Analysis
-
max time kernel
139s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
22/07/2024, 20:15
Static task
static1
Behavioral task
behavioral1
Sample
64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe
-
Size
306KB
-
MD5
64a5ad1ffd99bcf6fa6432952ae24ca4
-
SHA1
f5eb9e1a261ec135905e52302a8701c90d5ba51d
-
SHA256
3a8c1bb90d28ddbd9533ced5ddec204318b998de78493428e8391ff489daf622
-
SHA512
08f0050db0dd906ad39ba4127f39c8d6399ebd7386efedd598d7bade3190abee16811794b7360d8d4401f24e3a934a68535bcd29301654d24c088c4186b5fcc3
-
SSDEEP
6144:p7xtd6v1sY8BcxKt8AIMakwpxyPQAfme3vhzaBTnssgsA:p7xHYqY8Bcxvb01Vfme3MTK
Malware Config
Extracted
darkcomet
íãÏíß
khdt1.zapto.org:5432
DC_MUTEX-9Y1VFXW
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
wurFyAv8D8DZ
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe -
Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 244 attrib.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 4444 msdcsc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" msdcsc.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4444 set thread context of 2376 4444 msdcsc.exe 91 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1956 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe Token: SeSecurityPrivilege 1956 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 1956 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe Token: SeLoadDriverPrivilege 1956 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe Token: SeSystemProfilePrivilege 1956 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe Token: SeSystemtimePrivilege 1956 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 1956 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1956 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 1956 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe Token: SeBackupPrivilege 1956 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe Token: SeRestorePrivilege 1956 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe Token: SeShutdownPrivilege 1956 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe Token: SeDebugPrivilege 1956 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 1956 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 1956 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 1956 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe Token: SeUndockPrivilege 1956 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe Token: SeManageVolumePrivilege 1956 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe Token: SeImpersonatePrivilege 1956 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 1956 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe Token: 33 1956 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe Token: 34 1956 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe Token: 35 1956 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe Token: 36 1956 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 4444 msdcsc.exe Token: SeSecurityPrivilege 4444 msdcsc.exe Token: SeTakeOwnershipPrivilege 4444 msdcsc.exe Token: SeLoadDriverPrivilege 4444 msdcsc.exe Token: SeSystemProfilePrivilege 4444 msdcsc.exe Token: SeSystemtimePrivilege 4444 msdcsc.exe Token: SeProfSingleProcessPrivilege 4444 msdcsc.exe Token: SeIncBasePriorityPrivilege 4444 msdcsc.exe Token: SeCreatePagefilePrivilege 4444 msdcsc.exe Token: SeBackupPrivilege 4444 msdcsc.exe Token: SeRestorePrivilege 4444 msdcsc.exe Token: SeShutdownPrivilege 4444 msdcsc.exe Token: SeDebugPrivilege 4444 msdcsc.exe Token: SeSystemEnvironmentPrivilege 4444 msdcsc.exe Token: SeChangeNotifyPrivilege 4444 msdcsc.exe Token: SeRemoteShutdownPrivilege 4444 msdcsc.exe Token: SeUndockPrivilege 4444 msdcsc.exe Token: SeManageVolumePrivilege 4444 msdcsc.exe Token: SeImpersonatePrivilege 4444 msdcsc.exe Token: SeCreateGlobalPrivilege 4444 msdcsc.exe Token: 33 4444 msdcsc.exe Token: 34 4444 msdcsc.exe Token: 35 4444 msdcsc.exe Token: 36 4444 msdcsc.exe Token: SeIncreaseQuotaPrivilege 2376 iexplore.exe Token: SeSecurityPrivilege 2376 iexplore.exe Token: SeTakeOwnershipPrivilege 2376 iexplore.exe Token: SeLoadDriverPrivilege 2376 iexplore.exe Token: SeSystemProfilePrivilege 2376 iexplore.exe Token: SeSystemtimePrivilege 2376 iexplore.exe Token: SeProfSingleProcessPrivilege 2376 iexplore.exe Token: SeIncBasePriorityPrivilege 2376 iexplore.exe Token: SeCreatePagefilePrivilege 2376 iexplore.exe Token: SeBackupPrivilege 2376 iexplore.exe Token: SeRestorePrivilege 2376 iexplore.exe Token: SeShutdownPrivilege 2376 iexplore.exe Token: SeDebugPrivilege 2376 iexplore.exe Token: SeSystemEnvironmentPrivilege 2376 iexplore.exe Token: SeChangeNotifyPrivilege 2376 iexplore.exe Token: SeRemoteShutdownPrivilege 2376 iexplore.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1956 wrote to memory of 1452 1956 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe 86 PID 1956 wrote to memory of 1452 1956 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe 86 PID 1956 wrote to memory of 1452 1956 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe 86 PID 1452 wrote to memory of 244 1452 cmd.exe 88 PID 1452 wrote to memory of 244 1452 cmd.exe 88 PID 1452 wrote to memory of 244 1452 cmd.exe 88 PID 1956 wrote to memory of 4444 1956 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe 90 PID 1956 wrote to memory of 4444 1956 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe 90 PID 1956 wrote to memory of 4444 1956 64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe 90 PID 4444 wrote to memory of 2376 4444 msdcsc.exe 91 PID 4444 wrote to memory of 2376 4444 msdcsc.exe 91 PID 4444 wrote to memory of 2376 4444 msdcsc.exe 91 PID 4444 wrote to memory of 2376 4444 msdcsc.exe 91 PID 4444 wrote to memory of 2376 4444 msdcsc.exe 91 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 244 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\64a5ad1ffd99bcf6fa6432952ae24ca4_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:244
-
-
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2376
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
306KB
MD564a5ad1ffd99bcf6fa6432952ae24ca4
SHA1f5eb9e1a261ec135905e52302a8701c90d5ba51d
SHA2563a8c1bb90d28ddbd9533ced5ddec204318b998de78493428e8391ff489daf622
SHA51208f0050db0dd906ad39ba4127f39c8d6399ebd7386efedd598d7bade3190abee16811794b7360d8d4401f24e3a934a68535bcd29301654d24c088c4186b5fcc3