Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26-07-2024 13:58
Static task
static1
Behavioral task
behavioral1
Sample
7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe
Resource
win7-20240705-en
General
-
Target
7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe
-
Size
343KB
-
MD5
7459dabde9a71618f63bde5999c81138
-
SHA1
244848e90107432bda5e929993193df7244dd724
-
SHA256
cc412889e3b6f4c3eb2935e2378d72f4b22949ed62024b53d401856b64facdc2
-
SHA512
35ff9ac4ae4dbd75707e309f82c42d48c9bcc26ca863d849a9143a6e13474c8b147c38c04359a1da777be35ccdc28b8074e2ca910c86586914028e038a27bd4d
-
SSDEEP
6144:JQ/W2mGZyRhTXMBCqyh7tP7H7xV1tBMDheWJ0S+x:JQODGIYBCjh7V7HFV1tCVnJ07x
Malware Config
Extracted
darkcomet
Guest16
loveayada.zapto.org:443
DC_MUTEX-ZNQTKSY
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
hqypCTfXL65a
-
install
true
-
offline_keylogger
true
-
password
0123456789
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
7459dabde9a71618f63bde5999c81138_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\MSDCSC\\msdcsc.exe" 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe -
Modifies firewall policy service 3 TTPs 3 IoCs
Processes:
msdcsc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" msdcsc.exe -
Modifies security service 2 TTPs 1 IoCs
Processes:
msdcsc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" msdcsc.exe -
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
7459dabde9a71618f63bde5999c81138_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe -
Executes dropped EXE 2 IoCs
Processes:
msdcsc.exemsdcsc.exepid process 4828 msdcsc.exe 5008 msdcsc.exe -
Processes:
resource yara_rule behavioral2/memory/2084-8-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral2/memory/2084-9-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral2/memory/2084-13-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral2/memory/2084-15-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral2/memory/2084-17-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral2/memory/2084-18-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral2/memory/2084-82-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral2/memory/5008-88-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral2/memory/5008-89-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral2/memory/5008-90-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral2/memory/5008-91-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral2/memory/5008-92-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral2/memory/5008-93-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral2/memory/5008-94-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral2/memory/5008-95-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral2/memory/5008-96-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral2/memory/5008-97-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral2/memory/5008-98-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral2/memory/5008-99-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral2/memory/5008-100-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral2/memory/5008-101-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral2/memory/5008-102-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral2/memory/5008-103-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral2/memory/5008-104-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral2/memory/5008-105-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral2/memory/5008-106-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral2/memory/5008-107-0x0000000000400000-0x00000000004BA000-memory.dmp upx -
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
7459dabde9a71618f63bde5999c81138_JaffaCakes118.exemsdcsc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\MSDCSC\\msdcsc.exe" 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\MSDCSC\\msdcsc.exe" msdcsc.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
7459dabde9a71618f63bde5999c81138_JaffaCakes118.exemsdcsc.exedescription pid process target process PID 5040 set thread context of 2084 5040 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe PID 4828 set thread context of 5008 4828 msdcsc.exe msdcsc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe7459dabde9a71618f63bde5999c81138_JaffaCakes118.exemsdcsc.exemsdcsc.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdcsc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdcsc.exe -
Modifies registry class 1 IoCs
Processes:
7459dabde9a71618f63bde5999c81138_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 50 IoCs
Processes:
7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe7459dabde9a71618f63bde5999c81138_JaffaCakes118.exemsdcsc.exemsdcsc.exedescription pid process Token: SeDebugPrivilege 5040 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 2084 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe Token: SeSecurityPrivilege 2084 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2084 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe Token: SeLoadDriverPrivilege 2084 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe Token: SeSystemProfilePrivilege 2084 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe Token: SeSystemtimePrivilege 2084 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 2084 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2084 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 2084 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe Token: SeBackupPrivilege 2084 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe Token: SeRestorePrivilege 2084 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe Token: SeShutdownPrivilege 2084 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe Token: SeDebugPrivilege 2084 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 2084 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 2084 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 2084 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe Token: SeUndockPrivilege 2084 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe Token: SeManageVolumePrivilege 2084 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe Token: SeImpersonatePrivilege 2084 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 2084 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe Token: 33 2084 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe Token: 34 2084 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe Token: 35 2084 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe Token: 36 2084 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe Token: SeDebugPrivilege 4828 msdcsc.exe Token: SeIncreaseQuotaPrivilege 5008 msdcsc.exe Token: SeSecurityPrivilege 5008 msdcsc.exe Token: SeTakeOwnershipPrivilege 5008 msdcsc.exe Token: SeLoadDriverPrivilege 5008 msdcsc.exe Token: SeSystemProfilePrivilege 5008 msdcsc.exe Token: SeSystemtimePrivilege 5008 msdcsc.exe Token: SeProfSingleProcessPrivilege 5008 msdcsc.exe Token: SeIncBasePriorityPrivilege 5008 msdcsc.exe Token: SeCreatePagefilePrivilege 5008 msdcsc.exe Token: SeBackupPrivilege 5008 msdcsc.exe Token: SeRestorePrivilege 5008 msdcsc.exe Token: SeShutdownPrivilege 5008 msdcsc.exe Token: SeDebugPrivilege 5008 msdcsc.exe Token: SeSystemEnvironmentPrivilege 5008 msdcsc.exe Token: SeChangeNotifyPrivilege 5008 msdcsc.exe Token: SeRemoteShutdownPrivilege 5008 msdcsc.exe Token: SeUndockPrivilege 5008 msdcsc.exe Token: SeManageVolumePrivilege 5008 msdcsc.exe Token: SeImpersonatePrivilege 5008 msdcsc.exe Token: SeCreateGlobalPrivilege 5008 msdcsc.exe Token: 33 5008 msdcsc.exe Token: 34 5008 msdcsc.exe Token: 35 5008 msdcsc.exe Token: 36 5008 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
msdcsc.exepid process 5008 msdcsc.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe7459dabde9a71618f63bde5999c81138_JaffaCakes118.exemsdcsc.exedescription pid process target process PID 5040 wrote to memory of 2084 5040 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe PID 5040 wrote to memory of 2084 5040 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe PID 5040 wrote to memory of 2084 5040 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe PID 5040 wrote to memory of 2084 5040 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe PID 5040 wrote to memory of 2084 5040 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe PID 5040 wrote to memory of 2084 5040 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe PID 5040 wrote to memory of 2084 5040 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe PID 5040 wrote to memory of 2084 5040 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe PID 2084 wrote to memory of 4828 2084 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe msdcsc.exe PID 2084 wrote to memory of 4828 2084 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe msdcsc.exe PID 2084 wrote to memory of 4828 2084 7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe msdcsc.exe PID 4828 wrote to memory of 5008 4828 msdcsc.exe msdcsc.exe PID 4828 wrote to memory of 5008 4828 msdcsc.exe msdcsc.exe PID 4828 wrote to memory of 5008 4828 msdcsc.exe msdcsc.exe PID 4828 wrote to memory of 5008 4828 msdcsc.exe msdcsc.exe PID 4828 wrote to memory of 5008 4828 msdcsc.exe msdcsc.exe PID 4828 wrote to memory of 5008 4828 msdcsc.exe msdcsc.exe PID 4828 wrote to memory of 5008 4828 msdcsc.exe msdcsc.exe PID 4828 wrote to memory of 5008 4828 msdcsc.exe msdcsc.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
msdcsc.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion msdcsc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\7459dabde9a71618f63bde5999c81138_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\7459dabde9a71618f63bde5999c81138_JaffaCakes118.exe2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\MSDCSC\msdcsc.exe"C:\MSDCSC\msdcsc.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\MSDCSC\msdcsc.exeC:\MSDCSC\msdcsc.exe4⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:5008
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Defense Evasion
Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Modify Registry
7Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
343KB
MD57459dabde9a71618f63bde5999c81138
SHA1244848e90107432bda5e929993193df7244dd724
SHA256cc412889e3b6f4c3eb2935e2378d72f4b22949ed62024b53d401856b64facdc2
SHA51235ff9ac4ae4dbd75707e309f82c42d48c9bcc26ca863d849a9143a6e13474c8b147c38c04359a1da777be35ccdc28b8074e2ca910c86586914028e038a27bd4d