrote to memory of 4928 2844 6390b876f7a9236842427d1aa64c47cb_JaffaCakes118.exe 88 PID 4928 wrote to memory of 1944 4928 cvtres.exe 89 PID 4928 wrote to memory of 1944 4928 cvtres.exe 89 PID 4928 wrote to memory of 1944 4928 cvtres.exe 89 PID 4928 wrote to memory of 1336 4928 cvtres.exe 91 PID 4928 wrote to memory of 1336 4928 cvtres.exe 91 PID 4928 wrote to memory of 1336 4928 cvtres.exe 91 PID 4928 wrote to memory of 2600 4928 cvtres.exe 93 PID 4928 wrote to memory of 2600 4928 cvtres.exe 93 PID 4928 wrote to memory of 2600 4928 cvtres.exe 93 PID 1944 wrote to memory of 4632 1944 cmd.exe 95 PID 1944 wrote to memory of 4632 1944 cmd.exe 95 PID 1944 wrote to memory of 4632 1944 cmd.exe 95 PID 1336 wrote to memory of 3976 1336 cmd.exe 96 PID 1336 wrote to memory of 3976 1336 cmd.exe 96 PID 1336 wrote to memory of 3976 1336 cmd.exe 96 -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 4632 attrib.exe 3976 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6390b876f7a9236842427d1aa64c47cb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6390b876f7a9236842427d1aa64c47cb_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ren C:\Users\Admin\AppData\Roaming\windowshostmanagerupdate windowshostmanagerupdate.exe && exit2⤵PID:5088
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe2⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe" +s +h3⤵
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe" +s +h4⤵
- Sets file to hidden
- Drops file in Windows directory
- Views/modifies file attributes
PID:4632
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727" +s +h3⤵
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727" +s +h4⤵
- Sets file to hidden
- Drops file in Windows directory
- Views/modifies file attributes
PID:3976
-
-
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"3⤵
- Executes dropped EXE
PID:2600
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
763KB
MD56390b876f7a9236842427d1aa64c47cb
SHA1d5a728fb6f1e8339a61076d499d47d932df3fcf5
SHA25623ec9eebb57bc2df3edcc310629f9320fdd2d5f52026f07fe7a280abe77b57f2
SHA512bb7cfee5576c193c5147b7faae1e390db22a28b942ae4111f10994984bbd8713ce23e29ec93438aa9cd4f3bfe6504192892da5d84570ac203282b0fb7b6e6e8e
-
Filesize
34KB
MD5e118330b4629b12368d91b9df6488be0
SHA1ce90218c7e3b90df2a3409ec253048bb6472c2fd
SHA2563a0f2936b8c45e8ba3458d69d7859a63844469e698652e15fb56639d32f40cc9
SHA512ac91c04cb20223dbaaf594440cb778dff36e857921be427c8528ba4c6cdb3e8bf8e71e1ae8af7bde9c04ff5b97b379231625bc1a2b66aba2f98cd340cd8a94b0