Analysis
-
max time kernel
150s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
19-10-2024 09:39
Behavioral task
behavioral1
Sample
5c0106271bdbd29ee14f145d87caa082_JaffaCakes118.exe
Resource
win7-20241010-en
windows7-x64
12 signatures
150 seconds
General
-
Target
5c0106271bdbd29ee14f145d87caa082_JaffaCakes118.exe
-
Size
280KB
-
MD5
5c0106271bdbd29ee14f145d87caa082
-
SHA1
5e758d47f5fd4c8f6eb2fc1c039bc6d72e6241b9
-
SHA256
cacddf660daa544ed10b229c985b88e987b611bd5528b4bdb526809901cab5be
-
SHA512
a2fbb5511cbb31285019e6c0e23a021919026314fb32ba07a8d0318353d74ed5b6c510c7e186464513e56fe3078cc7b8a65c2f3499d104da05d6b915abf2025c
-
SSDEEP
6144:iwT5O7pJmNB6dLY6dCnnsyZLHoaIyv6ocU/qxDS2xDWb3cwEw4:iP+NULZdCn3TbncU2D7Ab3n4
Malware Config
Extracted
Family
darkcomet
Botnet
Victim
C2
ganjalife.no-ip.biz:1452
Mutex
DC_MUTEX-JLZHKUJ
Attributes
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
5sqvqmXgCKct
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
5c0106271bdbd29ee14f145d87caa082_JaffaCakes118.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 5c0106271bdbd29ee14f145d87caa082_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid Process 2440 msdcsc.exe -
Loads dropped DLL 2 IoCs
Processes:
5c0106271bdbd29ee14f145d87caa082_JaffaCakes118.exepid Process 2412 5c0106271bdbd29ee14f145d87caa082_JaffaCakes118.exe 2412 5c0106271bdbd29ee14f145d87caa082_JaffaCakes118.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
5c0106271bdbd29ee14f145d87caa082_JaffaCakes118.exemsdcsc.exeiexplore.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 5c0106271bdbd29ee14f145d87caa082_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" iexplore.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
msdcsc.exedescription pid Process procid_target PID 2440 set thread context of 2848 2440 msdcsc.exe 30 -
Processes:
resource yara_rule behavioral1/memory/2412-0-0x0000000000400000-0x00000000004C5000-memory.dmp upx behavioral1/files/0x0009000000016cd8-7.dat upx behavioral1/memory/2440-16-0x0000000000400000-0x00000000004C5000-memory.dmp upx behavioral1/memory/2412-14-0x0000000000400000-0x00000000004C5000-memory.dmp upx behavioral1/memory/2848-18-0x0000000000400000-0x00000000004C5000-memory.dmp upx behavioral1/memory/2440-20-0x0000000000400000-0x00000000004C5000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
5c0106271bdbd29ee14f145d87caa082_JaffaCakes118.exemsdcsc.exeiexplore.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5c0106271bdbd29ee14f145d87caa082_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdcsc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
5c0106271bdbd29ee14f145d87caa082_JaffaCakes118.exemsdcsc.exeiexplore.exedescription pid Process Token: SeIncreaseQuotaPrivilege 2412 5c0106271bdbd29ee14f145d87caa082_JaffaCakes118.exe Token: SeSecurityPrivilege 2412 5c0106271bdbd29ee14f145d87caa082_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2412 5c0106271bdbd29ee14f145d87caa082_JaffaCakes118.exe Token: SeLoadDriverPrivilege 2412 5c0106271bdbd29ee14f145d87caa082_JaffaCakes118.exe Token: SeSystemProfilePrivilege 2412 5c0106271bdbd29ee14f145d87caa082_JaffaCakes118.exe Token: SeSystemtimePrivilege 2412 5c0106271bdbd29ee14f145d87caa082_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 2412 5c0106271bdbd29ee14f145d87caa082_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2412 5c0106271bdbd29ee14f145d87caa082_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 2412 5c0106271bdbd29ee14f145d87caa082_JaffaCakes118.exe Token: SeBackupPrivilege 2412 5c0106271bdbd29ee14f145d87caa082_JaffaCakes118.exe Token: SeRestorePrivilege 2412 5c0106271bdbd29ee14f145d87caa082_JaffaCakes118.exe Token: SeShutdownPrivilege 2412 5c0106271bdbd29ee14f145d87caa082_JaffaCakes118.exe Token: SeDebugPrivilege 2412 5c0106271bdbd29ee14f145d87caa082_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 2412 5c0106271bdbd29ee14f145d87caa082_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 2412 5c0106271bdbd29ee14f145d87caa082_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 2412 5c0106271bdbd29ee14f145d87caa082_JaffaCakes118.exe Token: SeUndockPrivilege 2412 5c0106271bdbd29ee14f145d87caa082_JaffaCakes118.exe Token: SeManageVolumePrivilege 2412 5c0106271bdbd29ee14f145d87caa082_JaffaCakes118.exe Token: SeImpersonatePrivilege 2412 5c0106271bdbd29ee14f145d87caa082_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 2412 5c0106271bdbd29ee14f145d87caa082_JaffaCakes118.exe Token: 33 2412 5c0106271bdbd29ee14f145d87caa082_JaffaCakes118.exe Token: 34 2412 5c0106271bdbd29ee14f145d87caa082_JaffaCakes118.exe Token: 35 2412 5c0106271bdbd29ee14f145d87caa082_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 2440 msdcsc.exe Token: SeSecurityPrivilege 2440 msdcsc.exe Token: SeTakeOwnershipPrivilege 2440 msdcsc.exe Token: SeLoadDriverPrivilege 2440 msdcsc.exe Token: SeSystemProfilePrivilege 2440 msdcsc.exe Token: SeSystemtimePrivilege 2440 msdcsc.exe Token: SeProfSingleProcessPrivilege 2440 msdcsc.exe Token: SeIncBasePriorityPrivilege 2440 msdcsc.exe Token: SeCreatePagefilePrivilege 2440 msdcsc.exe Token: SeBackupPrivilege 2440 msdcsc.exe Token: SeRestorePrivilege 2440 msdcsc.exe Token: SeShutdownPrivilege 2440 msdcsc.exe Token: SeDebugPrivilege 2440 msdcsc.exe Token: SeSystemEnvironmentPrivilege 2440 msdcsc.exe Token: SeChangeNotifyPrivilege 2440 msdcsc.exe Token: SeRemoteShutdownPrivilege 2440 msdcsc.exe Token: SeUndockPrivilege 2440 msdcsc.exe Token: SeManageVolumePrivilege 2440 msdcsc.exe Token: SeImpersonatePrivilege 2440 msdcsc.exe Token: SeCreateGlobalPrivilege 2440 msdcsc.exe Token: 33 2440 msdcsc.exe Token: 34 2440 msdcsc.exe Token: 35 2440 msdcsc.exe Token: SeIncreaseQuotaPrivilege 2848 iexplore.exe Token: SeSecurityPrivilege 2848 iexplore.exe Token: SeTakeOwnershipPrivilege 2848 iexplore.exe Token: SeLoadDriverPrivilege 2848 iexplore.exe Token: SeSystemProfilePrivilege 2848 iexplore.exe Token: SeSystemtimePrivilege 2848 iexplore.exe Token: SeProfSingleProcessPrivilege 2848 iexplore.exe Token: SeIncBasePriorityPrivilege 2848 iexplore.exe Token: SeCreatePagefilePrivilege 2848 iexplore.exe Token: SeBackupPrivilege 2848 iexplore.exe Token: SeRestorePrivilege 2848 iexplore.exe Token: SeShutdownPrivilege 2848 iexplore.exe Token: SeDebugPrivilege 2848 iexplore.exe Token: SeSystemEnvironmentPrivilege 2848 iexplore.exe Token: SeChangeNotifyPrivilege 2848 iexplore.exe Token: SeRemoteShutdownPrivilege 2848 iexplore.exe Token: SeUndockPrivilege 2848 iexplore.exe Token: SeManageVolumePrivilege 2848 iexplore.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
iexplore.exepid Process 2848 iexplore.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
5c0106271bdbd29ee14f145d87caa082_JaffaCakes118.exemsdcsc.exedescription pid Process procid_target PID 2412 wrote to memory of 2440 2412 5c0106271bdbd29ee14f145d87caa082_JaffaCakes118.exe 29 PID 2412 wrote to memory of 2440 2412 5c0106271bdbd29ee14f145d87caa082_JaffaCakes118.exe 29 PID 2412 wrote to memory of 2440 2412 5c0106271bdbd29ee14f145d87caa082_JaffaCakes118.exe 29 PID 2412 wrote to memory of 2440 2412 5c0106271bdbd29ee14f145d87caa082_JaffaCakes118.exe 29 PID 2440 wrote to memory of 2848 2440 msdcsc.exe 30 PID 2440 wrote to memory of 2848 2440 msdcsc.exe 30 PID 2440 wrote to memory of 2848 2440 msdcsc.exe 30 PID 2440 wrote to memory of 2848 2440 msdcsc.exe 30 PID 2440 wrote to memory of 2848 2440 msdcsc.exe 30 PID 2440 wrote to memory of 2848 2440 msdcsc.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c0106271bdbd29ee14f145d87caa082_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5c0106271bdbd29ee14f145d87caa082_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2848
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
280KB
MD55c0106271bdbd29ee14f145d87caa082
SHA15e758d47f5fd4c8f6eb2fc1c039bc6d72e6241b9
SHA256cacddf660daa544ed10b229c985b88e987b611bd5528b4bdb526809901cab5be
SHA512a2fbb5511cbb31285019e6c0e23a021919026314fb32ba07a8d0318353d74ed5b6c510c7e186464513e56fe3078cc7b8a65c2f3499d104da05d6b915abf2025c