Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
22/07/2024, 20:15
Static task
static1
Behavioral task
behavioral1
Sample
64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe
-
Size
306KB
-
MD5
64a5ad1ffd99bcf6fa6432952ae24ca4
-
SHA1
f5eb9e1a261ec135905e52302a8701c90d5ba51d
-
SHA256
3a8c1bb90d28ddbd9533ced5ddec204318b998de78493428e8391ff489daf622
-
SHA512
08f0050db0dd906ad39ba4127f39c8d6399ebd7386efedd598d7bade3190abee16811794b7360d8d4401f24e3a934a68535bcd29301654d24c088c4186b5fcc3
-
SSDEEP
6144:p7xtd6v1sY8BcxKt8AIMakwpxyPQAfme3vhzaBTnssgsA:p7xHYqY8Bcxvb01Vfme3MTK
Malware Config
Extracted
darkcomet
íãÏíß
khdt1.zapto.org:5432
DC_MUTEX-9Y1VFXW
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
wurFyAv8D8DZ
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe -
Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 2464 attrib.exe -
Executes dropped EXE 1 IoCs
pid Process 2060 msdcsc.exe -
Loads dropped DLL 1 IoCs
pid Process 2992 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" iexplore.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2060 set thread context of 1924 2060 msdcsc.exe 34 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1924 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2992 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe Token: SeSecurityPrivilege 2992 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2992 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe Token: SeLoadDriverPrivilege 2992 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe Token: SeSystemProfilePrivilege 2992 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe Token: SeSystemtimePrivilege 2992 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 2992 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2992 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 2992 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe Token: SeBackupPrivilege 2992 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe Token: SeRestorePrivilege 2992 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe Token: SeShutdownPrivilege 2992 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe Token: SeDebugPrivilege 2992 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 2992 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 2992 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 2992 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe Token: SeUndockPrivilege 2992 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe Token: SeManageVolumePrivilege 2992 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe Token: SeImpersonatePrivilege 2992 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 2992 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe Token: 33 2992 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe Token: 34 2992 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe Token: 35 2992 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 2060 msdcsc.exe Token: SeSecurityPrivilege 2060 msdcsc.exe Token: SeTakeOwnershipPrivilege 2060 msdcsc.exe Token: SeLoadDriverPrivilege 2060 msdcsc.exe Token: SeSystemProfilePrivilege 2060 msdcsc.exe Token: SeSystemtimePrivilege 2060 msdcsc.exe Token: SeProfSingleProcessPrivilege 2060 msdcsc.exe Token: SeIncBasePriorityPrivilege 2060 msdcsc.exe Token: SeCreatePagefilePrivilege 2060 msdcsc.exe Token: SeBackupPrivilege 2060 msdcsc.exe Token: SeRestorePrivilege 2060 msdcsc.exe Token: SeShutdownPrivilege 2060 msdcsc.exe Token: SeDebugPrivilege 2060 msdcsc.exe Token: SeSystemEnvironmentPrivilege 2060 msdcsc.exe Token: SeChangeNotifyPrivilege 2060 msdcsc.exe Token: SeRemoteShutdownPrivilege 2060 msdcsc.exe Token: SeUndockPrivilege 2060 msdcsc.exe Token: SeManageVolumePrivilege 2060 msdcsc.exe Token: SeImpersonatePrivilege 2060 msdcsc.exe Token: SeCreateGlobalPrivilege 2060 msdcsc.exe Token: 33 2060 msdcsc.exe Token: 34 2060 msdcsc.exe Token: 35 2060 msdcsc.exe Token: SeIncreaseQuotaPrivilege 1924 iexplore.exe Token: SeSecurityPrivilege 1924 iexplore.exe Token: SeTakeOwnershipPrivilege 1924 iexplore.exe Token: SeLoadDriverPrivilege 1924 iexplore.exe Token: SeSystemProfilePrivilege 1924 iexplore.exe Token: SeSystemtimePrivilege 1924 iexplore.exe Token: SeProfSingleProcessPrivilege 1924 iexplore.exe Token: SeIncBasePriorityPrivilege 1924 iexplore.exe Token: SeCreatePagefilePrivilege 1924 iexplore.exe Token: SeBackupPrivilege 1924 iexplore.exe Token: SeRestorePrivilege 1924 iexplore.exe Token: SeShutdownPrivilege 1924 iexplore.exe Token: SeDebugPrivilege 1924 iexplore.exe Token: SeSystemEnvironmentPrivilege 1924 iexplore.exe Token: SeChangeNotifyPrivilege 1924 iexplore.exe Token: SeRemoteShutdownPrivilege 1924 iexplore.exe Token: SeUndockPrivilege 1924 iexplore.exe Token: SeManageVolumePrivilege 1924 iexplore.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1924 iexplore.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2992 wrote to memory of 544 2992 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe 30 PID 2992 wrote to memory of 544 2992 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe 30 PID 2992 wrote to memory of 544 2992 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe 30 PID 2992 wrote to memory of 544 2992 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe 30 PID 544 wrote to memory of 2464 544 cmd.exe 32 PID 544 wrote to memory of 2464 544 cmd.exe 32 PID 544 wrote to memory of 2464 544 cmd.exe 32 PID 544 wrote to memory of 2464 544 cmd.exe 32 PID 2992 wrote to memory of 2060 2992 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe 33 PID 2992 wrote to memory of 2060 2992 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe 33 PID 2992 wrote to memory of 2060 2992 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe 33 PID 2992 wrote to memory of 2060 2992 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe 33 PID 2060 wrote to memory of 1924 2060 msdcsc.exe 34 PID 2060 wrote to memory of 1924 2060 msdcsc.exe 34 PID 2060 wrote to memory of 1924 2060 msdcsc.exe 34 PID 2060 wrote to memory of 1924 2060 msdcsc.exe 34 PID 2060 wrote to memory of 1924 2060 msdcsc.exe 34 PID 2060 wrote to memory of 1924 2060 msdcsc.exe 34 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 2464 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2464
-
-
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1924
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
306KB
MD564a5ad1ffd99bcf6fa6432952ae24ca4
SHA1f5eb9e1a261ec135905e52302a8701c90d5ba51d
SHA2563a8c1bb90d28ddbd9533ced5ddec204318b998de78493428e8391ff489daf622
SHA51208f0050db0dd906ad39ba4127f39c8d6399ebd7386efedd598d7bade3190abee16811794b7360d8d4401f24e3a934a68535bcd29301654d24c088c4186b5fcc3