Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
26-07-2024 13:58
Static task
static1
Behavioral task
behavioral1
Sample
7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe
-
Size
343KB
-
MD5
7459dabde9a71618f63bde5999c81138
-
SHA1
244848e90107432bda5e929993193df7244dd724
-
SHA256
cc412889e3b6f4c3eb2935e2378d72f4b22949ed62024b53d401856b64facdc2
-
SHA512
35ff9ac4ae4dbd75707e309f82c42d48c9bcc26ca863d849a9143a6e13474c8b147c38c04359a1da777be35ccdc28b8074e2ca910c86586914028e038a27bd4d
-
SSDEEP
6144:JQ/W2mGZyRhTXMBCqyh7tP7H7xV1tBMDheWJ0S+x:JQODGIYBCjh7V7HFV1tCVnJ07x
Malware Config
Extracted
darkcomet
Guest16
loveayada.zapto.org:443
DC_MUTEX-ZNQTKSY
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
hqypCTfXL65a
-
install
true
-
offline_keylogger
true
-
password
0123456789
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
7459dabde9a71618f63bde5999c81138_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\MSDCSC\\msdcsc.exe" 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe -
Modifies firewall policy service 3 TTPs 3 IoCs
Processes:
msdcsc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" msdcsc.exe -
Modifies security service 2 TTPs 1 IoCs
Processes:
msdcsc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" msdcsc.exe -
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Executes dropped EXE 2 IoCs
Processes:
msdcsc.exemsdcsc.exepid process 2992 msdcsc.exe 2628 msdcsc.exe -
Loads dropped DLL 1 IoCs
Processes:
7459dabde9a71618f63bde5999c81138_JaffaCakes118.exepid process 2596 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe -
Processes:
resource yara_rule behavioral1/memory/2596-20-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/2596-18-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/2596-15-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/2596-12-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/2596-10-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/2596-21-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/2596-23-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/2596-22-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/2596-24-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/2596-25-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/2596-37-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/2628-51-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/2628-49-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/2628-50-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/2628-54-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/2628-53-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/2628-52-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/2628-55-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/2628-56-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/2628-57-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/2628-58-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/2628-59-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/2628-60-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/2628-61-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/2628-62-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/2628-63-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/2628-64-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/2628-65-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/2628-66-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/2628-67-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral1/memory/2628-68-0x0000000000400000-0x00000000004BA000-memory.dmp upx -
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
7459dabde9a71618f63bde5999c81138_JaffaCakes118.exemsdcsc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\MSDCSC\\msdcsc.exe" 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\MSDCSC\\msdcsc.exe" msdcsc.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
7459dabde9a71618f63bde5999c81138_JaffaCakes118.exemsdcsc.exedescription pid process target process PID 2204 set thread context of 2596 2204 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe PID 2992 set thread context of 2628 2992 msdcsc.exe msdcsc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
msdcsc.exe7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe7459dabde9a71618f63bde5999c81138_JaffaCakes118.exemsdcsc.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdcsc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe7459dabde9a71618f63bde5999c81138_JaffaCakes118.exemsdcsc.exemsdcsc.exedescription pid process Token: SeDebugPrivilege 2204 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 2596 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe Token: SeSecurityPrivilege 2596 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2596 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe Token: SeLoadDriverPrivilege 2596 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe Token: SeSystemProfilePrivilege 2596 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe Token: SeSystemtimePrivilege 2596 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 2596 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2596 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 2596 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe Token: SeBackupPrivilege 2596 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe Token: SeRestorePrivilege 2596 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe Token: SeShutdownPrivilege 2596 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe Token: SeDebugPrivilege 2596 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 2596 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 2596 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 2596 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe Token: SeUndockPrivilege 2596 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe Token: SeManageVolumePrivilege 2596 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe Token: SeImpersonatePrivilege 2596 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 2596 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe Token: 33 2596 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe Token: 34 2596 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe Token: 35 2596 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe Token: SeDebugPrivilege 2992 msdcsc.exe Token: SeIncreaseQuotaPrivilege 2628 msdcsc.exe Token: SeSecurityPrivilege 2628 msdcsc.exe Token: SeTakeOwnershipPrivilege 2628 msdcsc.exe Token: SeLoadDriverPrivilege 2628 msdcsc.exe Token: SeSystemProfilePrivilege 2628 msdcsc.exe Token: SeSystemtimePrivilege 2628 msdcsc.exe Token: SeProfSingleProcessPrivilege 2628 msdcsc.exe Token: SeIncBasePriorityPrivilege 2628 msdcsc.exe Token: SeCreatePagefilePrivilege 2628 msdcsc.exe Token: SeBackupPrivilege 2628 msdcsc.exe Token: SeRestorePrivilege 2628 msdcsc.exe Token: SeShutdownPrivilege 2628 msdcsc.exe Token: SeDebugPrivilege 2628 msdcsc.exe Token: SeSystemEnvironmentPrivilege 2628 msdcsc.exe Token: SeChangeNotifyPrivilege 2628 msdcsc.exe Token: SeRemoteShutdownPrivilege 2628 msdcsc.exe Token: SeUndockPrivilege 2628 msdcsc.exe Token: SeManageVolumePrivilege 2628 msdcsc.exe Token: SeImpersonatePrivilege 2628 msdcsc.exe Token: SeCreateGlobalPrivilege 2628 msdcsc.exe Token: 33 2628 msdcsc.exe Token: 34 2628 msdcsc.exe Token: 35 2628 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
msdcsc.exepid process 2628 msdcsc.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe7459dabde9a71618f63bde5999c81138_JaffaCakes118.exemsdcsc.exedescription pid process target process PID 2204 wrote to memory of 2596 2204 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe PID 2204 wrote to memory of 2596 2204 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe PID 2204 wrote to memory of 2596 2204 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe PID 2204 wrote to memory of 2596 2204 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe PID 2204 wrote to memory of 2596 2204 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe PID 2204 wrote to memory of 2596 2204 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe PID 2204 wrote to memory of 2596 2204 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe PID 2204 wrote to memory of 2596 2204 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe PID 2596 wrote to memory of 2992 2596 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe msdcsc.exe PID 2596 wrote to memory of 2992 2596 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe msdcsc.exe PID 2596 wrote to memory of 2992 2596 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe msdcsc.exe PID 2596 wrote to memory of 2992 2596 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe msdcsc.exe PID 2992 wrote to memory of 2628 2992 msdcsc.exe msdcsc.exe PID 2992 wrote to memory of 2628 2992 msdcsc.exe msdcsc.exe PID 2992 wrote to memory of 2628 2992 msdcsc.exe msdcsc.exe PID 2992 wrote to memory of 2628 2992 msdcsc.exe msdcsc.exe PID 2992 wrote to memory of 2628 2992 msdcsc.exe msdcsc.exe PID 2992 wrote to memory of 2628 2992 msdcsc.exe msdcsc.exe PID 2992 wrote to memory of 2628 2992 msdcsc.exe msdcsc.exe PID 2992 wrote to memory of 2628 2992 msdcsc.exe msdcsc.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
msdcsc.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" msdcsc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\7459dabde9a71618f63bde5999c81138_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe2⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\MSDCSC\msdcsc.exe"C:\MSDCSC\msdcsc.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\MSDCSC\msdcsc.exeC:\MSDCSC\msdcsc.exe4⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2628
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Defense Evasion
Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Modify Registry
7Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
343KB
MD57459dabde9a71618f63bde5999c81138
SHA1244848e90107432bda5e929993193df7244dd724
SHA256cc412889e3b6f4c3eb2935e2378d72f4b22949ed62024b53d401856b64facdc2
SHA51235ff9ac4ae4dbd75707e309f82c42d48c9bcc26ca863d849a9143a6e13474c8b147c38c04359a1da777be35ccdc28b8074e2ca910c86586914028e038a27bd4d