Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-12-2024 00:17
Static task
static1
Behavioral task
behavioral1
Sample
dc27eceaf210841183bb41d174d82703_JaffaCakes118.exe
Resource
win7-20240729-en
General
-
Target
dc27eceaf210841183bb41d174d82703_JaffaCakes118.exe
-
Size
806KB
-
MD5
dc27eceaf210841183bb41d174d82703
-
SHA1
3168822dae81eec0db1717de9eaeb8b815342b39
-
SHA256
57a1236800a5aed6cb19fdbacddf7690879e7089a3a4e53e69914a881deeee9d
-
SHA512
42bfb70ce62522e95e9c3c1a6cd6e1488d7044a94a017ae4bd1ed6ba7e3858f987a4d48bb40f412501918639b83c14e9544a8acceb7fb7eda377e8a4d8b582a2
-
SSDEEP
12288:vYUAPSGPXu8BFlemZpYZ0RKYrb/FGLzj2Ev7CQGuXMgpTYnsqhAiuwW:mSSuO1MZ0B/F4muXbpE+tr
Malware Config
Signatures
-
Darkcomet family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" Crypted.exe -
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" msdcsc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile iexplore.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" iexplore.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" iexplore.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" msdcsc.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 1992 attrib.exe 764 attrib.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation dc27eceaf210841183bb41d174d82703_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation Crypted.exe -
Executes dropped EXE 2 IoCs
pid Process 4744 Crypted.exe 5080 msdcsc.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" Crypted.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" iexplore.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 5080 set thread context of 4472 5080 msdcsc.exe 94 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Crypted.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdcsc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 3696 cmd.exe 3164 PING.EXE -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Crypted.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3164 PING.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4472 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4744 Crypted.exe Token: SeSecurityPrivilege 4744 Crypted.exe Token: SeTakeOwnershipPrivilege 4744 Crypted.exe Token: SeLoadDriverPrivilege 4744 Crypted.exe Token: SeSystemProfilePrivilege 4744 Crypted.exe Token: SeSystemtimePrivilege 4744 Crypted.exe Token: SeProfSingleProcessPrivilege 4744 Crypted.exe Token: SeIncBasePriorityPrivilege 4744 Crypted.exe Token: SeCreatePagefilePrivilege 4744 Crypted.exe Token: SeBackupPrivilege 4744 Crypted.exe Token: SeRestorePrivilege 4744 Crypted.exe Token: SeShutdownPrivilege 4744 Crypted.exe Token: SeDebugPrivilege 4744 Crypted.exe Token: SeSystemEnvironmentPrivilege 4744 Crypted.exe Token: SeChangeNotifyPrivilege 4744 Crypted.exe Token: SeRemoteShutdownPrivilege 4744 Crypted.exe Token: SeUndockPrivilege 4744 Crypted.exe Token: SeManageVolumePrivilege 4744 Crypted.exe Token: SeImpersonatePrivilege 4744 Crypted.exe Token: SeCreateGlobalPrivilege 4744 Crypted.exe Token: 33 4744 Crypted.exe Token: 34 4744 Crypted.exe Token: 35 4744 Crypted.exe Token: 36 4744 Crypted.exe Token: SeIncreaseQuotaPrivilege 5080 msdcsc.exe Token: SeSecurityPrivilege 5080 msdcsc.exe Token: SeTakeOwnershipPrivilege 5080 msdcsc.exe Token: SeLoadDriverPrivilege 5080 msdcsc.exe Token: SeSystemProfilePrivilege 5080 msdcsc.exe Token: SeSystemtimePrivilege 5080 msdcsc.exe Token: SeProfSingleProcessPrivilege 5080 msdcsc.exe Token: SeIncBasePriorityPrivilege 5080 msdcsc.exe Token: SeCreatePagefilePrivilege 5080 msdcsc.exe Token: SeBackupPrivilege 5080 msdcsc.exe Token: SeRestorePrivilege 5080 msdcsc.exe Token: SeShutdownPrivilege 5080 msdcsc.exe Token: SeDebugPrivilege 5080 msdcsc.exe Token: SeSystemEnvironmentPrivilege 5080 msdcsc.exe Token: SeChangeNotifyPrivilege 5080 msdcsc.exe Token: SeRemoteShutdownPrivilege 5080 msdcsc.exe Token: SeUndockPrivilege 5080 msdcsc.exe Token: SeManageVolumePrivilege 5080 msdcsc.exe Token: SeImpersonatePrivilege 5080 msdcsc.exe Token: SeCreateGlobalPrivilege 5080 msdcsc.exe Token: 33 5080 msdcsc.exe Token: 34 5080 msdcsc.exe Token: 35 5080 msdcsc.exe Token: 36 5080 msdcsc.exe Token: SeIncreaseQuotaPrivilege 4472 iexplore.exe Token: SeSecurityPrivilege 4472 iexplore.exe Token: SeTakeOwnershipPrivilege 4472 iexplore.exe Token: SeLoadDriverPrivilege 4472 iexplore.exe Token: SeSystemProfilePrivilege 4472 iexplore.exe Token: SeSystemtimePrivilege 4472 iexplore.exe Token: SeProfSingleProcessPrivilege 4472 iexplore.exe Token: SeIncBasePriorityPrivilege 4472 iexplore.exe Token: SeCreatePagefilePrivilege 4472 iexplore.exe Token: SeBackupPrivilege 4472 iexplore.exe Token: SeRestorePrivilege 4472 iexplore.exe Token: SeShutdownPrivilege 4472 iexplore.exe Token: SeDebugPrivilege 4472 iexplore.exe Token: SeSystemEnvironmentPrivilege 4472 iexplore.exe Token: SeChangeNotifyPrivilege 4472 iexplore.exe Token: SeRemoteShutdownPrivilege 4472 iexplore.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4472 iexplore.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 4932 wrote to memory of 4744 4932 dc27eceaf210841183bb41d174d82703_JaffaCakes118.exe 83 PID 4932 wrote to memory of 4744 4932 dc27eceaf210841183bb41d174d82703_JaffaCakes118.exe 83 PID 4932 wrote to memory of 4744 4932 dc27eceaf210841183bb41d174d82703_JaffaCakes118.exe 83 PID 4744 wrote to memory of 4384 4744 Crypted.exe 84 PID 4744 wrote to memory of 4384 4744 Crypted.exe 84 PID 4744 wrote to memory of 4384 4744 Crypted.exe 84 PID 4744 wrote to memory of 372 4744 Crypted.exe 85 PID 4744 wrote to memory of 372 4744 Crypted.exe 85 PID 4744 wrote to memory of 372 4744 Crypted.exe 85 PID 4744 wrote to memory of 3696 4744 Crypted.exe 88 PID 4744 wrote to memory of 3696 4744 Crypted.exe 88 PID 4744 wrote to memory of 3696 4744 Crypted.exe 88 PID 372 wrote to memory of 1992 372 cmd.exe 90 PID 372 wrote to memory of 1992 372 cmd.exe 90 PID 372 wrote to memory of 1992 372 cmd.exe 90 PID 4384 wrote to memory of 764 4384 cmd.exe 91 PID 4384 wrote to memory of 764 4384 cmd.exe 91 PID 4384 wrote to memory of 764 4384 cmd.exe 91 PID 3696 wrote to memory of 3164 3696 cmd.exe 92 PID 3696 wrote to memory of 3164 3696 cmd.exe 92 PID 3696 wrote to memory of 3164 3696 cmd.exe 92 PID 4744 wrote to memory of 5080 4744 Crypted.exe 93 PID 4744 wrote to memory of 5080 4744 Crypted.exe 93 PID 4744 wrote to memory of 5080 4744 Crypted.exe 93 PID 5080 wrote to memory of 4472 5080 msdcsc.exe 94 PID 5080 wrote to memory of 4472 5080 msdcsc.exe 94 PID 5080 wrote to memory of 4472 5080 msdcsc.exe 94 PID 5080 wrote to memory of 4472 5080 msdcsc.exe 94 PID 5080 wrote to memory of 4472 5080 msdcsc.exe 94 -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 1992 attrib.exe 764 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc27eceaf210841183bb41d174d82703_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\dc27eceaf210841183bb41d174d82703_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\Crypted.exe"C:\Users\Admin\AppData\Local\Temp\Crypted.exe"2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\Crypted.exe" +s +h3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\Crypted.exe" +s +h4⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:764
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:1992
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Users\Admin\AppData\Local\Temp\Crypted.exe"3⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 44⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3164
-
-
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"3⤵
- Modifies firewall policy service
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"4⤵
- Modifies firewall policy service
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4472
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
744KB
MD5d6856a3c5fad61d5d8a11ea02db604b6
SHA11812768080f0a9e0dbf376f7c1b3beece18f5747
SHA256ff5cc5d6ca35c5657bc6ac0167107e4490fa6abfe3bb830cdb85df0c7cb0c0c8
SHA51281f110e574660648c77c02305a30a556dd4605a66afe621700cb0b05feb937243bf7c316cb2829fa5012a5374307bc0207859e545822c8d1ca19360ff79632e2