Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-12-2024 08:01
Behavioral task
behavioral1
Sample
eaa3e99c14f2a6c77f1991ba4132b1f1_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
eaa3e99c14f2a6c77f1991ba4132b1f1_JaffaCakes118.exe
-
Size
374KB
-
MD5
eaa3e99c14f2a6c77f1991ba4132b1f1
-
SHA1
1bb5481c627e599609c1b34e97ba68355de2ba0e
-
SHA256
0299f0c9537c0a9c3415221f2939b9d3f964090d9f02e80c1bb3916cfeb346c3
-
SHA512
b2cf4c16d8d11c3760c0b9c09bf8cc14c475011e91dbac469fb659591182a1f584020e27eb690d215cea6ecfce17774644c819f39d4083564eda2a492dd7b8a4
-
SSDEEP
6144:kzNxMMVANb6ES5Kg3PIuYkk94yNcO43SiIDxfB7GTndEgVpRlrsI4:2xkOHPVg4ydeRI1V8R5sI4
Malware Config
Signatures
-
Darkcomet family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Desktop\\MSDCSC\\msdcsc.exe" 566.EXE -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 1328 attrib.exe 1264 attrib.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation eaa3e99c14f2a6c77f1991ba4132b1f1_JaffaCakes118.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation 566.EXE -
Executes dropped EXE 2 IoCs
pid Process 2872 566.EXE 5012 msdcsc.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Desktop\\MSDCSC\\msdcsc.exe" 566.EXE Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Desktop\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Desktop\\MSDCSC\\msdcsc.exe" iexplore.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 5012 set thread context of 2776 5012 msdcsc.exe 94 -
resource yara_rule behavioral2/memory/628-0-0x0000000000B30000-0x0000000000C01000-memory.dmp upx behavioral2/memory/628-13-0x0000000000B30000-0x0000000000C01000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdcsc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eaa3e99c14f2a6c77f1991ba4132b1f1_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 566.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 566.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2776 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2872 566.EXE Token: SeSecurityPrivilege 2872 566.EXE Token: SeTakeOwnershipPrivilege 2872 566.EXE Token: SeLoadDriverPrivilege 2872 566.EXE Token: SeSystemProfilePrivilege 2872 566.EXE Token: SeSystemtimePrivilege 2872 566.EXE Token: SeProfSingleProcessPrivilege 2872 566.EXE Token: SeIncBasePriorityPrivilege 2872 566.EXE Token: SeCreatePagefilePrivilege 2872 566.EXE Token: SeBackupPrivilege 2872 566.EXE Token: SeRestorePrivilege 2872 566.EXE Token: SeShutdownPrivilege 2872 566.EXE Token: SeDebugPrivilege 2872 566.EXE Token: SeSystemEnvironmentPrivilege 2872 566.EXE Token: SeChangeNotifyPrivilege 2872 566.EXE Token: SeRemoteShutdownPrivilege 2872 566.EXE Token: SeUndockPrivilege 2872 566.EXE Token: SeManageVolumePrivilege 2872 566.EXE Token: SeImpersonatePrivilege 2872 566.EXE Token: SeCreateGlobalPrivilege 2872 566.EXE Token: 33 2872 566.EXE Token: 34 2872 566.EXE Token: 35 2872 566.EXE Token: 36 2872 566.EXE Token: SeIncreaseQuotaPrivilege 5012 msdcsc.exe Token: SeSecurityPrivilege 5012 msdcsc.exe Token: SeTakeOwnershipPrivilege 5012 msdcsc.exe Token: SeLoadDriverPrivilege 5012 msdcsc.exe Token: SeSystemProfilePrivilege 5012 msdcsc.exe Token: SeSystemtimePrivilege 5012 msdcsc.exe Token: SeProfSingleProcessPrivilege 5012 msdcsc.exe Token: SeIncBasePriorityPrivilege 5012 msdcsc.exe Token: SeCreatePagefilePrivilege 5012 msdcsc.exe Token: SeBackupPrivilege 5012 msdcsc.exe Token: SeRestorePrivilege 5012 msdcsc.exe Token: SeShutdownPrivilege 5012 msdcsc.exe Token: SeDebugPrivilege 5012 msdcsc.exe Token: SeSystemEnvironmentPrivilege 5012 msdcsc.exe Token: SeChangeNotifyPrivilege 5012 msdcsc.exe Token: SeRemoteShutdownPrivilege 5012 msdcsc.exe Token: SeUndockPrivilege 5012 msdcsc.exe Token: SeManageVolumePrivilege 5012 msdcsc.exe Token: SeImpersonatePrivilege 5012 msdcsc.exe Token: SeCreateGlobalPrivilege 5012 msdcsc.exe Token: 33 5012 msdcsc.exe Token: 34 5012 msdcsc.exe Token: 35 5012 msdcsc.exe Token: 36 5012 msdcsc.exe Token: SeIncreaseQuotaPrivilege 2776 iexplore.exe Token: SeSecurityPrivilege 2776 iexplore.exe Token: SeTakeOwnershipPrivilege 2776 iexplore.exe Token: SeLoadDriverPrivilege 2776 iexplore.exe Token: SeSystemProfilePrivilege 2776 iexplore.exe Token: SeSystemtimePrivilege 2776 iexplore.exe Token: SeProfSingleProcessPrivilege 2776 iexplore.exe Token: SeIncBasePriorityPrivilege 2776 iexplore.exe Token: SeCreatePagefilePrivilege 2776 iexplore.exe Token: SeBackupPrivilege 2776 iexplore.exe Token: SeRestorePrivilege 2776 iexplore.exe Token: SeShutdownPrivilege 2776 iexplore.exe Token: SeDebugPrivilege 2776 iexplore.exe Token: SeSystemEnvironmentPrivilege 2776 iexplore.exe Token: SeChangeNotifyPrivilege 2776 iexplore.exe Token: SeRemoteShutdownPrivilege 2776 iexplore.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2776 iexplore.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 628 wrote to memory of 2872 628 eaa3e99c14f2a6c77f1991ba4132b1f1_JaffaCakes118.exe 84 PID 628 wrote to memory of 2872 628 eaa3e99c14f2a6c77f1991ba4132b1f1_JaffaCakes118.exe 84 PID 628 wrote to memory of 2872 628 eaa3e99c14f2a6c77f1991ba4132b1f1_JaffaCakes118.exe 84 PID 2872 wrote to memory of 2112 2872 566.EXE 87 PID 2872 wrote to memory of 2112 2872 566.EXE 87 PID 2872 wrote to memory of 2112 2872 566.EXE 87 PID 2872 wrote to memory of 4520 2872 566.EXE 89 PID 2872 wrote to memory of 4520 2872 566.EXE 89 PID 2872 wrote to memory of 4520 2872 566.EXE 89 PID 2112 wrote to memory of 1264 2112 cmd.exe 91 PID 2112 wrote to memory of 1264 2112 cmd.exe 91 PID 2112 wrote to memory of 1264 2112 cmd.exe 91 PID 4520 wrote to memory of 1328 4520 cmd.exe 92 PID 4520 wrote to memory of 1328 4520 cmd.exe 92 PID 4520 wrote to memory of 1328 4520 cmd.exe 92 PID 2872 wrote to memory of 5012 2872 566.EXE 93 PID 2872 wrote to memory of 5012 2872 566.EXE 93 PID 2872 wrote to memory of 5012 2872 566.EXE 93 PID 5012 wrote to memory of 2776 5012 msdcsc.exe 94 PID 5012 wrote to memory of 2776 5012 msdcsc.exe 94 PID 5012 wrote to memory of 2776 5012 msdcsc.exe 94 PID 5012 wrote to memory of 2776 5012 msdcsc.exe 94 PID 5012 wrote to memory of 2776 5012 msdcsc.exe 94 -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 1328 attrib.exe 1264 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\eaa3e99c14f2a6c77f1991ba4132b1f1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\eaa3e99c14f2a6c77f1991ba4132b1f1_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Users\Admin\AppData\Local\Temp\566.EXE"C:\Users\Admin\AppData\Local\Temp\566.EXE"2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:1264
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:1328
-
-
-
C:\Users\Admin\Desktop\MSDCSC\msdcsc.exe"C:\Users\Admin\Desktop\MSDCSC\msdcsc.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2776
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
755KB
MD5b64c98cc781514eccebb0b1b5c930cbb
SHA1dc1099f9d3071e510ffae2b5ca7878bc42bb38e4
SHA256ef785a958c1af0a5c6ad3fe62a2d676fe8b4a723b8d4bb3d1778a0c2cdac7f57
SHA5122deea429a91b44131553256bc3e88a0e21b3927ee67c038c333da2cd0220143fe6bcb104d6c83f3d7eb9271e298bd74bbbe8a2a3e6c1c227e37ec15ee788110a
-
Filesize
50B
MD5b774ae3fb1da087e1f83b4f7b2060e5a
SHA197eb9be49ac3af9c851c9e1e84e32bfd53e325a8
SHA256adaf4a84b41e410b02e261cfd0fe7739d98647eab73c3badd32ac6e39f26351b
SHA512f75d0f95f7306d26a12b414bfe37b97fbd37546cb3c6e403def7077329ddffb4b45d5c5f0ba0e7bb6d72851d2d691b0a85267beead42f7cbf2e8c3d45a3b4701