Analysis
-
max time kernel
150s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27/02/2025, 04:49
Behavioral task
behavioral1
Sample
JaffaCakes118_2ad0882bd65c724bc72a5551cfc4deac.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_2ad0882bd65c724bc72a5551cfc4deac.exe
Resource
win10v2004-20250217-en
General
-
Target
JaffaCakes118_2ad0882bd65c724bc72a5551cfc4deac.exe
-
Size
251KB
-
MD5
2ad0882bd65c724bc72a5551cfc4deac
-
SHA1
aa4ad1269bc7852513c2c09b3b83f19b62b370e4
-
SHA256
3764002f8b40e8752ba731f80116fa83adff90d1e142cd1a8973515418d97d7b
-
SHA512
f554741dc123ead7faff2342467609385f020feb12c330c8090a65635c1d3cc95322a5ef886b9e88b07f60af5920babeeb6917f016c693311cdc4db352449aee
-
SSDEEP
6144:McNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37s:McW7KEZlPzCy37
Malware Config
Extracted
darkcomet
Guest16
62.201.240.82:1604
DC_MUTEX-Q2YYCL4
-
InstallPath
MSDCSC\msdcsc.bat
-
gencode
WYKYDgPxBWPJ
-
install
true
-
offline_keylogger
true
-
password
0123456789
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Darkcomet family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.bat" JaffaCakes118_2ad0882bd65c724bc72a5551cfc4deac.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" msdcsc.bat -
Executes dropped EXE 1 IoCs
pid Process 1832 msdcsc.bat -
Loads dropped DLL 2 IoCs
pid Process 2828 JaffaCakes118_2ad0882bd65c724bc72a5551cfc4deac.exe 2828 JaffaCakes118_2ad0882bd65c724bc72a5551cfc4deac.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.bat" JaffaCakes118_2ad0882bd65c724bc72a5551cfc4deac.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.bat" msdcsc.bat -
resource yara_rule behavioral1/memory/2828-0-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/files/0x0008000000015d0d-5.dat upx behavioral1/memory/1832-14-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2828-47-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1832-48-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1832-52-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1832-54-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1832-56-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1832-60-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1832-62-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_2ad0882bd65c724bc72a5551cfc4deac.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdcsc.bat Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1832 msdcsc.bat -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2828 JaffaCakes118_2ad0882bd65c724bc72a5551cfc4deac.exe Token: SeSecurityPrivilege 2828 JaffaCakes118_2ad0882bd65c724bc72a5551cfc4deac.exe Token: SeTakeOwnershipPrivilege 2828 JaffaCakes118_2ad0882bd65c724bc72a5551cfc4deac.exe Token: SeLoadDriverPrivilege 2828 JaffaCakes118_2ad0882bd65c724bc72a5551cfc4deac.exe Token: SeSystemProfilePrivilege 2828 JaffaCakes118_2ad0882bd65c724bc72a5551cfc4deac.exe Token: SeSystemtimePrivilege 2828 JaffaCakes118_2ad0882bd65c724bc72a5551cfc4deac.exe Token: SeProfSingleProcessPrivilege 2828 JaffaCakes118_2ad0882bd65c724bc72a5551cfc4deac.exe Token: SeIncBasePriorityPrivilege 2828 JaffaCakes118_2ad0882bd65c724bc72a5551cfc4deac.exe Token: SeCreatePagefilePrivilege 2828 JaffaCakes118_2ad0882bd65c724bc72a5551cfc4deac.exe Token: SeBackupPrivilege 2828 JaffaCakes118_2ad0882bd65c724bc72a5551cfc4deac.exe Token: SeRestorePrivilege 2828 JaffaCakes118_2ad0882bd65c724bc72a5551cfc4deac.exe Token: SeShutdownPrivilege 2828 JaffaCakes118_2ad0882bd65c724bc72a5551cfc4deac.exe Token: SeDebugPrivilege 2828 JaffaCakes118_2ad0882bd65c724bc72a5551cfc4deac.exe Token: SeSystemEnvironmentPrivilege 2828 JaffaCakes118_2ad0882bd65c724bc72a5551cfc4deac.exe Token: SeChangeNotifyPrivilege 2828 JaffaCakes118_2ad0882bd65c724bc72a5551cfc4deac.exe Token: SeRemoteShutdownPrivilege 2828 JaffaCakes118_2ad0882bd65c724bc72a5551cfc4deac.exe Token: SeUndockPrivilege 2828 JaffaCakes118_2ad0882bd65c724bc72a5551cfc4deac.exe Token: SeManageVolumePrivilege 2828 JaffaCakes118_2ad0882bd65c724bc72a5551cfc4deac.exe Token: SeImpersonatePrivilege 2828 JaffaCakes118_2ad0882bd65c724bc72a5551cfc4deac.exe Token: SeCreateGlobalPrivilege 2828 JaffaCakes118_2ad0882bd65c724bc72a5551cfc4deac.exe Token: 33 2828 JaffaCakes118_2ad0882bd65c724bc72a5551cfc4deac.exe Token: 34 2828 JaffaCakes118_2ad0882bd65c724bc72a5551cfc4deac.exe Token: 35 2828 JaffaCakes118_2ad0882bd65c724bc72a5551cfc4deac.exe Token: SeIncreaseQuotaPrivilege 1832 msdcsc.bat Token: SeSecurityPrivilege 1832 msdcsc.bat Token: SeTakeOwnershipPrivilege 1832 msdcsc.bat Token: SeLoadDriverPrivilege 1832 msdcsc.bat Token: SeSystemProfilePrivilege 1832 msdcsc.bat Token: SeSystemtimePrivilege 1832 msdcsc.bat Token: SeProfSingleProcessPrivilege 1832 msdcsc.bat Token: SeIncBasePriorityPrivilege 1832 msdcsc.bat Token: SeCreatePagefilePrivilege 1832 msdcsc.bat Token: SeBackupPrivilege 1832 msdcsc.bat Token: SeRestorePrivilege 1832 msdcsc.bat Token: SeShutdownPrivilege 1832 msdcsc.bat Token: SeDebugPrivilege 1832 msdcsc.bat Token: SeSystemEnvironmentPrivilege 1832 msdcsc.bat Token: SeChangeNotifyPrivilege 1832 msdcsc.bat Token: SeRemoteShutdownPrivilege 1832 msdcsc.bat Token: SeUndockPrivilege 1832 msdcsc.bat Token: SeManageVolumePrivilege 1832 msdcsc.bat Token: SeImpersonatePrivilege 1832 msdcsc.bat Token: SeCreateGlobalPrivilege 1832 msdcsc.bat Token: 33 1832 msdcsc.bat Token: 34 1832 msdcsc.bat Token: 35 1832 msdcsc.bat -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1832 msdcsc.bat -
Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 2828 wrote to memory of 1832 2828 JaffaCakes118_2ad0882bd65c724bc72a5551cfc4deac.exe 28 PID 2828 wrote to memory of 1832 2828 JaffaCakes118_2ad0882bd65c724bc72a5551cfc4deac.exe 28 PID 2828 wrote to memory of 1832 2828 JaffaCakes118_2ad0882bd65c724bc72a5551cfc4deac.exe 28 PID 2828 wrote to memory of 1832 2828 JaffaCakes118_2ad0882bd65c724bc72a5551cfc4deac.exe 28 PID 1832 wrote to memory of 2824 1832 msdcsc.bat 29 PID 1832 wrote to memory of 2824 1832 msdcsc.bat 29 PID 1832 wrote to memory of 2824 1832 msdcsc.bat 29 PID 1832 wrote to memory of 2824 1832 msdcsc.bat 29 PID 1832 wrote to memory of 2124 1832 msdcsc.bat 30 PID 1832 wrote to memory of 2124 1832 msdcsc.bat 30 PID 1832 wrote to memory of 2124 1832 msdcsc.bat 30 PID 1832 wrote to memory of 2124 1832 msdcsc.bat 30 PID 1832 wrote to memory of 2128 1832 msdcsc.bat 31 PID 1832 wrote to memory of 2128 1832 msdcsc.bat 31 PID 1832 wrote to memory of 2128 1832 msdcsc.bat 31 PID 1832 wrote to memory of 2128 1832 msdcsc.bat 31 PID 1832 wrote to memory of 2128 1832 msdcsc.bat 31 PID 1832 wrote to memory of 2128 1832 msdcsc.bat 31 PID 1832 wrote to memory of 2128 1832 msdcsc.bat 31 PID 1832 wrote to memory of 2128 1832 msdcsc.bat 31 PID 1832 wrote to memory of 2128 1832 msdcsc.bat 31 PID 1832 wrote to memory of 2128 1832 msdcsc.bat 31 PID 1832 wrote to memory of 2128 1832 msdcsc.bat 31 PID 1832 wrote to memory of 2128 1832 msdcsc.bat 31 PID 1832 wrote to memory of 2128 1832 msdcsc.bat 31 PID 1832 wrote to memory of 2128 1832 msdcsc.bat 31 PID 1832 wrote to memory of 2128 1832 msdcsc.bat 31 PID 1832 wrote to memory of 2128 1832 msdcsc.bat 31 PID 1832 wrote to memory of 2128 1832 msdcsc.bat 31 PID 1832 wrote to memory of 2128 1832 msdcsc.bat 31 PID 1832 wrote to memory of 2128 1832 msdcsc.bat 31 PID 1832 wrote to memory of 2128 1832 msdcsc.bat 31 PID 1832 wrote to memory of 2128 1832 msdcsc.bat 31 PID 1832 wrote to memory of 2128 1832 msdcsc.bat 31 PID 1832 wrote to memory of 2128 1832 msdcsc.bat 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2ad0882bd65c724bc72a5551cfc4deac.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2ad0882bd65c724bc72a5551cfc4deac.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\Documents\MSDCSC\msdcsc.bat"C:\Users\Admin\Documents\MSDCSC\msdcsc.bat"2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵PID:2824
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"3⤵PID:2124
-
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
- System Location Discovery: System Language Discovery
PID:2128
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD52ad0882bd65c724bc72a5551cfc4deac
SHA1aa4ad1269bc7852513c2c09b3b83f19b62b370e4
SHA2563764002f8b40e8752ba731f80116fa83adff90d1e142cd1a8973515418d97d7b
SHA512f554741dc123ead7faff2342467609385f020feb12c330c8090a65635c1d3cc95322a5ef886b9e88b07f60af5920babeeb6917f016c693311cdc4db352449aee