Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
02-07-2024 08:54
Static task
static1
Behavioral task
behavioral1
Sample
1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe
-
Size
297KB
-
MD5
1eb4f6368114de35712e3877a11244a1
-
SHA1
fd3b3d3c5b2e0f4a581d816779be8a39de77c41a
-
SHA256
07369156178ba6f590d73e7bf4b65e905a982fc5e71cb4c58d2f3ca4f75e4748
-
SHA512
be8b84d63f44201e36b9a61e660adb7cdede8a8be57c8e44896aa69707d16fbfe36b82f8730232fecce75b27fdf5ddcfe5723a4b7c57a49d3f096e0ba08fb7cd
-
SSDEEP
6144:cympJy59MG872XFaVTvo09tRN6uLWidOEtO2Asc7o9zzKMDVQ1:FOPGYc2U0XRN6gWh8O2h/9zzKMDVQ1
Malware Config
Extracted
darkcomet
Gagze
abdodo.no-ip.org:100
DC_MUTEX-V6608W1
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
G31Xw9jA2Vip
-
install
true
-
offline_keylogger
true
-
password
123456789
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" 1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe -
Modifies security service 2 TTPs 1 IoCs
Processes:
msdcsc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" msdcsc.exe -
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation 1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe -
Executes dropped EXE 2 IoCs
Processes:
msdcsc.exemsdcsc.exepid process 3700 msdcsc.exe 3076 msdcsc.exe -
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exemsdcsc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" 1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe -
Drops file in System32 directory 3 IoCs
Processes:
1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exedescription ioc process File created C:\Windows\SysWOW64\MSDCSC\msdcsc.exe 1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\msdcsc.exe 1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\ 1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exemsdcsc.exedescription pid process target process PID 4420 set thread context of 3480 4420 1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe 1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe PID 3700 set thread context of 3076 3700 msdcsc.exe msdcsc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
msdcsc.exepid process 3076 msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 3480 1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe Token: SeSecurityPrivilege 3480 1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe Token: SeTakeOwnershipPrivilege 3480 1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe Token: SeLoadDriverPrivilege 3480 1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe Token: SeSystemProfilePrivilege 3480 1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe Token: SeSystemtimePrivilege 3480 1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe Token: SeProfSingleProcessPrivilege 3480 1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 3480 1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe Token: SeCreatePagefilePrivilege 3480 1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe Token: SeBackupPrivilege 3480 1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe Token: SeRestorePrivilege 3480 1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe Token: SeShutdownPrivilege 3480 1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe Token: SeDebugPrivilege 3480 1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe Token: SeSystemEnvironmentPrivilege 3480 1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe Token: SeChangeNotifyPrivilege 3480 1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe Token: SeRemoteShutdownPrivilege 3480 1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe Token: SeUndockPrivilege 3480 1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe Token: SeManageVolumePrivilege 3480 1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe Token: SeImpersonatePrivilege 3480 1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe Token: SeCreateGlobalPrivilege 3480 1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe Token: 33 3480 1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe Token: 34 3480 1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe Token: 35 3480 1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe Token: 36 3480 1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe Token: SeIncreaseQuotaPrivilege 3076 msdcsc.exe Token: SeSecurityPrivilege 3076 msdcsc.exe Token: SeTakeOwnershipPrivilege 3076 msdcsc.exe Token: SeLoadDriverPrivilege 3076 msdcsc.exe Token: SeSystemProfilePrivilege 3076 msdcsc.exe Token: SeSystemtimePrivilege 3076 msdcsc.exe Token: SeProfSingleProcessPrivilege 3076 msdcsc.exe Token: SeIncBasePriorityPrivilege 3076 msdcsc.exe Token: SeCreatePagefilePrivilege 3076 msdcsc.exe Token: SeBackupPrivilege 3076 msdcsc.exe Token: SeRestorePrivilege 3076 msdcsc.exe Token: SeShutdownPrivilege 3076 msdcsc.exe Token: SeDebugPrivilege 3076 msdcsc.exe Token: SeSystemEnvironmentPrivilege 3076 msdcsc.exe Token: SeChangeNotifyPrivilege 3076 msdcsc.exe Token: SeRemoteShutdownPrivilege 3076 msdcsc.exe Token: SeUndockPrivilege 3076 msdcsc.exe Token: SeManageVolumePrivilege 3076 msdcsc.exe Token: SeImpersonatePrivilege 3076 msdcsc.exe Token: SeCreateGlobalPrivilege 3076 msdcsc.exe Token: 33 3076 msdcsc.exe Token: 34 3076 msdcsc.exe Token: 35 3076 msdcsc.exe Token: 36 3076 msdcsc.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exemsdcsc.exemsdcsc.exepid process 4420 1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe 3700 msdcsc.exe 3076 msdcsc.exe -
Suspicious use of WriteProcessMemory 45 IoCs
Processes:
1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe1eb4f6368114de35712e3877a11244a1_JaffaCakes118.execmd.exemsdcsc.exemsdcsc.exedescription pid process target process PID 4420 wrote to memory of 3480 4420 1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe 1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe PID 4420 wrote to memory of 3480 4420 1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe 1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe PID 4420 wrote to memory of 3480 4420 1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe 1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe PID 4420 wrote to memory of 3480 4420 1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe 1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe PID 4420 wrote to memory of 3480 4420 1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe 1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe PID 4420 wrote to memory of 3480 4420 1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe 1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe PID 4420 wrote to memory of 3480 4420 1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe 1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe PID 3480 wrote to memory of 1604 3480 1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe cmd.exe PID 3480 wrote to memory of 1604 3480 1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe cmd.exe PID 3480 wrote to memory of 1604 3480 1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe cmd.exe PID 1604 wrote to memory of 4008 1604 cmd.exe attrib.exe PID 1604 wrote to memory of 4008 1604 cmd.exe attrib.exe PID 1604 wrote to memory of 4008 1604 cmd.exe attrib.exe PID 3480 wrote to memory of 3700 3480 1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe msdcsc.exe PID 3480 wrote to memory of 3700 3480 1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe msdcsc.exe PID 3480 wrote to memory of 3700 3480 1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe msdcsc.exe PID 3700 wrote to memory of 3076 3700 msdcsc.exe msdcsc.exe PID 3700 wrote to memory of 3076 3700 msdcsc.exe msdcsc.exe PID 3700 wrote to memory of 3076 3700 msdcsc.exe msdcsc.exe PID 3700 wrote to memory of 3076 3700 msdcsc.exe msdcsc.exe PID 3700 wrote to memory of 3076 3700 msdcsc.exe msdcsc.exe PID 3700 wrote to memory of 3076 3700 msdcsc.exe msdcsc.exe PID 3700 wrote to memory of 3076 3700 msdcsc.exe msdcsc.exe PID 3076 wrote to memory of 1016 3076 msdcsc.exe notepad.exe PID 3076 wrote to memory of 1016 3076 msdcsc.exe notepad.exe PID 3076 wrote to memory of 1016 3076 msdcsc.exe notepad.exe PID 3076 wrote to memory of 1016 3076 msdcsc.exe notepad.exe PID 3076 wrote to memory of 1016 3076 msdcsc.exe notepad.exe PID 3076 wrote to memory of 1016 3076 msdcsc.exe notepad.exe PID 3076 wrote to memory of 1016 3076 msdcsc.exe notepad.exe PID 3076 wrote to memory of 1016 3076 msdcsc.exe notepad.exe PID 3076 wrote to memory of 1016 3076 msdcsc.exe notepad.exe PID 3076 wrote to memory of 1016 3076 msdcsc.exe notepad.exe PID 3076 wrote to memory of 1016 3076 msdcsc.exe notepad.exe PID 3076 wrote to memory of 1016 3076 msdcsc.exe notepad.exe PID 3076 wrote to memory of 1016 3076 msdcsc.exe notepad.exe PID 3076 wrote to memory of 1016 3076 msdcsc.exe notepad.exe PID 3076 wrote to memory of 1016 3076 msdcsc.exe notepad.exe PID 3076 wrote to memory of 1016 3076 msdcsc.exe notepad.exe PID 3076 wrote to memory of 1016 3076 msdcsc.exe notepad.exe PID 3076 wrote to memory of 1016 3076 msdcsc.exe notepad.exe PID 3076 wrote to memory of 1016 3076 msdcsc.exe notepad.exe PID 3076 wrote to memory of 1016 3076 msdcsc.exe notepad.exe PID 3076 wrote to memory of 1016 3076 msdcsc.exe notepad.exe PID 3076 wrote to memory of 1016 3076 msdcsc.exe notepad.exe -
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1eb4f6368114de35712e3877a11244a1_JaffaCakes118.exe
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe
- Modifies security service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad5⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
297KB
MD51eb4f6368114de35712e3877a11244a1
SHA1fd3b3d3c5b2e0f4a581d816779be8a39de77c41a
SHA25607369156178ba6f590d73e7bf4b65e905a982fc5e71cb4c58d2f3ca4f75e4748
SHA512be8b84d63f44201e36b9a61e660adb7cdede8a8be57c8e44896aa69707d16fbfe36b82f8730232fecce75b27fdf5ddcfe5723a4b7c57a49d3f096e0ba08fb7cd
-
memory/1016-88-0x0000000000B10000-0x0000000000B11000-memory.dmpFilesize
4KB
-
memory/3076-97-0x0000000000400000-0x00000000004B4000-memory.dmpFilesize
720KB
-
memory/3076-94-0x0000000000400000-0x00000000004B4000-memory.dmpFilesize
720KB
-
memory/3076-89-0x0000000000400000-0x00000000004B4000-memory.dmpFilesize
720KB
-
memory/3076-100-0x0000000000400000-0x00000000004B4000-memory.dmpFilesize
720KB
-
memory/3076-105-0x0000000000400000-0x00000000004B4000-memory.dmpFilesize
720KB
-
memory/3076-99-0x0000000000400000-0x00000000004B4000-memory.dmpFilesize
720KB
-
memory/3076-90-0x0000000000400000-0x00000000004B4000-memory.dmpFilesize
720KB
-
memory/3076-98-0x0000000000400000-0x00000000004B4000-memory.dmpFilesize
720KB
-
memory/3076-102-0x0000000000400000-0x00000000004B4000-memory.dmpFilesize
720KB
-
memory/3076-81-0x0000000000400000-0x00000000004B4000-memory.dmpFilesize
720KB
-
memory/3076-82-0x0000000000400000-0x00000000004B4000-memory.dmpFilesize
720KB
-
memory/3076-103-0x0000000000400000-0x00000000004B4000-memory.dmpFilesize
720KB
-
memory/3076-87-0x0000000000400000-0x00000000004B4000-memory.dmpFilesize
720KB
-
memory/3076-86-0x0000000000400000-0x00000000004B4000-memory.dmpFilesize
720KB
-
memory/3076-106-0x0000000000400000-0x00000000004B4000-memory.dmpFilesize
720KB
-
memory/3076-104-0x0000000000400000-0x00000000004B4000-memory.dmpFilesize
720KB
-
memory/3076-96-0x0000000000400000-0x00000000004B4000-memory.dmpFilesize
720KB
-
memory/3076-95-0x0000000000400000-0x00000000004B4000-memory.dmpFilesize
720KB
-
memory/3076-93-0x0000000000400000-0x00000000004B4000-memory.dmpFilesize
720KB
-
memory/3076-101-0x0000000000400000-0x00000000004B4000-memory.dmpFilesize
720KB
-
memory/3480-91-0x0000000000400000-0x00000000004B4000-memory.dmpFilesize
720KB
-
memory/3480-15-0x0000000000400000-0x00000000004B4000-memory.dmpFilesize
720KB
-
memory/3480-6-0x0000000000400000-0x00000000004B4000-memory.dmpFilesize
720KB
-
memory/3480-4-0x0000000000400000-0x00000000004B4000-memory.dmpFilesize
720KB
-
memory/3480-9-0x0000000000400000-0x00000000004B4000-memory.dmpFilesize
720KB
-
memory/3480-10-0x0000000000400000-0x00000000004B4000-memory.dmpFilesize
720KB
-
memory/3700-74-0x0000000000400000-0x0000000000517000-memory.dmpFilesize
1.1MB
-
memory/3700-85-0x0000000000400000-0x0000000000517000-memory.dmpFilesize
1.1MB
-
memory/4420-1-0x00000000001C0000-0x00000000001C3000-memory.dmpFilesize
12KB
-
memory/4420-0-0x0000000000400000-0x0000000000517000-memory.dmpFilesize
1.1MB
-
memory/4420-11-0x0000000000400000-0x0000000000517000-memory.dmpFilesize
1.1MB
-
memory/4420-8-0x00000000001C0000-0x00000000001C3000-memory.dmpFilesize
12KB