Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
02/11/2024, 20:55
Behavioral task
behavioral1
Sample
87b1557a6486ef0dad75b2d9f4b9ec86_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
87b1557a6486ef0dad75b2d9f4b9ec86_JaffaCakes118.exe
-
Size
253KB
-
MD5
87b1557a6486ef0dad75b2d9f4b9ec86
-
SHA1
1daf68ee5f08ef0c0f55b4b6a799440dc175281b
-
SHA256
e35661892e57a9dcf8fd0d99eaa61422ca765a68a52ef60d12df488321800a2e
-
SHA512
3bb7412f12dbf3e463d31d503ed74a6d9d3ee6bd229a826849c88f1c9d2551300f1330952d413f2cb0dfc3aeb7e7e5f16a33a8e8b8f9bf0ebef099e2d5398e1c
-
SSDEEP
6144:XD7cY2fgssM7Wirg9KXylmRiL+QMeC/i6isqX7UovnONztByipwxZ:Xl8E4w5huat7UovONzbXw
Malware Config
Extracted
darkcomet
Guest16
sameg.no-ip.biz:1604
DC_MUTEX-F54S21D
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
QrEhKkKT5N4s
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Darkcomet family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 87b1557a6486ef0dad75b2d9f4b9ec86_JaffaCakes118.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 87b1557a6486ef0dad75b2d9f4b9ec86_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 3132 msdcsc.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 87b1557a6486ef0dad75b2d9f4b9ec86_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" msdcsc.exe -
resource yara_rule behavioral2/memory/3896-0-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral2/files/0x0007000000023cb1-6.dat upx behavioral2/memory/3132-63-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral2/memory/3896-65-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral2/memory/3132-67-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral2/memory/3132-68-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral2/memory/3132-69-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral2/memory/3132-70-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral2/memory/3132-72-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral2/memory/3132-74-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral2/memory/3132-76-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral2/memory/3132-77-0x0000000000400000-0x00000000004BA000-memory.dmp upx behavioral2/memory/3132-81-0x0000000000400000-0x00000000004BA000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87b1557a6486ef0dad75b2d9f4b9ec86_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdcsc.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 87b1557a6486ef0dad75b2d9f4b9ec86_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3896 87b1557a6486ef0dad75b2d9f4b9ec86_JaffaCakes118.exe Token: SeSecurityPrivilege 3896 87b1557a6486ef0dad75b2d9f4b9ec86_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 3896 87b1557a6486ef0dad75b2d9f4b9ec86_JaffaCakes118.exe Token: SeLoadDriverPrivilege 3896 87b1557a6486ef0dad75b2d9f4b9ec86_JaffaCakes118.exe Token: SeSystemProfilePrivilege 3896 87b1557a6486ef0dad75b2d9f4b9ec86_JaffaCakes118.exe Token: SeSystemtimePrivilege 3896 87b1557a6486ef0dad75b2d9f4b9ec86_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 3896 87b1557a6486ef0dad75b2d9f4b9ec86_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 3896 87b1557a6486ef0dad75b2d9f4b9ec86_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 3896 87b1557a6486ef0dad75b2d9f4b9ec86_JaffaCakes118.exe Token: SeBackupPrivilege 3896 87b1557a6486ef0dad75b2d9f4b9ec86_JaffaCakes118.exe Token: SeRestorePrivilege 3896 87b1557a6486ef0dad75b2d9f4b9ec86_JaffaCakes118.exe Token: SeShutdownPrivilege 3896 87b1557a6486ef0dad75b2d9f4b9ec86_JaffaCakes118.exe Token: SeDebugPrivilege 3896 87b1557a6486ef0dad75b2d9f4b9ec86_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 3896 87b1557a6486ef0dad75b2d9f4b9ec86_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 3896 87b1557a6486ef0dad75b2d9f4b9ec86_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 3896 87b1557a6486ef0dad75b2d9f4b9ec86_JaffaCakes118.exe Token: SeUndockPrivilege 3896 87b1557a6486ef0dad75b2d9f4b9ec86_JaffaCakes118.exe Token: SeManageVolumePrivilege 3896 87b1557a6486ef0dad75b2d9f4b9ec86_JaffaCakes118.exe Token: SeImpersonatePrivilege 3896 87b1557a6486ef0dad75b2d9f4b9ec86_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 3896 87b1557a6486ef0dad75b2d9f4b9ec86_JaffaCakes118.exe Token: 33 3896 87b1557a6486ef0dad75b2d9f4b9ec86_JaffaCakes118.exe Token: 34 3896 87b1557a6486ef0dad75b2d9f4b9ec86_JaffaCakes118.exe Token: 35 3896 87b1557a6486ef0dad75b2d9f4b9ec86_JaffaCakes118.exe Token: 36 3896 87b1557a6486ef0dad75b2d9f4b9ec86_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 3132 msdcsc.exe Token: SeSecurityPrivilege 3132 msdcsc.exe Token: SeTakeOwnershipPrivilege 3132 msdcsc.exe Token: SeLoadDriverPrivilege 3132 msdcsc.exe Token: SeSystemProfilePrivilege 3132 msdcsc.exe Token: SeSystemtimePrivilege 3132 msdcsc.exe Token: SeProfSingleProcessPrivilege 3132 msdcsc.exe Token: SeIncBasePriorityPrivilege 3132 msdcsc.exe Token: SeCreatePagefilePrivilege 3132 msdcsc.exe Token: SeBackupPrivilege 3132 msdcsc.exe Token: SeRestorePrivilege 3132 msdcsc.exe Token: SeShutdownPrivilege 3132 msdcsc.exe Token: SeDebugPrivilege 3132 msdcsc.exe Token: SeSystemEnvironmentPrivilege 3132 msdcsc.exe Token: SeChangeNotifyPrivilege 3132 msdcsc.exe Token: SeRemoteShutdownPrivilege 3132 msdcsc.exe Token: SeUndockPrivilege 3132 msdcsc.exe Token: SeManageVolumePrivilege 3132 msdcsc.exe Token: SeImpersonatePrivilege 3132 msdcsc.exe Token: SeCreateGlobalPrivilege 3132 msdcsc.exe Token: 33 3132 msdcsc.exe Token: 34 3132 msdcsc.exe Token: 35 3132 msdcsc.exe Token: 36 3132 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3132 msdcsc.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3896 wrote to memory of 3132 3896 87b1557a6486ef0dad75b2d9f4b9ec86_JaffaCakes118.exe 85 PID 3896 wrote to memory of 3132 3896 87b1557a6486ef0dad75b2d9f4b9ec86_JaffaCakes118.exe 85 PID 3896 wrote to memory of 3132 3896 87b1557a6486ef0dad75b2d9f4b9ec86_JaffaCakes118.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\87b1557a6486ef0dad75b2d9f4b9ec86_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\87b1557a6486ef0dad75b2d9f4b9ec86_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3132
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
253KB
MD587b1557a6486ef0dad75b2d9f4b9ec86
SHA11daf68ee5f08ef0c0f55b4b6a799440dc175281b
SHA256e35661892e57a9dcf8fd0d99eaa61422ca765a68a52ef60d12df488321800a2e
SHA5123bb7412f12dbf3e463d31d503ed74a6d9d3ee6bd229a826849c88f1c9d2551300f1330952d413f2cb0dfc3aeb7e7e5f16a33a8e8b8f9bf0ebef099e2d5398e1c