Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26-07-2024 23:03
Behavioral task
behavioral1
Sample
761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe
-
Size
661KB
-
MD5
761b2ea3d2f05a0b94de32442ff9cd05
-
SHA1
a03f6454f45d207fb5821f68d4d19e76391876c0
-
SHA256
3bb11a7d30a3e352b6a1919cdae64b58b8ed6581b5c3dc076a3f563ee88c4d86
-
SHA512
3208510fef115b1abaf9eec90c5540a50d239583fb6fce0e6297950deb44936c653d273677ac9e50193a26199ae297162bf5aab3ce1f1bb67eca5b366994b70b
-
SSDEEP
12288:IXhpvNWw276S/DuoeFcfbmiJ99VPhYR5MTSHvLenELrWv1lZw4JuMkMh/fy452U3:unAw2WWeFcfbP9VPSPMTSPL/rWvzq4JH
Malware Config
Extracted
darkcomet
Guest16
jojojijijojo.no-ip.org:7050
DC_MUTEX-VJCE7NK
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
Qm8S8Vk13fvr
-
install
true
-
offline_keylogger
false
-
password
mutexvisa
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 3120 msdcsc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
msdcsc.exe761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exemsdcsc.exenotepad.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdcsc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 4696 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe Token: SeSecurityPrivilege 4696 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 4696 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe Token: SeLoadDriverPrivilege 4696 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe Token: SeSystemProfilePrivilege 4696 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe Token: SeSystemtimePrivilege 4696 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 4696 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 4696 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 4696 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe Token: SeBackupPrivilege 4696 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe Token: SeRestorePrivilege 4696 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe Token: SeShutdownPrivilege 4696 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe Token: SeDebugPrivilege 4696 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 4696 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 4696 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 4696 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe Token: SeUndockPrivilege 4696 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe Token: SeManageVolumePrivilege 4696 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe Token: SeImpersonatePrivilege 4696 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 4696 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe Token: 33 4696 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe Token: 34 4696 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe Token: 35 4696 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe Token: 36 4696 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 3120 msdcsc.exe Token: SeSecurityPrivilege 3120 msdcsc.exe Token: SeTakeOwnershipPrivilege 3120 msdcsc.exe Token: SeLoadDriverPrivilege 3120 msdcsc.exe Token: SeSystemProfilePrivilege 3120 msdcsc.exe Token: SeSystemtimePrivilege 3120 msdcsc.exe Token: SeProfSingleProcessPrivilege 3120 msdcsc.exe Token: SeIncBasePriorityPrivilege 3120 msdcsc.exe Token: SeCreatePagefilePrivilege 3120 msdcsc.exe Token: SeBackupPrivilege 3120 msdcsc.exe Token: SeRestorePrivilege 3120 msdcsc.exe Token: SeShutdownPrivilege 3120 msdcsc.exe Token: SeDebugPrivilege 3120 msdcsc.exe Token: SeSystemEnvironmentPrivilege 3120 msdcsc.exe Token: SeChangeNotifyPrivilege 3120 msdcsc.exe Token: SeRemoteShutdownPrivilege 3120 msdcsc.exe Token: SeUndockPrivilege 3120 msdcsc.exe Token: SeManageVolumePrivilege 3120 msdcsc.exe Token: SeImpersonatePrivilege 3120 msdcsc.exe Token: SeCreateGlobalPrivilege 3120 msdcsc.exe Token: 33 3120 msdcsc.exe Token: 34 3120 msdcsc.exe Token: 35 3120 msdcsc.exe Token: 36 3120 msdcsc.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exemsdcsc.exedescription pid process target process PID 4696 wrote to memory of 3120 4696 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe msdcsc.exe PID 4696 wrote to memory of 3120 4696 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe msdcsc.exe PID 4696 wrote to memory of 3120 4696 761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe msdcsc.exe PID 3120 wrote to memory of 5040 3120 msdcsc.exe notepad.exe PID 3120 wrote to memory of 5040 3120 msdcsc.exe notepad.exe PID 3120 wrote to memory of 5040 3120 msdcsc.exe notepad.exe PID 3120 wrote to memory of 5040 3120 msdcsc.exe notepad.exe PID 3120 wrote to memory of 5040 3120 msdcsc.exe notepad.exe PID 3120 wrote to memory of 5040 3120 msdcsc.exe notepad.exe PID 3120 wrote to memory of 5040 3120 msdcsc.exe notepad.exe PID 3120 wrote to memory of 5040 3120 msdcsc.exe notepad.exe PID 3120 wrote to memory of 5040 3120 msdcsc.exe notepad.exe PID 3120 wrote to memory of 5040 3120 msdcsc.exe notepad.exe PID 3120 wrote to memory of 5040 3120 msdcsc.exe notepad.exe PID 3120 wrote to memory of 5040 3120 msdcsc.exe notepad.exe PID 3120 wrote to memory of 5040 3120 msdcsc.exe notepad.exe PID 3120 wrote to memory of 5040 3120 msdcsc.exe notepad.exe PID 3120 wrote to memory of 5040 3120 msdcsc.exe notepad.exe PID 3120 wrote to memory of 5040 3120 msdcsc.exe notepad.exe PID 3120 wrote to memory of 5040 3120 msdcsc.exe notepad.exe PID 3120 wrote to memory of 5040 3120 msdcsc.exe notepad.exe PID 3120 wrote to memory of 5040 3120 msdcsc.exe notepad.exe PID 3120 wrote to memory of 5040 3120 msdcsc.exe notepad.exe PID 3120 wrote to memory of 5040 3120 msdcsc.exe notepad.exe PID 3120 wrote to memory of 5040 3120 msdcsc.exe notepad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\761b2ea3d2f05a0b94de32442ff9cd05_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Windows\SysWOW64\notepad.exenotepad3⤵
- System Location Discovery: System Language Discovery
PID:5040
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
661KB
MD5761b2ea3d2f05a0b94de32442ff9cd05
SHA1a03f6454f45d207fb5821f68d4d19e76391876c0
SHA2563bb11a7d30a3e352b6a1919cdae64b58b8ed6581b5c3dc076a3f563ee88c4d86
SHA5123208510fef115b1abaf9eec90c5540a50d239583fb6fce0e6297950deb44936c653d273677ac9e50193a26199ae297162bf5aab3ce1f1bb67eca5b366994b70b