Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
03-01-2025 10:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe
Resource
win7-20240903-en
windows7-x64
26 signatures
150 seconds
General
-
Target
JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe
-
Size
864KB
-
MD5
6c0de5b944735fb6574dcdd8b7d563c0
-
SHA1
c2c1032481f7194cbf3e24933ef6671af38f0c2c
-
SHA256
46277ff9b64c1e0c101dbfcbcd3b6522c53246cf2b5d87456cebe1f2efb72838
-
SHA512
f80bfabbcb0dafd0ec94abe4c9deac50ecce54cd4ce341e9ff1072d4a63f4266051d8ce2c818dc5e8558a94e32b0c0321175d19992537d9beb50dc66c4f28b33
-
SSDEEP
24576:lJzKTyB6LIVewBV5nmEY9OY847pKdLCAN:fz16LIzpmHD84O
Malware Config
Signatures
-
Darkcomet family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe -
Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile iexplore.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" iexplore.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" iexplore.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" msdcsc.exe -
Modifies security service 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" iexplore.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" msdcsc.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe -
Disables RegEdit via registry modification 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" msdcsc.exe -
Disables Task Manager via registry modification
-
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 3852 attrib.exe 548 attrib.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe -
Executes dropped EXE 3 IoCs
pid Process 2716 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe 1604 msdcsc.exe 448 msdcsc.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\help.exe" JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\help.exe" JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\help.exe" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\help.exe" msdcsc.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 4092 3760 WerFault.exe 83 -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 224 set thread context of 3760 224 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe 83 PID 224 set thread context of 2716 224 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe 90 PID 1604 set thread context of 2480 1604 msdcsc.exe 102 PID 1604 set thread context of 448 1604 msdcsc.exe 106 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 17 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdcsc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdcsc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2452 cmd.exe 3360 PING.EXE -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe -
Runs net.exe
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3360 PING.EXE -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 224 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe 224 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe 224 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe 224 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe 224 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe 224 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe 224 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe 224 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe 1604 msdcsc.exe 1604 msdcsc.exe 1604 msdcsc.exe 1604 msdcsc.exe 1604 msdcsc.exe 1604 msdcsc.exe 1604 msdcsc.exe 1604 msdcsc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2480 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2716 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe Token: SeSecurityPrivilege 2716 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe Token: SeTakeOwnershipPrivilege 2716 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe Token: SeLoadDriverPrivilege 2716 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe Token: SeSystemProfilePrivilege 2716 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe Token: SeSystemtimePrivilege 2716 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe Token: SeProfSingleProcessPrivilege 2716 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe Token: SeIncBasePriorityPrivilege 2716 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe Token: SeCreatePagefilePrivilege 2716 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe Token: SeBackupPrivilege 2716 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe Token: SeRestorePrivilege 2716 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe Token: SeShutdownPrivilege 2716 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe Token: SeDebugPrivilege 2716 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe Token: SeSystemEnvironmentPrivilege 2716 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe Token: SeChangeNotifyPrivilege 2716 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe Token: SeRemoteShutdownPrivilege 2716 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe Token: SeUndockPrivilege 2716 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe Token: SeManageVolumePrivilege 2716 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe Token: SeImpersonatePrivilege 2716 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe Token: SeCreateGlobalPrivilege 2716 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe Token: 33 2716 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe Token: 34 2716 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe Token: 35 2716 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe Token: 36 2716 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe Token: SeIncreaseQuotaPrivilege 2480 iexplore.exe Token: SeSecurityPrivilege 2480 iexplore.exe Token: SeTakeOwnershipPrivilege 2480 iexplore.exe Token: SeLoadDriverPrivilege 2480 iexplore.exe Token: SeSystemProfilePrivilege 2480 iexplore.exe Token: SeSystemtimePrivilege 2480 iexplore.exe Token: SeProfSingleProcessPrivilege 2480 iexplore.exe Token: SeIncBasePriorityPrivilege 2480 iexplore.exe Token: SeCreatePagefilePrivilege 2480 iexplore.exe Token: SeBackupPrivilege 2480 iexplore.exe Token: SeRestorePrivilege 2480 iexplore.exe Token: SeShutdownPrivilege 2480 iexplore.exe Token: SeDebugPrivilege 2480 iexplore.exe Token: SeSystemEnvironmentPrivilege 2480 iexplore.exe Token: SeChangeNotifyPrivilege 2480 iexplore.exe Token: SeRemoteShutdownPrivilege 2480 iexplore.exe Token: SeUndockPrivilege 2480 iexplore.exe Token: SeManageVolumePrivilege 2480 iexplore.exe Token: SeImpersonatePrivilege 2480 iexplore.exe Token: SeCreateGlobalPrivilege 2480 iexplore.exe Token: 33 2480 iexplore.exe Token: 34 2480 iexplore.exe Token: 35 2480 iexplore.exe Token: 36 2480 iexplore.exe Token: SeIncreaseQuotaPrivilege 448 msdcsc.exe Token: SeSecurityPrivilege 448 msdcsc.exe Token: SeTakeOwnershipPrivilege 448 msdcsc.exe Token: SeLoadDriverPrivilege 448 msdcsc.exe Token: SeSystemProfilePrivilege 448 msdcsc.exe Token: SeSystemtimePrivilege 448 msdcsc.exe Token: SeProfSingleProcessPrivilege 448 msdcsc.exe Token: SeIncBasePriorityPrivilege 448 msdcsc.exe Token: SeCreatePagefilePrivilege 448 msdcsc.exe Token: SeBackupPrivilege 448 msdcsc.exe Token: SeRestorePrivilege 448 msdcsc.exe Token: SeShutdownPrivilege 448 msdcsc.exe Token: SeDebugPrivilege 448 msdcsc.exe Token: SeSystemEnvironmentPrivilege 448 msdcsc.exe Token: SeChangeNotifyPrivilege 448 msdcsc.exe Token: SeRemoteShutdownPrivilege 448 msdcsc.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 224 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe 1604 msdcsc.exe 2480 iexplore.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 224 wrote to memory of 396 224 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe 82 PID 224 wrote to memory of 396 224 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe 82 PID 224 wrote to memory of 396 224 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe 82 PID 224 wrote to memory of 3760 224 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe 83 PID 224 wrote to memory of 3760 224 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe 83 PID 224 wrote to memory of 3760 224 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe 83 PID 224 wrote to memory of 3760 224 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe 83 PID 396 wrote to memory of 1132 396 cmd.exe 87 PID 396 wrote to memory of 1132 396 cmd.exe 87 PID 396 wrote to memory of 1132 396 cmd.exe 87 PID 1132 wrote to memory of 2592 1132 net.exe 88 PID 1132 wrote to memory of 2592 1132 net.exe 88 PID 1132 wrote to memory of 2592 1132 net.exe 88 PID 224 wrote to memory of 2716 224 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe 90 PID 224 wrote to memory of 2716 224 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe 90 PID 224 wrote to memory of 2716 224 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe 90 PID 224 wrote to memory of 2716 224 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe 90 PID 224 wrote to memory of 2716 224 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe 90 PID 224 wrote to memory of 2716 224 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe 90 PID 224 wrote to memory of 2716 224 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe 90 PID 224 wrote to memory of 2716 224 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe 90 PID 224 wrote to memory of 2716 224 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe 90 PID 224 wrote to memory of 2716 224 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe 90 PID 224 wrote to memory of 2716 224 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe 90 PID 224 wrote to memory of 2716 224 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe 90 PID 224 wrote to memory of 2716 224 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe 90 PID 224 wrote to memory of 2716 224 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe 90 PID 2716 wrote to memory of 4368 2716 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe 91 PID 2716 wrote to memory of 4368 2716 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe 91 PID 2716 wrote to memory of 4368 2716 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe 91 PID 2716 wrote to memory of 5040 2716 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe 93 PID 2716 wrote to memory of 5040 2716 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe 93 PID 2716 wrote to memory of 5040 2716 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe 93 PID 2716 wrote to memory of 2452 2716 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe 94 PID 2716 wrote to memory of 2452 2716 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe 94 PID 2716 wrote to memory of 2452 2716 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe 94 PID 4368 wrote to memory of 3852 4368 cmd.exe 97 PID 4368 wrote to memory of 3852 4368 cmd.exe 97 PID 4368 wrote to memory of 3852 4368 cmd.exe 97 PID 5040 wrote to memory of 548 5040 cmd.exe 98 PID 5040 wrote to memory of 548 5040 cmd.exe 98 PID 5040 wrote to memory of 548 5040 cmd.exe 98 PID 2452 wrote to memory of 3360 2452 cmd.exe 99 PID 2452 wrote to memory of 3360 2452 cmd.exe 99 PID 2452 wrote to memory of 3360 2452 cmd.exe 99 PID 2716 wrote to memory of 1604 2716 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe 100 PID 2716 wrote to memory of 1604 2716 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe 100 PID 2716 wrote to memory of 1604 2716 JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe 100 PID 1604 wrote to memory of 3964 1604 msdcsc.exe 101 PID 1604 wrote to memory of 3964 1604 msdcsc.exe 101 PID 1604 wrote to memory of 3964 1604 msdcsc.exe 101 PID 1604 wrote to memory of 2480 1604 msdcsc.exe 102 PID 1604 wrote to memory of 2480 1604 msdcsc.exe 102 PID 1604 wrote to memory of 2480 1604 msdcsc.exe 102 PID 1604 wrote to memory of 2480 1604 msdcsc.exe 102 PID 1604 wrote to memory of 2480 1604 msdcsc.exe 102 PID 1604 wrote to memory of 2480 1604 msdcsc.exe 102 PID 1604 wrote to memory of 2480 1604 msdcsc.exe 102 PID 1604 wrote to memory of 2480 1604 msdcsc.exe 102 PID 1604 wrote to memory of 2480 1604 msdcsc.exe 102 PID 1604 wrote to memory of 2480 1604 msdcsc.exe 102 PID 1604 wrote to memory of 2480 1604 msdcsc.exe 102 PID 1604 wrote to memory of 2480 1604 msdcsc.exe 102 PID 1604 wrote to memory of 2480 1604 msdcsc.exe 102 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" msdcsc.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 3852 attrib.exe 548 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Windows\SysWOW64\cmd.exe/c net stop MpsSvc2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Windows\SysWOW64\net.exenet stop MpsSvc3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MpsSvc4⤵
- System Location Discovery: System Language Discovery
PID:2592
-
-
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵PID:3760
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3760 -s 843⤵
- Program crash
PID:4092
-
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe" +s +h3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe" +s +h4⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:3852
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Sets file to hidden
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:548
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6c0de5b944735fb6574dcdd8b7d563c0.exe"3⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 44⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3360
-
-
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Windows\SysWOW64\cmd.exe/c net stop MpsSvc4⤵
- System Location Discovery: System Language Discovery
PID:3964 -
C:\Windows\SysWOW64\net.exenet stop MpsSvc5⤵
- System Location Discovery: System Language Discovery
PID:3680 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MpsSvc6⤵
- System Location Discovery: System Language Discovery
PID:1468
-
-
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"4⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2480
-
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeC:\Users\Admin\Documents\MSDCSC\msdcsc.exe4⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:448
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3760 -ip 37601⤵PID:3468
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Modify Registry
7Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
864KB
MD56c0de5b944735fb6574dcdd8b7d563c0
SHA1c2c1032481f7194cbf3e24933ef6671af38f0c2c
SHA25646277ff9b64c1e0c101dbfcbcd3b6522c53246cf2b5d87456cebe1f2efb72838
SHA512f80bfabbcb0dafd0ec94abe4c9deac50ecce54cd4ce341e9ff1072d4a63f4266051d8ce2c818dc5e8558a94e32b0c0321175d19992537d9beb50dc66c4f28b33