Malware Analysis Report

2025-04-13 22:39

Sample ID 250226-wjxylaxyaw
Target JaffaCakes118_27a577ebf60199ecba7d20e0d4f3bb4a
SHA256 e2e583c859826ea44c7571d0f44fb2ff315af4f2a1f2d2c6aeba2a7ae3973d3e
Tags
darkcomet guest16 defense_evasion discovery persistence rat trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e2e583c859826ea44c7571d0f44fb2ff315af4f2a1f2d2c6aeba2a7ae3973d3e

Threat Level: Known bad

The file JaffaCakes118_27a577ebf60199ecba7d20e0d4f3bb4a was found to be: Known bad.

Malicious Activity Summary

darkcomet guest16 defense_evasion discovery persistence rat trojan upx

Modifies firewall policy service

Modifies WinLogon for persistence

Modifies security service

Windows security bypass

Darkcomet family

Darkcomet

Sets file to hidden

Loads dropped DLL

Executes dropped EXE

Windows security modification

Checks computer location settings

Adds Run key to start application

UPX packed file

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Unsigned PE

Modifies registry class

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Views/modifies file attributes

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-02-26 17:57

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-02-26 17:57

Reported

2025-02-26 18:00

Platform

win7-20240903-en

Max time kernel

150s

Max time network

117s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_27a577ebf60199ecba7d20e0d4f3bb4a.exe"

Signatures

Darkcomet

trojan rat darkcomet

Darkcomet family

darkcomet

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\MSDCSC\\msdcsc.exe" C:\Users\Admin\AppData\Local\Temp\Stage1.exe N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A

Modifies security service

defense_evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A

Windows security bypass

defense_evasion trojan
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A

Sets file to hidden

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Windows security modification

defense_evasion trojan
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\MSDCSC\\msdcsc.exe" C:\Users\Admin\AppData\Local\Temp\Stage1.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\MSDCSC\\msdcsc.exe" C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_27a577ebf60199ecba7d20e0d4f3bb4a.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Stage2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\notepad.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Crypted.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Stage1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\attrib.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A
Token: SeSecurityPrivilege N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A
Token: SeLoadDriverPrivilege N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A
Token: SeSystemProfilePrivilege N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A
Token: SeSystemtimePrivilege N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A
Token: SeBackupPrivilege N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A
Token: SeRestorePrivilege N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A
Token: SeShutdownPrivilege N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A
Token: SeUndockPrivilege N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A
Token: SeManageVolumePrivilege N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A
Token: SeImpersonatePrivilege N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A
Token: 33 N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A
Token: 34 N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A
Token: 35 N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2644 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_27a577ebf60199ecba7d20e0d4f3bb4a.exe C:\Users\Admin\AppData\Local\Temp\Crypted.exe
PID 2644 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_27a577ebf60199ecba7d20e0d4f3bb4a.exe C:\Users\Admin\AppData\Local\Temp\Crypted.exe
PID 2644 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_27a577ebf60199ecba7d20e0d4f3bb4a.exe C:\Users\Admin\AppData\Local\Temp\Crypted.exe
PID 2644 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_27a577ebf60199ecba7d20e0d4f3bb4a.exe C:\Users\Admin\AppData\Local\Temp\Crypted.exe
PID 2644 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_27a577ebf60199ecba7d20e0d4f3bb4a.exe C:\Users\Admin\AppData\Local\Temp\Crypted.exe
PID 2644 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_27a577ebf60199ecba7d20e0d4f3bb4a.exe C:\Users\Admin\AppData\Local\Temp\Crypted.exe
PID 2644 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_27a577ebf60199ecba7d20e0d4f3bb4a.exe C:\Users\Admin\AppData\Local\Temp\Crypted.exe
PID 2768 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\Crypted.exe C:\Users\Admin\AppData\Local\Temp\Stage2.exe
PID 2768 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\Crypted.exe C:\Users\Admin\AppData\Local\Temp\Stage2.exe
PID 2768 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\Crypted.exe C:\Users\Admin\AppData\Local\Temp\Stage2.exe
PID 2768 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\Crypted.exe C:\Users\Admin\AppData\Local\Temp\Stage2.exe
PID 2768 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\Crypted.exe C:\Users\Admin\AppData\Local\Temp\Stage2.exe
PID 2768 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\Crypted.exe C:\Users\Admin\AppData\Local\Temp\Stage2.exe
PID 2768 wrote to memory of 1968 N/A C:\Users\Admin\AppData\Local\Temp\Crypted.exe C:\Users\Admin\AppData\Local\Temp\Stage2.exe
PID 2768 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\Crypted.exe C:\Users\Admin\AppData\Local\Temp\Stage1.exe
PID 2768 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\Crypted.exe C:\Users\Admin\AppData\Local\Temp\Stage1.exe
PID 2768 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\Crypted.exe C:\Users\Admin\AppData\Local\Temp\Stage1.exe
PID 2768 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\Crypted.exe C:\Users\Admin\AppData\Local\Temp\Stage1.exe
PID 2768 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\Crypted.exe C:\Users\Admin\AppData\Local\Temp\Stage1.exe
PID 2768 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\Crypted.exe C:\Users\Admin\AppData\Local\Temp\Stage1.exe
PID 2768 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\Crypted.exe C:\Users\Admin\AppData\Local\Temp\Stage1.exe
PID 2536 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe C:\Windows\SysWOW64\cmd.exe
PID 2536 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe C:\Windows\SysWOW64\cmd.exe
PID 2536 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe C:\Windows\SysWOW64\cmd.exe
PID 2536 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe C:\Windows\SysWOW64\cmd.exe
PID 2536 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe C:\Windows\SysWOW64\cmd.exe
PID 2536 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe C:\Windows\SysWOW64\cmd.exe
PID 2536 wrote to memory of 2932 N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe C:\Windows\SysWOW64\cmd.exe
PID 2932 wrote to memory of 576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2932 wrote to memory of 576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2932 wrote to memory of 576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2932 wrote to memory of 576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2932 wrote to memory of 576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2932 wrote to memory of 576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2932 wrote to memory of 576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2536 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe
PID 2536 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe
PID 2536 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe
PID 2536 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe
PID 2536 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe
PID 2536 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe
PID 2536 wrote to memory of 1600 N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe
PID 1600 wrote to memory of 2376 N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 1600 wrote to memory of 2376 N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 1600 wrote to memory of 2376 N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 1600 wrote to memory of 2376 N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 1600 wrote to memory of 2376 N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 1600 wrote to memory of 2376 N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 1600 wrote to memory of 2376 N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 1600 wrote to memory of 2376 N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 1600 wrote to memory of 2376 N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 1600 wrote to memory of 2376 N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 1600 wrote to memory of 2376 N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 1600 wrote to memory of 2376 N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 1600 wrote to memory of 2376 N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 1600 wrote to memory of 2376 N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 1600 wrote to memory of 2376 N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 1600 wrote to memory of 2376 N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 1600 wrote to memory of 2376 N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 1600 wrote to memory of 2376 N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 1600 wrote to memory of 2376 N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 1600 wrote to memory of 2376 N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 1600 wrote to memory of 2376 N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 1600 wrote to memory of 2376 N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe

Views/modifies file attributes

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_27a577ebf60199ecba7d20e0d4f3bb4a.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_27a577ebf60199ecba7d20e0d4f3bb4a.exe"

C:\Users\Admin\AppData\Local\Temp\Crypted.exe

"C:\Users\Admin\AppData\Local\Temp\Crypted.exe"

C:\Users\Admin\AppData\Local\Temp\Stage2.exe

"C:\Users\Admin\AppData\Local\Temp\Stage2.exe" x -y -oC:\Users\Admin\AppData\Local\Temp -pxnq8rPMxVI87ciGwWJHxRTy3iauHcIirteOOELv3B5vkS9kJoHBUAahY1dWxj8yA

C:\Users\Admin\AppData\Local\Temp\Stage1.exe

"C:\Users\Admin\AppData\Local\Temp\Stage1.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\Stage1.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Users\Admin\AppData\Local\Temp\Stage1.exe" +s +h

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe

"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe"

C:\Windows\SysWOW64\notepad.exe

notepad

Network

Country Destination Domain Proto
US 8.8.8.8:53 holawhey.no-ip.biz udp

Files

C:\Users\Admin\AppData\Local\Temp\Crypted.exe

MD5 133f59b4fa4393eef2766d72ea5f4a00
SHA1 3a33ea8e9c446385d5cf01e47439308c434e67a4
SHA256 b959e80f8de1d37cdf89c1c4b008405db4b9930a2ab1bf93c3201847e2d7421e
SHA512 f1c1b2ace3ef629245df3f5e5395243fea9a33769a725f471b84911266e2f7b299bc556ff2afb9e9aa464c962a05ed38dd30e34595e9859bbb7e638ff0357cd4

memory/2768-6-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2768-11-0x0000000000240000-0x0000000000264000-memory.dmp

memory/2768-10-0x0000000000240000-0x0000000000264000-memory.dmp

\Users\Admin\AppData\Local\Temp\Stage2.exe

MD5 3f6c9f4e2b46b1db1927ae37d0fff55f
SHA1 eb687968cccb0a640ccce2d8c32c942d1edeb9e8
SHA256 59865e45a20ade01259451928f875fe7ed18f5794d51d4caa67851c7b75987f2
SHA512 9df211db0fcc77ce85ec92a027c103ce3473712faa3aa4689d6115e26d4dec0f7659d6682fef705a1c140b8e227b393a39382bc167d4c1d963ba50dbf9d816ed

memory/2768-17-0x0000000002AE0000-0x0000000002B23000-memory.dmp

memory/2768-19-0x0000000002AE0000-0x0000000002B23000-memory.dmp

memory/1968-27-0x0000000000230000-0x0000000000273000-memory.dmp

memory/1968-30-0x0000000000400000-0x0000000000443000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Stage1.exe

MD5 a0dff5b8cab088e99c2b4a48df7df81a
SHA1 b3c202e661515bb06eb05dc1c5dce95022bfcbc7
SHA256 68ba7280939a788da4efdf1667582fb11af99c737601a70e7c625a94afbb3e9a
SHA512 f98cc3a05139b61b9b1f805813c78867eee68c2e5749daba7906ce78e1665d5c2339cba1b77c95d6d8f2e10df36f92095f5d31d94d652abb0e1a15c3be6ca866

memory/2768-36-0x0000000002AE0000-0x0000000002B97000-memory.dmp

memory/2768-35-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2768-34-0x0000000002AE0000-0x0000000002B97000-memory.dmp

memory/2536-39-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2768-38-0x0000000000240000-0x0000000000264000-memory.dmp

memory/2376-95-0x0000000000210000-0x0000000000211000-memory.dmp

memory/2376-57-0x00000000000D0000-0x00000000000D1000-memory.dmp

memory/1600-56-0x0000000000230000-0x00000000002E7000-memory.dmp

memory/1600-55-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2536-96-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2768-97-0x0000000000400000-0x0000000000424000-memory.dmp

memory/1600-98-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/1600-99-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/1600-100-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/1600-101-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/1600-102-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/1600-103-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/1600-104-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/1600-105-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/1600-106-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/1600-107-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/1600-108-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/1600-109-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/1600-110-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/1600-111-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/1600-112-0x0000000000400000-0x00000000004B7000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-02-26 17:57

Reported

2025-02-26 18:00

Platform

win10v2004-20250217-en

Max time kernel

150s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_27a577ebf60199ecba7d20e0d4f3bb4a.exe"

Signatures

Darkcomet

trojan rat darkcomet

Darkcomet family

darkcomet

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\MSDCSC\\msdcsc.exe" C:\Users\Admin\AppData\Local\Temp\Stage1.exe N/A

Modifies firewall policy service

defense_evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A

Modifies security service

defense_evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A

Windows security bypass

defense_evasion trojan
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A

Sets file to hidden

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_27a577ebf60199ecba7d20e0d4f3bb4a.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Crypted.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Stage1.exe N/A

Windows security modification

defense_evasion trojan
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\MSDCSC\\msdcsc.exe" C:\Users\Admin\AppData\Local\Temp\Stage1.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1161330783-2912525651-1278508834-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\MSDCSC\\msdcsc.exe" C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\notepad.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_27a577ebf60199ecba7d20e0d4f3bb4a.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Crypted.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Stage2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\attrib.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Stage1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Users\Admin\AppData\Local\Temp\Stage1.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A
Token: SeSecurityPrivilege N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A
Token: SeLoadDriverPrivilege N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A
Token: SeSystemProfilePrivilege N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A
Token: SeSystemtimePrivilege N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A
Token: SeBackupPrivilege N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A
Token: SeRestorePrivilege N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A
Token: SeShutdownPrivilege N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A
Token: SeDebugPrivilege N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A
Token: SeUndockPrivilege N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A
Token: SeManageVolumePrivilege N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A
Token: SeImpersonatePrivilege N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A
Token: 33 N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A
Token: 34 N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A
Token: 35 N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A
Token: 36 N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1592 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_27a577ebf60199ecba7d20e0d4f3bb4a.exe C:\Users\Admin\AppData\Local\Temp\Crypted.exe
PID 1592 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_27a577ebf60199ecba7d20e0d4f3bb4a.exe C:\Users\Admin\AppData\Local\Temp\Crypted.exe
PID 1592 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_27a577ebf60199ecba7d20e0d4f3bb4a.exe C:\Users\Admin\AppData\Local\Temp\Crypted.exe
PID 5084 wrote to memory of 3392 N/A C:\Users\Admin\AppData\Local\Temp\Crypted.exe C:\Users\Admin\AppData\Local\Temp\Stage2.exe
PID 5084 wrote to memory of 3392 N/A C:\Users\Admin\AppData\Local\Temp\Crypted.exe C:\Users\Admin\AppData\Local\Temp\Stage2.exe
PID 5084 wrote to memory of 3392 N/A C:\Users\Admin\AppData\Local\Temp\Crypted.exe C:\Users\Admin\AppData\Local\Temp\Stage2.exe
PID 5084 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\Crypted.exe C:\Users\Admin\AppData\Local\Temp\Stage1.exe
PID 5084 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\Crypted.exe C:\Users\Admin\AppData\Local\Temp\Stage1.exe
PID 5084 wrote to memory of 1472 N/A C:\Users\Admin\AppData\Local\Temp\Crypted.exe C:\Users\Admin\AppData\Local\Temp\Stage1.exe
PID 1472 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe C:\Windows\SysWOW64\cmd.exe
PID 1472 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe C:\Windows\SysWOW64\cmd.exe
PID 1472 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe C:\Windows\SysWOW64\cmd.exe
PID 2832 wrote to memory of 3964 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2832 wrote to memory of 3964 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 2832 wrote to memory of 3964 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\attrib.exe
PID 1472 wrote to memory of 2304 N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe
PID 1472 wrote to memory of 2304 N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe
PID 1472 wrote to memory of 2304 N/A C:\Users\Admin\AppData\Local\Temp\Stage1.exe C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe
PID 2304 wrote to memory of 904 N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 2304 wrote to memory of 904 N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 2304 wrote to memory of 904 N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 2304 wrote to memory of 904 N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 2304 wrote to memory of 904 N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 2304 wrote to memory of 904 N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 2304 wrote to memory of 904 N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 2304 wrote to memory of 904 N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 2304 wrote to memory of 904 N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 2304 wrote to memory of 904 N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 2304 wrote to memory of 904 N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 2304 wrote to memory of 904 N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 2304 wrote to memory of 904 N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 2304 wrote to memory of 904 N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 2304 wrote to memory of 904 N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 2304 wrote to memory of 904 N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 2304 wrote to memory of 904 N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 2304 wrote to memory of 904 N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 2304 wrote to memory of 904 N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 2304 wrote to memory of 904 N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 2304 wrote to memory of 904 N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe
PID 2304 wrote to memory of 904 N/A C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe C:\Windows\SysWOW64\notepad.exe

Views/modifies file attributes

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_27a577ebf60199ecba7d20e0d4f3bb4a.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_27a577ebf60199ecba7d20e0d4f3bb4a.exe"

C:\Users\Admin\AppData\Local\Temp\Crypted.exe

"C:\Users\Admin\AppData\Local\Temp\Crypted.exe"

C:\Users\Admin\AppData\Local\Temp\Stage2.exe

"C:\Users\Admin\AppData\Local\Temp\Stage2.exe" x -y -oC:\Users\Admin\AppData\Local\Temp -pxnq8rPMxVI87ciGwWJHxRTy3iauHcIirteOOELv3B5vkS9kJoHBUAahY1dWxj8yA

C:\Users\Admin\AppData\Local\Temp\Stage1.exe

"C:\Users\Admin\AppData\Local\Temp\Stage1.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\Stage1.exe" +s +h

C:\Windows\SysWOW64\attrib.exe

attrib "C:\Users\Admin\AppData\Local\Temp\Stage1.exe" +s +h

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe

"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe"

C:\Windows\SysWOW64\notepad.exe

notepad

Network

Country Destination Domain Proto
US 8.8.8.8:53 holawhey.no-ip.biz udp
US 8.8.8.8:53 holawhey.no-ip.biz udp
US 8.8.8.8:53 holawhey.no-ip.biz udp
US 8.8.8.8:53 holawhey.no-ip.biz udp
US 8.8.8.8:53 holawhey.no-ip.biz udp
US 8.8.8.8:53 holawhey.no-ip.biz udp
US 8.8.8.8:53 holawhey.no-ip.biz udp
US 8.8.8.8:53 holawhey.no-ip.biz udp
US 8.8.8.8:53 holawhey.no-ip.biz udp
US 8.8.8.8:53 holawhey.no-ip.biz udp
US 8.8.8.8:53 holawhey.no-ip.biz udp
US 8.8.8.8:53 holawhey.no-ip.biz udp
US 8.8.8.8:53 holawhey.no-ip.biz udp
US 8.8.8.8:53 holawhey.no-ip.biz udp
US 8.8.8.8:53 holawhey.no-ip.biz udp
US 8.8.8.8:53 holawhey.no-ip.biz udp
US 8.8.8.8:53 holawhey.no-ip.biz udp
US 8.8.8.8:53 holawhey.no-ip.biz udp
US 8.8.8.8:53 holawhey.no-ip.biz udp
US 8.8.8.8:53 holawhey.no-ip.biz udp
US 8.8.8.8:53 holawhey.no-ip.biz udp
US 150.171.27.10:443 tcp
US 150.171.27.10:443 tcp
US 150.171.27.10:443 tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tcp
US 8.8.8.8:53 holawhey.no-ip.biz udp
US 8.8.8.8:53 holawhey.no-ip.biz udp
US 8.8.8.8:53 holawhey.no-ip.biz udp
US 8.8.8.8:53 holawhey.no-ip.biz udp
US 8.8.8.8:53 holawhey.no-ip.biz udp
US 8.8.8.8:53 holawhey.no-ip.biz udp
US 8.8.8.8:53 holawhey.no-ip.biz udp
US 8.8.8.8:53 holawhey.no-ip.biz udp
US 8.8.8.8:53 holawhey.no-ip.biz udp

Files

C:\Users\Admin\AppData\Local\Temp\Crypted.exe

MD5 133f59b4fa4393eef2766d72ea5f4a00
SHA1 3a33ea8e9c446385d5cf01e47439308c434e67a4
SHA256 b959e80f8de1d37cdf89c1c4b008405db4b9930a2ab1bf93c3201847e2d7421e
SHA512 f1c1b2ace3ef629245df3f5e5395243fea9a33769a725f471b84911266e2f7b299bc556ff2afb9e9aa464c962a05ed38dd30e34595e9859bbb7e638ff0357cd4

memory/5084-10-0x0000000000400000-0x0000000000424000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Stage2.exe

MD5 3f6c9f4e2b46b1db1927ae37d0fff55f
SHA1 eb687968cccb0a640ccce2d8c32c942d1edeb9e8
SHA256 59865e45a20ade01259451928f875fe7ed18f5794d51d4caa67851c7b75987f2
SHA512 9df211db0fcc77ce85ec92a027c103ce3473712faa3aa4689d6115e26d4dec0f7659d6682fef705a1c140b8e227b393a39382bc167d4c1d963ba50dbf9d816ed

memory/3392-23-0x0000000000400000-0x0000000000443000-memory.dmp

memory/3392-27-0x0000000000400000-0x0000000000443000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Stage1.exe

MD5 a0dff5b8cab088e99c2b4a48df7df81a
SHA1 b3c202e661515bb06eb05dc1c5dce95022bfcbc7
SHA256 68ba7280939a788da4efdf1667582fb11af99c737601a70e7c625a94afbb3e9a
SHA512 f98cc3a05139b61b9b1f805813c78867eee68c2e5749daba7906ce78e1665d5c2339cba1b77c95d6d8f2e10df36f92095f5d31d94d652abb0e1a15c3be6ca866

memory/1472-30-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/1472-31-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

memory/2304-92-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/904-93-0x00000000005E0000-0x00000000005E1000-memory.dmp

memory/1472-95-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/5084-97-0x0000000000400000-0x0000000000424000-memory.dmp

memory/2304-98-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2304-99-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2304-100-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2304-101-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2304-102-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2304-103-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2304-104-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2304-105-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2304-106-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2304-107-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2304-108-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2304-109-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2304-110-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2304-111-0x0000000000400000-0x00000000004B7000-memory.dmp

memory/2304-112-0x0000000000400000-0x00000000004B7000-memory.dmp