Analysis
-
max time kernel
120s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
01/03/2025, 07:30
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_37969e3e1072e63d7b7cb3a4589da868.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_37969e3e1072e63d7b7cb3a4589da868.exe
Resource
win10v2004-20250217-en
General
-
Target
JaffaCakes118_37969e3e1072e63d7b7cb3a4589da868.exe
-
Size
1.0MB
-
MD5
37969e3e1072e63d7b7cb3a4589da868
-
SHA1
7322c4e785f823a88bac1a1905b6a9552a813ff6
-
SHA256
bffdb13b50fb76a4e85e4e027e166271dbe2cc9ccaf19fbff4ba8cfeeb6ea297
-
SHA512
9b20b52d83a740cea6f7757c71d8b6a218f4b179c44d32487fd7127d2e3701bcc67d211840c214e5986f609e18ba33d01a271f8f163a45e2108935d1d475046d
-
SSDEEP
12288:YPUrHQD3AQlabjnJnIP5BfjdXmwmwGsqp/UAQQf9y0yaln2qnqGG41I9SOHlhCUC:YsTjTNebdhmMov1Cc0zdQL98hpyX
Malware Config
Extracted
darkcomet
Guest16
drkcmt.no-ip.org:1604
DC_MUTEX-XRH4NSY
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
WY7jPoPv6hlA
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Darkcomet family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\MSDCSC\\msdcsc.exe" vbc.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 4016 attrib.exe 4180 attrib.exe -
Executes dropped EXE 1 IoCs
pid Process 2696 msdcsc.exe -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-22591836-1183090055-1220658180-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\MSDCSC\\msdcsc.exe" vbc.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1452 set thread context of 4552 1452 JaffaCakes118_37969e3e1072e63d7b7cb3a4589da868.exe 91 -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe attrib.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727 attrib.exe -
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_37969e3e1072e63d7b7cb3a4589da868.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdcsc.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ vbc.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4552 vbc.exe Token: SeSecurityPrivilege 4552 vbc.exe Token: SeTakeOwnershipPrivilege 4552 vbc.exe Token: SeLoadDriverPrivilege 4552 vbc.exe Token: SeSystemProfilePrivilege 4552 vbc.exe Token: SeSystemtimePrivilege 4552 vbc.exe Token: SeProfSingleProcessPrivilege 4552 vbc.exe Token: SeIncBasePriorityPrivilege 4552 vbc.exe Token: SeCreatePagefilePrivilege 4552 vbc.exe Token: SeBackupPrivilege 4552 vbc.exe Token: SeRestorePrivilege 4552 vbc.exe Token: SeShutdownPrivilege 4552 vbc.exe Token: SeDebugPrivilege 4552 vbc.exe Token: SeSystemEnvironmentPrivilege 4552 vbc.exe Token: SeChangeNotifyPrivilege 4552 vbc.exe Token: SeRemoteShutdownPrivilege 4552 vbc.exe Token: SeUndockPrivilege 4552 vbc.exe Token: SeManageVolumePrivilege 4552 vbc.exe Token: SeImpersonatePrivilege 4552 vbc.exe Token: SeCreateGlobalPrivilege 4552 vbc.exe Token: 33 4552 vbc.exe Token: 34 4552 vbc.exe Token: 35 4552 vbc.exe Token: 36 4552 vbc.exe -
Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 1452 wrote to memory of 1904 1452 JaffaCakes118_37969e3e1072e63d7b7cb3a4589da868.exe 88 PID 1452 wrote to memory of 1904 1452 JaffaCakes118_37969e3e1072e63d7b7cb3a4589da868.exe 88 PID 1452 wrote to memory of 1904 1452 JaffaCakes118_37969e3e1072e63d7b7cb3a4589da868.exe 88 PID 1904 wrote to memory of 2416 1904 csc.exe 90 PID 1904 wrote to memory of 2416 1904 csc.exe 90 PID 1904 wrote to memory of 2416 1904 csc.exe 90 PID 1452 wrote to memory of 4552 1452 JaffaCakes118_37969e3e1072e63d7b7cb3a4589da868.exe 91 PID 1452 wrote to memory of 4552 1452 JaffaCakes118_37969e3e1072e63d7b7cb3a4589da868.exe 91 PID 1452 wrote to memory of 4552 1452 JaffaCakes118_37969e3e1072e63d7b7cb3a4589da868.exe 91 PID 1452 wrote to memory of 4552 1452 JaffaCakes118_37969e3e1072e63d7b7cb3a4589da868.exe 91 PID 1452 wrote to memory of 4552 1452 JaffaCakes118_37969e3e1072e63d7b7cb3a4589da868.exe 91 PID 1452 wrote to memory of 4552 1452 JaffaCakes118_37969e3e1072e63d7b7cb3a4589da868.exe 91 PID 1452 wrote to memory of 4552 1452 JaffaCakes118_37969e3e1072e63d7b7cb3a4589da868.exe 91 PID 1452 wrote to memory of 4552 1452 JaffaCakes118_37969e3e1072e63d7b7cb3a4589da868.exe 91 PID 1452 wrote to memory of 4552 1452 JaffaCakes118_37969e3e1072e63d7b7cb3a4589da868.exe 91 PID 1452 wrote to memory of 4552 1452 JaffaCakes118_37969e3e1072e63d7b7cb3a4589da868.exe 91 PID 1452 wrote to memory of 4552 1452 JaffaCakes118_37969e3e1072e63d7b7cb3a4589da868.exe 91 PID 1452 wrote to memory of 4552 1452 JaffaCakes118_37969e3e1072e63d7b7cb3a4589da868.exe 91 PID 1452 wrote to memory of 4552 1452 JaffaCakes118_37969e3e1072e63d7b7cb3a4589da868.exe 91 PID 1452 wrote to memory of 4552 1452 JaffaCakes118_37969e3e1072e63d7b7cb3a4589da868.exe 91 PID 4552 wrote to memory of 1944 4552 vbc.exe 92 PID 4552 wrote to memory of 1944 4552 vbc.exe 92 PID 4552 wrote to memory of 1944 4552 vbc.exe 92 PID 4552 wrote to memory of 4608 4552 vbc.exe 94 PID 4552 wrote to memory of 4608 4552 vbc.exe 94 PID 4552 wrote to memory of 4608 4552 vbc.exe 94 PID 4608 wrote to memory of 4016 4608 cmd.exe 96 PID 4608 wrote to memory of 4016 4608 cmd.exe 96 PID 4608 wrote to memory of 4016 4608 cmd.exe 96 PID 1944 wrote to memory of 4180 1944 cmd.exe 97 PID 1944 wrote to memory of 4180 1944 cmd.exe 97 PID 1944 wrote to memory of 4180 1944 cmd.exe 97 PID 4552 wrote to memory of 2696 4552 vbc.exe 98 PID 4552 wrote to memory of 2696 4552 vbc.exe 98 PID 4552 wrote to memory of 2696 4552 vbc.exe 98 -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 4016 attrib.exe 4180 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_37969e3e1072e63d7b7cb3a4589da868.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_37969e3e1072e63d7b7cb3a4589da868.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\04fdikmx\04fdikmx.cmdline"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6EB8.tmp" "c:\Users\Admin\AppData\Local\Temp\04fdikmx\CSC815E8200991A41CEA99D9F1AB8EFF7EE.TMP"3⤵
- System Location Discovery: System Language Discovery
PID:2416
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe2⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" +s +h3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" +s +h4⤵
- Sets file to hidden
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:4180
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727" +s +h3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727" +s +h4⤵
- Sets file to hidden
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:4016
-
-
-
C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe"C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2696
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
Filesize
5KB
MD5a596f6e581c6dcde21fd4877bfc2487a
SHA1499b359cc2c91e718ed0cab8b336a21c81699a74
SHA256d254c1812dd93abaf928b59f3e462183f8640c9bb628b9f093b50c8c39f33594
SHA5125d2112262d3ab7e52e138d8eda2ffb4336cbb45faef67ff81096402708668d0e7f5324df4d47d5abe84caf77146dbf260cabb69e3547e42d2143a0aab9331ef8
-
Filesize
1KB
MD523dca0039787962e6b56c3f4faa7c6a6
SHA1f3c66040f28ce16456427ee9749def89f6bd91c1
SHA2560d89705db1207728b06cbc48d7daeb54bdba3db3484a49a7d0c27b7f1c0afdd4
SHA512384f5609659baeb5daf7c917c34099ed7b752b59390ecc52dc304b738ca3a62d5719e8b984be1b6c3474edf0f98f87cf14c20697d25fa009a82ae457ca697b23
-
Filesize
4KB
MD5f60a1218bfdab4f9b0176d4e1a15ec68
SHA12222a76846b6caf120589f7120a5a41f8811761d
SHA256fa9031f18b423c4d078667222b009f1d285149b93d60029feab549fc6d46a927
SHA512c082a09f8e8b20776d5d1397b6a781c293df15a421c1f93e069df8df8fe59580100c7347deef3185c8104ecce2eae6fabfc44994805d21a23123a6a9cd763bc6
-
Filesize
224B
MD5970797d6fe506b798585f556d5f8b974
SHA1ff17371ae2915ed118a4f881c02317625c7af08c
SHA25671fc03136bb2d0142863b0d53b1065d2c460e0f384f7b628124202857c24dfc5
SHA512360576ae861a9d337c065e1ae22ae86df79e166a84709b73a89058d332d7faa022c2e2f0f300064b50976c43bfc182532411284d98426c300577a4efcf749d70
-
Filesize
652B
MD53c8a5dfaaf48e41086594de9f97e29c6
SHA1a6814592b5a64d8752e0bd371bcb408b057f3ddb
SHA2561a756e8274706986a39749ad42cb36a95d6ef91b1824d238d825da9ac2ff02f6
SHA512a02f6ab135fcce155b90a156c4bcb1c37bb3b3495e9533b82463c1d62ac1234f3a5b75275fac3c3b7fbd2e25f57034e73d89da0786a66b825cce9ecabb887fa7