Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27/01/2025, 15:05
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_40cc7f1ac53d3b835227a0676c36cc87.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_40cc7f1ac53d3b835227a0676c36cc87.exe
-
Size
721KB
-
MD5
40cc7f1ac53d3b835227a0676c36cc87
-
SHA1
eb257ed1fc860f63df76ac5d43fc62b93dd09cbe
-
SHA256
e1d6755c9349ae52f82cc0118752649fa01f0e2d3ede0062b282e0311dc58017
-
SHA512
46ee9b163f31904f809807eb8664fffa079f2a5b470cdd9c8c7ce5ac3a4e972d209a1f2bab10a489920448258917bd14d5218bd0a470dceb629dc1dd1e2a34f3
-
SSDEEP
12288:kjh8ZBPJaG77Wiq0oGUk6ss5XPn5jfJIAc93nJC0PmPD6sZYPaads2PfhNN8PPM7:BPUG2LHG8VZJbeg0+r6gYiOPPf983
Malware Config
Extracted
darkcomet
Guest16
sepeti.zapto.org:2323
DC_MUTEX-GWNWMRG
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
xThbpvEWW0Ry
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
MicroUpdate
Signatures
-
Darkcomet family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" JaffaCakes118_40cc7f1ac53d3b835227a0676c36cc87.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation JaffaCakes118_40cc7f1ac53d3b835227a0676c36cc87.exe -
Executes dropped EXE 2 IoCs
pid Process 4684 msdcsc.exe 2192 msdcsc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" JaffaCakes118_40cc7f1ac53d3b835227a0676c36cc87.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 408 set thread context of 540 408 JaffaCakes118_40cc7f1ac53d3b835227a0676c36cc87.exe 83 PID 4684 set thread context of 2192 4684 msdcsc.exe 85 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_40cc7f1ac53d3b835227a0676c36cc87.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdcsc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdcsc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_40cc7f1ac53d3b835227a0676c36cc87.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 540 JaffaCakes118_40cc7f1ac53d3b835227a0676c36cc87.exe Token: SeSecurityPrivilege 540 JaffaCakes118_40cc7f1ac53d3b835227a0676c36cc87.exe Token: SeTakeOwnershipPrivilege 540 JaffaCakes118_40cc7f1ac53d3b835227a0676c36cc87.exe Token: SeLoadDriverPrivilege 540 JaffaCakes118_40cc7f1ac53d3b835227a0676c36cc87.exe Token: SeSystemProfilePrivilege 540 JaffaCakes118_40cc7f1ac53d3b835227a0676c36cc87.exe Token: SeSystemtimePrivilege 540 JaffaCakes118_40cc7f1ac53d3b835227a0676c36cc87.exe Token: SeProfSingleProcessPrivilege 540 JaffaCakes118_40cc7f1ac53d3b835227a0676c36cc87.exe Token: SeIncBasePriorityPrivilege 540 JaffaCakes118_40cc7f1ac53d3b835227a0676c36cc87.exe Token: SeCreatePagefilePrivilege 540 JaffaCakes118_40cc7f1ac53d3b835227a0676c36cc87.exe Token: SeBackupPrivilege 540 JaffaCakes118_40cc7f1ac53d3b835227a0676c36cc87.exe Token: SeRestorePrivilege 540 JaffaCakes118_40cc7f1ac53d3b835227a0676c36cc87.exe Token: SeShutdownPrivilege 540 JaffaCakes118_40cc7f1ac53d3b835227a0676c36cc87.exe Token: SeDebugPrivilege 540 JaffaCakes118_40cc7f1ac53d3b835227a0676c36cc87.exe Token: SeSystemEnvironmentPrivilege 540 JaffaCakes118_40cc7f1ac53d3b835227a0676c36cc87.exe Token: SeChangeNotifyPrivilege 540 JaffaCakes118_40cc7f1ac53d3b835227a0676c36cc87.exe Token: SeRemoteShutdownPrivilege 540 JaffaCakes118_40cc7f1ac53d3b835227a0676c36cc87.exe Token: SeUndockPrivilege 540 JaffaCakes118_40cc7f1ac53d3b835227a0676c36cc87.exe Token: SeManageVolumePrivilege 540 JaffaCakes118_40cc7f1ac53d3b835227a0676c36cc87.exe Token: SeImpersonatePrivilege 540 JaffaCakes118_40cc7f1ac53d3b835227a0676c36cc87.exe Token: SeCreateGlobalPrivilege 540 JaffaCakes118_40cc7f1ac53d3b835227a0676c36cc87.exe Token: 33 540 JaffaCakes118_40cc7f1ac53d3b835227a0676c36cc87.exe Token: 34 540 JaffaCakes118_40cc7f1ac53d3b835227a0676c36cc87.exe Token: 35 540 JaffaCakes118_40cc7f1ac53d3b835227a0676c36cc87.exe Token: 36 540 JaffaCakes118_40cc7f1ac53d3b835227a0676c36cc87.exe Token: SeIncreaseQuotaPrivilege 2192 msdcsc.exe Token: SeSecurityPrivilege 2192 msdcsc.exe Token: SeTakeOwnershipPrivilege 2192 msdcsc.exe Token: SeLoadDriverPrivilege 2192 msdcsc.exe Token: SeSystemProfilePrivilege 2192 msdcsc.exe Token: SeSystemtimePrivilege 2192 msdcsc.exe Token: SeProfSingleProcessPrivilege 2192 msdcsc.exe Token: SeIncBasePriorityPrivilege 2192 msdcsc.exe Token: SeCreatePagefilePrivilege 2192 msdcsc.exe Token: SeBackupPrivilege 2192 msdcsc.exe Token: SeRestorePrivilege 2192 msdcsc.exe Token: SeShutdownPrivilege 2192 msdcsc.exe Token: SeDebugPrivilege 2192 msdcsc.exe Token: SeSystemEnvironmentPrivilege 2192 msdcsc.exe Token: SeChangeNotifyPrivilege 2192 msdcsc.exe Token: SeRemoteShutdownPrivilege 2192 msdcsc.exe Token: SeUndockPrivilege 2192 msdcsc.exe Token: SeManageVolumePrivilege 2192 msdcsc.exe Token: SeImpersonatePrivilege 2192 msdcsc.exe Token: SeCreateGlobalPrivilege 2192 msdcsc.exe Token: 33 2192 msdcsc.exe Token: 34 2192 msdcsc.exe Token: 35 2192 msdcsc.exe Token: 36 2192 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2192 msdcsc.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 408 wrote to memory of 540 408 JaffaCakes118_40cc7f1ac53d3b835227a0676c36cc87.exe 83 PID 408 wrote to memory of 540 408 JaffaCakes118_40cc7f1ac53d3b835227a0676c36cc87.exe 83 PID 408 wrote to memory of 540 408 JaffaCakes118_40cc7f1ac53d3b835227a0676c36cc87.exe 83 PID 408 wrote to memory of 540 408 JaffaCakes118_40cc7f1ac53d3b835227a0676c36cc87.exe 83 PID 408 wrote to memory of 540 408 JaffaCakes118_40cc7f1ac53d3b835227a0676c36cc87.exe 83 PID 408 wrote to memory of 540 408 JaffaCakes118_40cc7f1ac53d3b835227a0676c36cc87.exe 83 PID 408 wrote to memory of 540 408 JaffaCakes118_40cc7f1ac53d3b835227a0676c36cc87.exe 83 PID 408 wrote to memory of 540 408 JaffaCakes118_40cc7f1ac53d3b835227a0676c36cc87.exe 83 PID 408 wrote to memory of 540 408 JaffaCakes118_40cc7f1ac53d3b835227a0676c36cc87.exe 83 PID 408 wrote to memory of 540 408 JaffaCakes118_40cc7f1ac53d3b835227a0676c36cc87.exe 83 PID 408 wrote to memory of 540 408 JaffaCakes118_40cc7f1ac53d3b835227a0676c36cc87.exe 83 PID 408 wrote to memory of 540 408 JaffaCakes118_40cc7f1ac53d3b835227a0676c36cc87.exe 83 PID 408 wrote to memory of 540 408 JaffaCakes118_40cc7f1ac53d3b835227a0676c36cc87.exe 83 PID 540 wrote to memory of 4684 540 JaffaCakes118_40cc7f1ac53d3b835227a0676c36cc87.exe 84 PID 540 wrote to memory of 4684 540 JaffaCakes118_40cc7f1ac53d3b835227a0676c36cc87.exe 84 PID 540 wrote to memory of 4684 540 JaffaCakes118_40cc7f1ac53d3b835227a0676c36cc87.exe 84 PID 4684 wrote to memory of 2192 4684 msdcsc.exe 85 PID 4684 wrote to memory of 2192 4684 msdcsc.exe 85 PID 4684 wrote to memory of 2192 4684 msdcsc.exe 85 PID 4684 wrote to memory of 2192 4684 msdcsc.exe 85 PID 4684 wrote to memory of 2192 4684 msdcsc.exe 85 PID 4684 wrote to memory of 2192 4684 msdcsc.exe 85 PID 4684 wrote to memory of 2192 4684 msdcsc.exe 85 PID 4684 wrote to memory of 2192 4684 msdcsc.exe 85 PID 4684 wrote to memory of 2192 4684 msdcsc.exe 85 PID 4684 wrote to memory of 2192 4684 msdcsc.exe 85 PID 4684 wrote to memory of 2192 4684 msdcsc.exe 85 PID 4684 wrote to memory of 2192 4684 msdcsc.exe 85 PID 4684 wrote to memory of 2192 4684 msdcsc.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40cc7f1ac53d3b835227a0676c36cc87.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40cc7f1ac53d3b835227a0676c36cc87.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40cc7f1ac53d3b835227a0676c36cc87.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40cc7f1ac53d3b835227a0676c36cc87.exe2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeC:\Users\Admin\Documents\MSDCSC\msdcsc.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2192
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
721KB
MD540cc7f1ac53d3b835227a0676c36cc87
SHA1eb257ed1fc860f63df76ac5d43fc62b93dd09cbe
SHA256e1d6755c9349ae52f82cc0118752649fa01f0e2d3ede0062b282e0311dc58017
SHA51246ee9b163f31904f809807eb8664fffa079f2a5b470cdd9c8c7ce5ac3a4e972d209a1f2bab10a489920448258917bd14d5218bd0a470dceb629dc1dd1e2a34f3