Analysis
-
max time kernel
121s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
01-08-2024 07:53
Static task
static1
Behavioral task
behavioral1
Sample
7fb95a278a19e2e617103073ce277949_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
7fb95a278a19e2e617103073ce277949_JaffaCakes118.exe
-
Size
1.0MB
-
MD5
7fb95a278a19e2e617103073ce277949
-
SHA1
b35d3abe168e600e479fe4ee0a9bbd0d16896293
-
SHA256
e10ceccfa2079cd2c7fbd113a12b2543089858353aa864120ac4fa4293a44c82
-
SHA512
f3a7abb1041b9cb894e11d240e651e1874f4698a426f652afa82360065da05cbbed3e7910b8cd3a82bc38b35e6ce5a07b8cc110e7c3823816fc4e4104fb112b8
-
SSDEEP
24576:FhXEizcghu+seL01pUbWm/FZk8KDdZprnIRWmAZfwv:z0rgw+s8k8KZ6DA1e
Malware Config
Extracted
darkcomet
Guest16
rat298.no-ip.biz:1604
DC_MUTEX-0GZYHZ0
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
z8rgSbLtXLFl
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" svchost.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 2560 attrib.exe 2536 attrib.exe -
Executes dropped EXE 2 IoCs
Processes:
svchost.exemsdcsc.exepid process 1816 svchost.exe 1792 msdcsc.exe -
Loads dropped DLL 2 IoCs
Processes:
7fb95a278a19e2e617103073ce277949_JaffaCakes118.exesvchost.exepid process 2424 7fb95a278a19e2e617103073ce277949_JaffaCakes118.exe 1816 svchost.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
svchost.exe7fb95a278a19e2e617103073ce277949_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSE = "C:\\Users\\Admin\\AppData\\Local\\Temp\\msupdate" 7fb95a278a19e2e617103073ce277949_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
7fb95a278a19e2e617103073ce277949_JaffaCakes118.exedescription pid process target process PID 2424 set thread context of 1816 2424 7fb95a278a19e2e617103073ce277949_JaffaCakes118.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
cmd.execmd.exenotepad.exeattrib.exeattrib.exemsdcsc.exe7fb95a278a19e2e617103073ce277949_JaffaCakes118.exesvchost.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdcsc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7fb95a278a19e2e617103073ce277949_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
7fb95a278a19e2e617103073ce277949_JaffaCakes118.exesvchost.exedescription pid process Token: SeDebugPrivilege 2424 7fb95a278a19e2e617103073ce277949_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 1816 svchost.exe Token: SeSecurityPrivilege 1816 svchost.exe Token: SeTakeOwnershipPrivilege 1816 svchost.exe Token: SeLoadDriverPrivilege 1816 svchost.exe Token: SeSystemProfilePrivilege 1816 svchost.exe Token: SeSystemtimePrivilege 1816 svchost.exe Token: SeProfSingleProcessPrivilege 1816 svchost.exe Token: SeIncBasePriorityPrivilege 1816 svchost.exe Token: SeCreatePagefilePrivilege 1816 svchost.exe Token: SeBackupPrivilege 1816 svchost.exe Token: SeRestorePrivilege 1816 svchost.exe Token: SeShutdownPrivilege 1816 svchost.exe Token: SeDebugPrivilege 1816 svchost.exe Token: SeSystemEnvironmentPrivilege 1816 svchost.exe Token: SeChangeNotifyPrivilege 1816 svchost.exe Token: SeRemoteShutdownPrivilege 1816 svchost.exe Token: SeUndockPrivilege 1816 svchost.exe Token: SeManageVolumePrivilege 1816 svchost.exe Token: SeImpersonatePrivilege 1816 svchost.exe Token: SeCreateGlobalPrivilege 1816 svchost.exe Token: 33 1816 svchost.exe Token: 34 1816 svchost.exe Token: 35 1816 svchost.exe -
Suspicious use of WriteProcessMemory 51 IoCs
Processes:
7fb95a278a19e2e617103073ce277949_JaffaCakes118.exesvchost.execmd.execmd.exedescription pid process target process PID 2424 wrote to memory of 1816 2424 7fb95a278a19e2e617103073ce277949_JaffaCakes118.exe svchost.exe PID 2424 wrote to memory of 1816 2424 7fb95a278a19e2e617103073ce277949_JaffaCakes118.exe svchost.exe PID 2424 wrote to memory of 1816 2424 7fb95a278a19e2e617103073ce277949_JaffaCakes118.exe svchost.exe PID 2424 wrote to memory of 1816 2424 7fb95a278a19e2e617103073ce277949_JaffaCakes118.exe svchost.exe PID 2424 wrote to memory of 1816 2424 7fb95a278a19e2e617103073ce277949_JaffaCakes118.exe svchost.exe PID 2424 wrote to memory of 1816 2424 7fb95a278a19e2e617103073ce277949_JaffaCakes118.exe svchost.exe PID 2424 wrote to memory of 1816 2424 7fb95a278a19e2e617103073ce277949_JaffaCakes118.exe svchost.exe PID 2424 wrote to memory of 1816 2424 7fb95a278a19e2e617103073ce277949_JaffaCakes118.exe svchost.exe PID 2424 wrote to memory of 1816 2424 7fb95a278a19e2e617103073ce277949_JaffaCakes118.exe svchost.exe PID 2424 wrote to memory of 1816 2424 7fb95a278a19e2e617103073ce277949_JaffaCakes118.exe svchost.exe PID 2424 wrote to memory of 1816 2424 7fb95a278a19e2e617103073ce277949_JaffaCakes118.exe svchost.exe PID 2424 wrote to memory of 1816 2424 7fb95a278a19e2e617103073ce277949_JaffaCakes118.exe svchost.exe PID 2424 wrote to memory of 1816 2424 7fb95a278a19e2e617103073ce277949_JaffaCakes118.exe svchost.exe PID 1816 wrote to memory of 2008 1816 svchost.exe cmd.exe PID 1816 wrote to memory of 2008 1816 svchost.exe cmd.exe PID 1816 wrote to memory of 2008 1816 svchost.exe cmd.exe PID 1816 wrote to memory of 2008 1816 svchost.exe cmd.exe PID 1816 wrote to memory of 2780 1816 svchost.exe cmd.exe PID 1816 wrote to memory of 2780 1816 svchost.exe cmd.exe PID 1816 wrote to memory of 2780 1816 svchost.exe cmd.exe PID 1816 wrote to memory of 2780 1816 svchost.exe cmd.exe PID 1816 wrote to memory of 2784 1816 svchost.exe notepad.exe PID 1816 wrote to memory of 2784 1816 svchost.exe notepad.exe PID 1816 wrote to memory of 2784 1816 svchost.exe notepad.exe PID 1816 wrote to memory of 2784 1816 svchost.exe notepad.exe PID 1816 wrote to memory of 2784 1816 svchost.exe notepad.exe PID 1816 wrote to memory of 2784 1816 svchost.exe notepad.exe PID 1816 wrote to memory of 2784 1816 svchost.exe notepad.exe PID 1816 wrote to memory of 2784 1816 svchost.exe notepad.exe PID 1816 wrote to memory of 2784 1816 svchost.exe notepad.exe PID 1816 wrote to memory of 2784 1816 svchost.exe notepad.exe PID 1816 wrote to memory of 2784 1816 svchost.exe notepad.exe PID 1816 wrote to memory of 2784 1816 svchost.exe notepad.exe PID 1816 wrote to memory of 2784 1816 svchost.exe notepad.exe PID 1816 wrote to memory of 2784 1816 svchost.exe notepad.exe PID 1816 wrote to memory of 2784 1816 svchost.exe notepad.exe PID 1816 wrote to memory of 2784 1816 svchost.exe notepad.exe PID 1816 wrote to memory of 2784 1816 svchost.exe notepad.exe PID 1816 wrote to memory of 2784 1816 svchost.exe notepad.exe PID 2780 wrote to memory of 2560 2780 cmd.exe attrib.exe PID 2780 wrote to memory of 2560 2780 cmd.exe attrib.exe PID 2780 wrote to memory of 2560 2780 cmd.exe attrib.exe PID 2780 wrote to memory of 2560 2780 cmd.exe attrib.exe PID 2008 wrote to memory of 2536 2008 cmd.exe attrib.exe PID 2008 wrote to memory of 2536 2008 cmd.exe attrib.exe PID 2008 wrote to memory of 2536 2008 cmd.exe attrib.exe PID 2008 wrote to memory of 2536 2008 cmd.exe attrib.exe PID 1816 wrote to memory of 1792 1816 svchost.exe msdcsc.exe PID 1816 wrote to memory of 1792 1816 svchost.exe msdcsc.exe PID 1816 wrote to memory of 1792 1816 svchost.exe msdcsc.exe PID 1816 wrote to memory of 1792 1816 svchost.exe msdcsc.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 2536 attrib.exe 2560 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7fb95a278a19e2e617103073ce277949_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\7fb95a278a19e2e617103073ce277949_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\svchost.exe2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\svchost.exe" +s +h3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\svchost.exe" +s +h4⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:2536 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:2560 -
C:\Windows\SysWOW64\notepad.exenotepad3⤵
- System Location Discovery: System Language Discovery
PID:2784 -
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1792
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
31KB
MD5ed797d8dc2c92401985d162e42ffa450
SHA10f02fc517c7facc4baefde4fe9467fb6488ebabe
SHA256b746362010a101cb5931bc066f0f4d3fc740c02a68c1f37fc3c8e6c87fd7cb1e
SHA512e831a6ff987f3ef29982da16afad06938b68eddd43c234ba88d1c96a1b5547f2284baf35cbb3a5bfd75e7f0445d14daa014e0ba00b4db72c67f83f0a314c80c2