Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29-11-2024 18:25
Behavioral task
behavioral1
Sample
b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe
-
Size
894KB
-
MD5
b30d655aefc52618b2a7e6e3e13de11f
-
SHA1
4ed6181c465ee67cc86af3abbfd8f98aa4be009b
-
SHA256
131b8c954a6dda5275a42067ad1c60e71b0c9c192281eb81b11ef68865f08a75
-
SHA512
58909a6ecb983ef4bcfff1598986a03cacc157f0b1e83d5222fa9cc5afdb2b214cde9ce04af3f655c1f28c7860a2b967df326c655459e7d331a5d3919f51272f
-
SSDEEP
12288:89HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hK3cwgBb:QZ1xuVVjfFoynPaVBUR8f+kN10EBvv
Malware Config
Extracted
darkcomet
windowscvtrell
anonymedeskype81.zapto.org:1500
DC_MUTEX-BU1D65U
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
2HVjF5Bcnmu5
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
windowscvtrell
Extracted
latentbot
anonymedeskype81.zapto.org
Signatures
-
Darkcomet family
-
Latentbot family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\MSDCSC\\msdcsc.exe" b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 2684 attrib.exe 2676 attrib.exe -
Deletes itself 1 IoCs
pid Process 2452 notepad.exe -
Executes dropped EXE 1 IoCs
pid Process 2716 msdcsc.exe -
Loads dropped DLL 2 IoCs
pid Process 2528 b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe 2528 b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\windowscvtrell = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\MSDCSC\\msdcsc.exe" b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdcsc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2716 msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2528 b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe Token: SeSecurityPrivilege 2528 b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 2528 b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe Token: SeLoadDriverPrivilege 2528 b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe Token: SeSystemProfilePrivilege 2528 b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe Token: SeSystemtimePrivilege 2528 b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 2528 b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2528 b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 2528 b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe Token: SeBackupPrivilege 2528 b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe Token: SeRestorePrivilege 2528 b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe Token: SeShutdownPrivilege 2528 b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe Token: SeDebugPrivilege 2528 b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 2528 b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 2528 b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 2528 b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe Token: SeUndockPrivilege 2528 b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe Token: SeManageVolumePrivilege 2528 b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe Token: SeImpersonatePrivilege 2528 b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 2528 b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe Token: 33 2528 b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe Token: 34 2528 b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe Token: 35 2528 b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 2716 msdcsc.exe Token: SeSecurityPrivilege 2716 msdcsc.exe Token: SeTakeOwnershipPrivilege 2716 msdcsc.exe Token: SeLoadDriverPrivilege 2716 msdcsc.exe Token: SeSystemProfilePrivilege 2716 msdcsc.exe Token: SeSystemtimePrivilege 2716 msdcsc.exe Token: SeProfSingleProcessPrivilege 2716 msdcsc.exe Token: SeIncBasePriorityPrivilege 2716 msdcsc.exe Token: SeCreatePagefilePrivilege 2716 msdcsc.exe Token: SeBackupPrivilege 2716 msdcsc.exe Token: SeRestorePrivilege 2716 msdcsc.exe Token: SeShutdownPrivilege 2716 msdcsc.exe Token: SeDebugPrivilege 2716 msdcsc.exe Token: SeSystemEnvironmentPrivilege 2716 msdcsc.exe Token: SeChangeNotifyPrivilege 2716 msdcsc.exe Token: SeRemoteShutdownPrivilege 2716 msdcsc.exe Token: SeUndockPrivilege 2716 msdcsc.exe Token: SeManageVolumePrivilege 2716 msdcsc.exe Token: SeImpersonatePrivilege 2716 msdcsc.exe Token: SeCreateGlobalPrivilege 2716 msdcsc.exe Token: 33 2716 msdcsc.exe Token: 34 2716 msdcsc.exe Token: 35 2716 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2716 msdcsc.exe -
Suspicious use of WriteProcessMemory 61 IoCs
description pid Process procid_target PID 2528 wrote to memory of 1536 2528 b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe 30 PID 2528 wrote to memory of 1536 2528 b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe 30 PID 2528 wrote to memory of 1536 2528 b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe 30 PID 2528 wrote to memory of 1536 2528 b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe 30 PID 2528 wrote to memory of 1400 2528 b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe 32 PID 2528 wrote to memory of 1400 2528 b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe 32 PID 2528 wrote to memory of 1400 2528 b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe 32 PID 2528 wrote to memory of 1400 2528 b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe 32 PID 2528 wrote to memory of 2452 2528 b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe 33 PID 2528 wrote to memory of 2452 2528 b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe 33 PID 2528 wrote to memory of 2452 2528 b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe 33 PID 2528 wrote to memory of 2452 2528 b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe 33 PID 2528 wrote to memory of 2452 2528 b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe 33 PID 2528 wrote to memory of 2452 2528 b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe 33 PID 2528 wrote to memory of 2452 2528 b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe 33 PID 2528 wrote to memory of 2452 2528 b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe 33 PID 2528 wrote to memory of 2452 2528 b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe 33 PID 2528 wrote to memory of 2452 2528 b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe 33 PID 2528 wrote to memory of 2452 2528 b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe 33 PID 2528 wrote to memory of 2452 2528 b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe 33 PID 2528 wrote to memory of 2452 2528 b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe 33 PID 2528 wrote to memory of 2452 2528 b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe 33 PID 2528 wrote to memory of 2452 2528 b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe 33 PID 2528 wrote to memory of 2452 2528 b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe 33 PID 2528 wrote to memory of 2452 2528 b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe 33 PID 2528 wrote to memory of 2452 2528 b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe 33 PID 2528 wrote to memory of 2716 2528 b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe 35 PID 2528 wrote to memory of 2716 2528 b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe 35 PID 2528 wrote to memory of 2716 2528 b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe 35 PID 2528 wrote to memory of 2716 2528 b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe 35 PID 2716 wrote to memory of 2768 2716 msdcsc.exe 36 PID 2716 wrote to memory of 2768 2716 msdcsc.exe 36 PID 2716 wrote to memory of 2768 2716 msdcsc.exe 36 PID 2716 wrote to memory of 2768 2716 msdcsc.exe 36 PID 2716 wrote to memory of 2768 2716 msdcsc.exe 36 PID 2716 wrote to memory of 2768 2716 msdcsc.exe 36 PID 2716 wrote to memory of 2768 2716 msdcsc.exe 36 PID 2716 wrote to memory of 2768 2716 msdcsc.exe 36 PID 2716 wrote to memory of 2768 2716 msdcsc.exe 36 PID 2716 wrote to memory of 2768 2716 msdcsc.exe 36 PID 2716 wrote to memory of 2768 2716 msdcsc.exe 36 PID 2716 wrote to memory of 2768 2716 msdcsc.exe 36 PID 2716 wrote to memory of 2768 2716 msdcsc.exe 36 PID 2716 wrote to memory of 2768 2716 msdcsc.exe 36 PID 2716 wrote to memory of 2768 2716 msdcsc.exe 36 PID 2716 wrote to memory of 2768 2716 msdcsc.exe 36 PID 2716 wrote to memory of 2768 2716 msdcsc.exe 36 PID 2716 wrote to memory of 2768 2716 msdcsc.exe 36 PID 2716 wrote to memory of 2768 2716 msdcsc.exe 36 PID 2716 wrote to memory of 2768 2716 msdcsc.exe 36 PID 2716 wrote to memory of 2768 2716 msdcsc.exe 36 PID 2716 wrote to memory of 2768 2716 msdcsc.exe 36 PID 2716 wrote to memory of 2768 2716 msdcsc.exe 36 PID 1400 wrote to memory of 2676 1400 cmd.exe 37 PID 1400 wrote to memory of 2676 1400 cmd.exe 37 PID 1400 wrote to memory of 2676 1400 cmd.exe 37 PID 1400 wrote to memory of 2676 1400 cmd.exe 37 PID 1536 wrote to memory of 2684 1536 cmd.exe 38 PID 1536 wrote to memory of 2684 1536 cmd.exe 38 PID 1536 wrote to memory of 2684 1536 cmd.exe 38 PID 1536 wrote to memory of 2684 1536 cmd.exe 38 -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 2676 attrib.exe 2684 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe" +s +h2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\b30d655aefc52618b2a7e6e3e13de11f_JaffaCakes118.exe" +s +h3⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:2684
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:2676
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2452
-
-
C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe"C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe"2⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\notepad.exenotepad3⤵
- System Location Discovery: System Language Discovery
PID:2768
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
894KB
MD5b30d655aefc52618b2a7e6e3e13de11f
SHA14ed6181c465ee67cc86af3abbfd8f98aa4be009b
SHA256131b8c954a6dda5275a42067ad1c60e71b0c9c192281eb81b11ef68865f08a75
SHA51258909a6ecb983ef4bcfff1598986a03cacc157f0b1e83d5222fa9cc5afdb2b214cde9ce04af3f655c1f28c7860a2b967df326c655459e7d331a5d3919f51272f