Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
26-07-2024 23:03
Behavioral task
behavioral1
Sample
761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe
-
Size
661KB
-
MD5
761b2ea3d2f05a0b94de32442ff9cd05
-
SHA1
a03f6454f45d207fb5821f68d4d19e76391876c0
-
SHA256
3bb11a7d30a3e352b6a1919cdae64b58b8ed6581b5c3dc076a3f563ee88c4d86
-
SHA512
3208510fef115b1abaf9eec90c5540a50d239583fb6fce0e6297950deb44936c653d273677ac9e50193a26199ae297162bf5aab3ce1f1bb67eca5b366994b70b
-
SSDEEP
12288:IXhpvNWw276S/DuoeFcfbmiJ99VPhYR5MTSHvLenELrWv1lZw4JuMkMh/fy452U3:unAw2WWeFcfbP9VPSPMTSPL/rWvzq4JH
Malware Config
Extracted
darkcomet
Guest16
jojojijijojo.no-ip.org:7050
DC_MUTEX-VJCE7NK
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
Qm8S8Vk13fvr
-
install
true
-
offline_keylogger
false
-
password
mutexvisa
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 2440 msdcsc.exe -
Loads dropped DLL 2 IoCs
Processes:
761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exepid process 1300 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe 1300 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exemsdcsc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" msdcsc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exemsdcsc.exenotepad.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdcsc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 1300 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe Token: SeSecurityPrivilege 1300 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 1300 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe Token: SeLoadDriverPrivilege 1300 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe Token: SeSystemProfilePrivilege 1300 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe Token: SeSystemtimePrivilege 1300 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 1300 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1300 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 1300 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe Token: SeBackupPrivilege 1300 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe Token: SeRestorePrivilege 1300 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe Token: SeShutdownPrivilege 1300 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe Token: SeDebugPrivilege 1300 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 1300 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 1300 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 1300 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe Token: SeUndockPrivilege 1300 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe Token: SeManageVolumePrivilege 1300 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe Token: SeImpersonatePrivilege 1300 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 1300 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe Token: 33 1300 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe Token: 34 1300 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe Token: 35 1300 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 2440 msdcsc.exe Token: SeSecurityPrivilege 2440 msdcsc.exe Token: SeTakeOwnershipPrivilege 2440 msdcsc.exe Token: SeLoadDriverPrivilege 2440 msdcsc.exe Token: SeSystemProfilePrivilege 2440 msdcsc.exe Token: SeSystemtimePrivilege 2440 msdcsc.exe Token: SeProfSingleProcessPrivilege 2440 msdcsc.exe Token: SeIncBasePriorityPrivilege 2440 msdcsc.exe Token: SeCreatePagefilePrivilege 2440 msdcsc.exe Token: SeBackupPrivilege 2440 msdcsc.exe Token: SeRestorePrivilege 2440 msdcsc.exe Token: SeShutdownPrivilege 2440 msdcsc.exe Token: SeDebugPrivilege 2440 msdcsc.exe Token: SeSystemEnvironmentPrivilege 2440 msdcsc.exe Token: SeChangeNotifyPrivilege 2440 msdcsc.exe Token: SeRemoteShutdownPrivilege 2440 msdcsc.exe Token: SeUndockPrivilege 2440 msdcsc.exe Token: SeManageVolumePrivilege 2440 msdcsc.exe Token: SeImpersonatePrivilege 2440 msdcsc.exe Token: SeCreateGlobalPrivilege 2440 msdcsc.exe Token: 33 2440 msdcsc.exe Token: 34 2440 msdcsc.exe Token: 35 2440 msdcsc.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exemsdcsc.exedescription pid process target process PID 1300 wrote to memory of 2440 1300 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe msdcsc.exe PID 1300 wrote to memory of 2440 1300 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe msdcsc.exe PID 1300 wrote to memory of 2440 1300 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe msdcsc.exe PID 1300 wrote to memory of 2440 1300 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe msdcsc.exe PID 2440 wrote to memory of 2316 2440 msdcsc.exe notepad.exe PID 2440 wrote to memory of 2316 2440 msdcsc.exe notepad.exe PID 2440 wrote to memory of 2316 2440 msdcsc.exe notepad.exe PID 2440 wrote to memory of 2316 2440 msdcsc.exe notepad.exe PID 2440 wrote to memory of 2316 2440 msdcsc.exe notepad.exe PID 2440 wrote to memory of 2316 2440 msdcsc.exe notepad.exe PID 2440 wrote to memory of 2316 2440 msdcsc.exe notepad.exe PID 2440 wrote to memory of 2316 2440 msdcsc.exe notepad.exe PID 2440 wrote to memory of 2316 2440 msdcsc.exe notepad.exe PID 2440 wrote to memory of 2316 2440 msdcsc.exe notepad.exe PID 2440 wrote to memory of 2316 2440 msdcsc.exe notepad.exe PID 2440 wrote to memory of 2316 2440 msdcsc.exe notepad.exe PID 2440 wrote to memory of 2316 2440 msdcsc.exe notepad.exe PID 2440 wrote to memory of 2316 2440 msdcsc.exe notepad.exe PID 2440 wrote to memory of 2316 2440 msdcsc.exe notepad.exe PID 2440 wrote to memory of 2316 2440 msdcsc.exe notepad.exe PID 2440 wrote to memory of 2316 2440 msdcsc.exe notepad.exe PID 2440 wrote to memory of 2316 2440 msdcsc.exe notepad.exe PID 2440 wrote to memory of 2316 2440 msdcsc.exe notepad.exe PID 2440 wrote to memory of 2316 2440 msdcsc.exe notepad.exe PID 2440 wrote to memory of 2316 2440 msdcsc.exe notepad.exe PID 2440 wrote to memory of 2316 2440 msdcsc.exe notepad.exe PID 2440 wrote to memory of 2316 2440 msdcsc.exe notepad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\SysWOW64\notepad.exenotepad3⤵
- System Location Discovery: System Language Discovery
PID:2316
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
661KB
MD5761b2ea3d2f05a0b94de32442ff9cd05
SHA1a03f6454f45d207fb5821f68d4d19e76391876c0
SHA2563bb11a7d30a3e352b6a1919cdae64b58b8ed6581b5c3dc076a3f563ee88c4d86
SHA5123208510fef115b1abaf9eec90c5540a50d239583fb6fce0e6297950deb44936c653d273677ac9e50193a26199ae297162bf5aab3ce1f1bb67eca5b366994b70b