Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-12-2024 04:52
Behavioral task
behavioral1
Sample
dd161950cedcff2b3d9cd6ccfdc733c9_JaffaCakes118.exe
Resource
win7-20241010-en
General
-
Target
dd161950cedcff2b3d9cd6ccfdc733c9_JaffaCakes118.exe
-
Size
658KB
-
MD5
dd161950cedcff2b3d9cd6ccfdc733c9
-
SHA1
83954fbf59bcf676268873596475189e5fa553c5
-
SHA256
a06ed2d7d98fc8ae6887bb0245e4d714797a2074226e205e4c509d68a5e4d51f
-
SHA512
0be589811e806c31b1e672fa3b41d9824683a2b6f92435deca9fba6e0ccc5a1471a2cdf70d5d53136a1d337159ebaa3e2c9c2c164102304d6e3c2ba43b1a1594
-
SSDEEP
12288:+9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hB:KZ1xuVVjfFoynPaVBUR8f+kN10EBH
Malware Config
Extracted
darkcomet
Test1UC
dast1nga.no-ip.org:1605
DC_MUTEX-YN7Z46U
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
a7HexTPYGlvQ
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Darkcomet family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" dd161950cedcff2b3d9cd6ccfdc733c9_JaffaCakes118.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 3844 attrib.exe 2920 attrib.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation dd161950cedcff2b3d9cd6ccfdc733c9_JaffaCakes118.exe -
Executes dropped EXE 1 IoCs
pid Process 1444 msdcsc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" dd161950cedcff2b3d9cd6ccfdc733c9_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" msdcsc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dd161950cedcff2b3d9cd6ccfdc733c9_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdcsc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ dd161950cedcff2b3d9cd6ccfdc733c9_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1444 msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1908 dd161950cedcff2b3d9cd6ccfdc733c9_JaffaCakes118.exe Token: SeSecurityPrivilege 1908 dd161950cedcff2b3d9cd6ccfdc733c9_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 1908 dd161950cedcff2b3d9cd6ccfdc733c9_JaffaCakes118.exe Token: SeLoadDriverPrivilege 1908 dd161950cedcff2b3d9cd6ccfdc733c9_JaffaCakes118.exe Token: SeSystemProfilePrivilege 1908 dd161950cedcff2b3d9cd6ccfdc733c9_JaffaCakes118.exe Token: SeSystemtimePrivilege 1908 dd161950cedcff2b3d9cd6ccfdc733c9_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 1908 dd161950cedcff2b3d9cd6ccfdc733c9_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1908 dd161950cedcff2b3d9cd6ccfdc733c9_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 1908 dd161950cedcff2b3d9cd6ccfdc733c9_JaffaCakes118.exe Token: SeBackupPrivilege 1908 dd161950cedcff2b3d9cd6ccfdc733c9_JaffaCakes118.exe Token: SeRestorePrivilege 1908 dd161950cedcff2b3d9cd6ccfdc733c9_JaffaCakes118.exe Token: SeShutdownPrivilege 1908 dd161950cedcff2b3d9cd6ccfdc733c9_JaffaCakes118.exe Token: SeDebugPrivilege 1908 dd161950cedcff2b3d9cd6ccfdc733c9_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 1908 dd161950cedcff2b3d9cd6ccfdc733c9_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 1908 dd161950cedcff2b3d9cd6ccfdc733c9_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 1908 dd161950cedcff2b3d9cd6ccfdc733c9_JaffaCakes118.exe Token: SeUndockPrivilege 1908 dd161950cedcff2b3d9cd6ccfdc733c9_JaffaCakes118.exe Token: SeManageVolumePrivilege 1908 dd161950cedcff2b3d9cd6ccfdc733c9_JaffaCakes118.exe Token: SeImpersonatePrivilege 1908 dd161950cedcff2b3d9cd6ccfdc733c9_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 1908 dd161950cedcff2b3d9cd6ccfdc733c9_JaffaCakes118.exe Token: 33 1908 dd161950cedcff2b3d9cd6ccfdc733c9_JaffaCakes118.exe Token: 34 1908 dd161950cedcff2b3d9cd6ccfdc733c9_JaffaCakes118.exe Token: 35 1908 dd161950cedcff2b3d9cd6ccfdc733c9_JaffaCakes118.exe Token: 36 1908 dd161950cedcff2b3d9cd6ccfdc733c9_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 1444 msdcsc.exe Token: SeSecurityPrivilege 1444 msdcsc.exe Token: SeTakeOwnershipPrivilege 1444 msdcsc.exe Token: SeLoadDriverPrivilege 1444 msdcsc.exe Token: SeSystemProfilePrivilege 1444 msdcsc.exe Token: SeSystemtimePrivilege 1444 msdcsc.exe Token: SeProfSingleProcessPrivilege 1444 msdcsc.exe Token: SeIncBasePriorityPrivilege 1444 msdcsc.exe Token: SeCreatePagefilePrivilege 1444 msdcsc.exe Token: SeBackupPrivilege 1444 msdcsc.exe Token: SeRestorePrivilege 1444 msdcsc.exe Token: SeShutdownPrivilege 1444 msdcsc.exe Token: SeDebugPrivilege 1444 msdcsc.exe Token: SeSystemEnvironmentPrivilege 1444 msdcsc.exe Token: SeChangeNotifyPrivilege 1444 msdcsc.exe Token: SeRemoteShutdownPrivilege 1444 msdcsc.exe Token: SeUndockPrivilege 1444 msdcsc.exe Token: SeManageVolumePrivilege 1444 msdcsc.exe Token: SeImpersonatePrivilege 1444 msdcsc.exe Token: SeCreateGlobalPrivilege 1444 msdcsc.exe Token: 33 1444 msdcsc.exe Token: 34 1444 msdcsc.exe Token: 35 1444 msdcsc.exe Token: 36 1444 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1444 msdcsc.exe -
Suspicious use of WriteProcessMemory 37 IoCs
description pid Process procid_target PID 1908 wrote to memory of 2388 1908 dd161950cedcff2b3d9cd6ccfdc733c9_JaffaCakes118.exe 82 PID 1908 wrote to memory of 2388 1908 dd161950cedcff2b3d9cd6ccfdc733c9_JaffaCakes118.exe 82 PID 1908 wrote to memory of 2388 1908 dd161950cedcff2b3d9cd6ccfdc733c9_JaffaCakes118.exe 82 PID 1908 wrote to memory of 3192 1908 dd161950cedcff2b3d9cd6ccfdc733c9_JaffaCakes118.exe 84 PID 1908 wrote to memory of 3192 1908 dd161950cedcff2b3d9cd6ccfdc733c9_JaffaCakes118.exe 84 PID 1908 wrote to memory of 3192 1908 dd161950cedcff2b3d9cd6ccfdc733c9_JaffaCakes118.exe 84 PID 2388 wrote to memory of 3844 2388 cmd.exe 86 PID 2388 wrote to memory of 3844 2388 cmd.exe 86 PID 2388 wrote to memory of 3844 2388 cmd.exe 86 PID 3192 wrote to memory of 2920 3192 cmd.exe 87 PID 3192 wrote to memory of 2920 3192 cmd.exe 87 PID 3192 wrote to memory of 2920 3192 cmd.exe 87 PID 1908 wrote to memory of 1444 1908 dd161950cedcff2b3d9cd6ccfdc733c9_JaffaCakes118.exe 88 PID 1908 wrote to memory of 1444 1908 dd161950cedcff2b3d9cd6ccfdc733c9_JaffaCakes118.exe 88 PID 1908 wrote to memory of 1444 1908 dd161950cedcff2b3d9cd6ccfdc733c9_JaffaCakes118.exe 88 PID 1444 wrote to memory of 1760 1444 msdcsc.exe 89 PID 1444 wrote to memory of 1760 1444 msdcsc.exe 89 PID 1444 wrote to memory of 1760 1444 msdcsc.exe 89 PID 1444 wrote to memory of 1760 1444 msdcsc.exe 89 PID 1444 wrote to memory of 1760 1444 msdcsc.exe 89 PID 1444 wrote to memory of 1760 1444 msdcsc.exe 89 PID 1444 wrote to memory of 1760 1444 msdcsc.exe 89 PID 1444 wrote to memory of 1760 1444 msdcsc.exe 89 PID 1444 wrote to memory of 1760 1444 msdcsc.exe 89 PID 1444 wrote to memory of 1760 1444 msdcsc.exe 89 PID 1444 wrote to memory of 1760 1444 msdcsc.exe 89 PID 1444 wrote to memory of 1760 1444 msdcsc.exe 89 PID 1444 wrote to memory of 1760 1444 msdcsc.exe 89 PID 1444 wrote to memory of 1760 1444 msdcsc.exe 89 PID 1444 wrote to memory of 1760 1444 msdcsc.exe 89 PID 1444 wrote to memory of 1760 1444 msdcsc.exe 89 PID 1444 wrote to memory of 1760 1444 msdcsc.exe 89 PID 1444 wrote to memory of 1760 1444 msdcsc.exe 89 PID 1444 wrote to memory of 1760 1444 msdcsc.exe 89 PID 1444 wrote to memory of 1760 1444 msdcsc.exe 89 PID 1444 wrote to memory of 1760 1444 msdcsc.exe 89 PID 1444 wrote to memory of 1760 1444 msdcsc.exe 89 -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 3844 attrib.exe 2920 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd161950cedcff2b3d9cd6ccfdc733c9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\dd161950cedcff2b3d9cd6ccfdc733c9_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\dd161950cedcff2b3d9cd6ccfdc733c9_JaffaCakes118.exe" +s +h2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\dd161950cedcff2b3d9cd6ccfdc733c9_JaffaCakes118.exe" +s +h3⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:3844
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:2920
-
-
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\SysWOW64\notepad.exenotepad3⤵
- System Location Discovery: System Language Discovery
PID:1760
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
658KB
MD5dd161950cedcff2b3d9cd6ccfdc733c9
SHA183954fbf59bcf676268873596475189e5fa553c5
SHA256a06ed2d7d98fc8ae6887bb0245e4d714797a2074226e205e4c509d68a5e4d51f
SHA5120be589811e806c31b1e672fa3b41d9824683a2b6f92435deca9fba6e0ccc5a1471a2cdf70d5d53136a1d337159ebaa3e2c9c2c164102304d6e3c2ba43b1a1594