Analysis

  • max time kernel
    149s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    15-04-2024 07:44

General

  • Target

    f099166904861ab4279bcb3363818e1b_JaffaCakes118.exe

  • Size

    1.0MB

  • MD5

    f099166904861ab4279bcb3363818e1b

  • SHA1

    947bdc188faf9186d1a0da4c5344092796edeb7b

  • SHA256

    b77cbf38ccd7eaffd507edd029defb701eb4f7627eb55d24b00981188af05a33

  • SHA512

    8cd115cdfe8e286a79a7b81a948ff5475f9492b0d649c632fefa64576aa648cf24acb18659f575ad31927a7f6f83554aff90a24d74eb6881696875497c69bc3b

  • SSDEEP

    12288:krcp5dIUYqiMzISoyzoSQMJe+Cixm4I5aex6sDQ6Z6pfwXOisfg+KpDZqLivKBSS:YGYKzmx+CJn5jDQ3pNtyDZ+E8b

Malware Config

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f099166904861ab4279bcb3363818e1b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f099166904861ab4279bcb3363818e1b_JaffaCakes118.exe"
    1⤵
    • Drops startup file
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3000
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rpvtndcb.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2184
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2492.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC2491.tmp"
        3⤵
          PID:2608
      • C:\Users\Admin\AppData\Roaming\Injection.exe
        C:\Users\Admin\AppData\Roaming\Injection.exe
        2⤵
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:2572

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\RES2492.tmp

      Filesize

      1KB

      MD5

      b08cc760a3ad3300a31aea21003467b2

      SHA1

      e11e1e278c9c4df3d6fed7e153f70fde6d4ab287

      SHA256

      4d3cfb36cfad405768837f11c9c7083cd7ac777bf7b63758d63a0320e81e939d

      SHA512

      f241f03291049a61d2bbc9e32464fd7f0e59c5736d4fcb254de1aa1de286fc19c6ee8a50adab53303c7598c16e1d88ca505507aaf41e7dfbfa1d73b362cb4e8c

    • C:\Users\Admin\AppData\Local\Temp\rpvtndcb.dll

      Filesize

      5KB

      MD5

      0e37ad110648e6fea93defd082b01930

      SHA1

      3f04947c8827e19b7a9b4b4463e4569dcb5c5c6f

      SHA256

      abd15708a674c0b10edab68a9fa106a4fea873e594bdd21cb31c2799eac514ec

      SHA512

      1ce926845dcdeb8dfe6b6d5ca4cbcfe0b9ec57b4784111bbaff8da1082e2b385f3cb573d0732315f71af8801173bb0cc383a53e5c1abc66b0fa845fdddf8fda3

    • \??\c:\Users\Admin\AppData\Local\Temp\CSC2491.tmp

      Filesize

      652B

      MD5

      50faa68530824e8a94483d3aa6904a30

      SHA1

      7fb4d05a4be699e879d3f257690fb2697b3c0d4e

      SHA256

      bc8f62b6fcd058d2ae93c125c3a67d3528dca3073dd3dfb456ec07298c3bc482

      SHA512

      a3995c11fbab31c021e8c65a5c502622857eb33f3053945b9c8cb460923b1c19265304eec9e91bb6333d7d24f5640b35332b4c437b88943181307b396f8e0fcc

    • \??\c:\Users\Admin\AppData\Local\Temp\rpvtndcb.0.cs

      Filesize

      4KB

      MD5

      6830431c6b49f72eaca4b2888a0ddaa9

      SHA1

      502083f68f991bfcfd771a7ba5bd508c2834591c

      SHA256

      ae57e8973a24563582d571743f0339d9347ffc82ed716d12a994694c2b673bf8

      SHA512

      939fa8cb2ca518904dea91b9612c53d833b9cf11e393fb376c1b0d00734e52b33708a6302e04bf15cb6a8e745475163766dec5a29ac265c914d0c286a170b35a

    • \??\c:\Users\Admin\AppData\Local\Temp\rpvtndcb.cmdline

      Filesize

      206B

      MD5

      573dbcbfb712af18b3430e5d5f063ad8

      SHA1

      a5c5dfe85383b1688f0d250660d7f39a1218e382

      SHA256

      5f718e41637fae4c8e35f71004815aacaf583e1010966e02989b7800f33a93ec

      SHA512

      47a6e40e6e98a9bab6db637c70c887f356b659bfd8e9304ffeaeee2658a96c7a31516f672a5ff37c1aaf74c46422a72aac0e8f3e1e9e9936880ca81ee7ffab66

    • \Users\Admin\AppData\Roaming\Injection.exe

      Filesize

      16KB

      MD5

      ba093215cda2c953d09cb4be4b85931f

      SHA1

      776090132599bca6a7d29362bba6a5893669e2a9

      SHA256

      8111d242686858f3a2e9adf30cd37b5c264743bfd4ad4d090ea4ce4187ce7798

      SHA512

      dc66ac0b2442339ec1bcbd2fa85a1e8e04d6485ea946a84a2516d96138f2c7f14bca703c71bb085669de0c4bc088e0e17927ca094273d06e01cfa0c5b1f35023

    • memory/2572-42-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2572-48-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2572-65-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2572-23-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2572-32-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2572-35-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2572-37-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2572-34-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2572-33-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2572-30-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2572-28-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2572-27-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2572-25-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2572-39-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2572-64-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2572-44-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2572-43-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2572-45-0x0000000000270000-0x0000000000271000-memory.dmp

      Filesize

      4KB

    • memory/2572-47-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2572-63-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2572-49-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2572-62-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2572-61-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2572-60-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2572-53-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2572-54-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2572-55-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2572-56-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2572-57-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2572-58-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2572-59-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/3000-52-0x00000000004C0000-0x0000000000500000-memory.dmp

      Filesize

      256KB

    • memory/3000-51-0x0000000074620000-0x0000000074BCB000-memory.dmp

      Filesize

      5.7MB

    • memory/3000-50-0x0000000074620000-0x0000000074BCB000-memory.dmp

      Filesize

      5.7MB

    • memory/3000-0-0x0000000074620000-0x0000000074BCB000-memory.dmp

      Filesize

      5.7MB

    • memory/3000-1-0x0000000074620000-0x0000000074BCB000-memory.dmp

      Filesize

      5.7MB

    • memory/3000-2-0x00000000004C0000-0x0000000000500000-memory.dmp

      Filesize

      256KB