Analysis

  • max time kernel
    4s
  • max time network
    3s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    16-04-2024 01:50

General

  • Target

    f269ccb519476724082fd3d4383d5ca6_JaffaCakes118.exe

  • Size

    1.1MB

  • MD5

    f269ccb519476724082fd3d4383d5ca6

  • SHA1

    fd9005d5401c9d2df2d792eec8d47ba5cee2b9c6

  • SHA256

    e56800ef1346a3a28f31c466eb1d31655a127c7cb81647bb7697558e7a879ed2

  • SHA512

    77e5f1499acfea03e9cef52d85c1189b7ea0283b005c8584bc559d5ab694c3d3870906c52c012a5ad64930819b05f618852cd289eaa4a73b157c171d799a69ac

  • SSDEEP

    12288:3R3osGLyv32XrpXEJETL3ZaHa1fwd3DqjPtet4nQTl0RgiynJd4m8SdZuZCpnp+Z:B3pvHEdchJFZkyYsBkcUZL

Malware Config

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f269ccb519476724082fd3d4383d5ca6_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f269ccb519476724082fd3d4383d5ca6_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2224
    • C:\Users\Admin\AppData\Local\Temp\hostcv.exe
      "C:\Users\Admin\AppData\Local\Temp\hostcv.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3068
      • C:\Users\Admin\AppData\Local\Temp\winini.exe
        C:\Users\Admin\AppData\Local\Temp\winini.exe
        3⤵
        • Executes dropped EXE
        PID:2680

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\hostcv.exe

    Filesize

    696KB

    MD5

    771c6ba0050a51ca574d2e316468720b

    SHA1

    6fc9f25f8f6fd2295e394fbbac529c5ed6a80459

    SHA256

    5bcce062586bf4f2be50b18110cb25f413f2f2049f505f1aed7f588951826900

    SHA512

    bbcbf93ae4ef4a08798c4f68b58267885a3db147d442ee5df449aa723d83d4e6004b901c28d55a463c74c072390b13434fccd198049cd93fc05af097f853fb64

  • \Users\Admin\AppData\Local\Temp\winini.exe

    Filesize

    31KB

    MD5

    ed797d8dc2c92401985d162e42ffa450

    SHA1

    0f02fc517c7facc4baefde4fe9467fb6488ebabe

    SHA256

    b746362010a101cb5931bc066f0f4d3fc740c02a68c1f37fc3c8e6c87fd7cb1e

    SHA512

    e831a6ff987f3ef29982da16afad06938b68eddd43c234ba88d1c96a1b5547f2284baf35cbb3a5bfd75e7f0445d14daa014e0ba00b4db72c67f83f0a314c80c2

  • memory/2224-1-0x0000000074A80000-0x000000007502B000-memory.dmp

    Filesize

    5.7MB

  • memory/2224-2-0x00000000022C0000-0x0000000002300000-memory.dmp

    Filesize

    256KB

  • memory/2224-0-0x0000000074A80000-0x000000007502B000-memory.dmp

    Filesize

    5.7MB

  • memory/2224-22-0x0000000074A80000-0x000000007502B000-memory.dmp

    Filesize

    5.7MB

  • memory/2680-27-0x0000000013140000-0x000000001320F000-memory.dmp

    Filesize

    828KB

  • memory/2680-28-0x0000000013140000-0x000000001320F000-memory.dmp

    Filesize

    828KB

  • memory/2680-20-0x0000000013140000-0x000000001320F000-memory.dmp

    Filesize

    828KB

  • memory/2680-21-0x0000000013140000-0x000000001320F000-memory.dmp

    Filesize

    828KB

  • memory/2680-31-0x0000000013140000-0x000000001320F000-memory.dmp

    Filesize

    828KB

  • memory/2680-23-0x0000000013140000-0x000000001320F000-memory.dmp

    Filesize

    828KB

  • memory/2680-25-0x0000000013140000-0x000000001320F000-memory.dmp

    Filesize

    828KB

  • memory/2680-24-0x0000000013140000-0x000000001320F000-memory.dmp

    Filesize

    828KB

  • memory/2680-26-0x0000000013140000-0x000000001320F000-memory.dmp

    Filesize

    828KB

  • memory/2680-29-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/3068-15-0x0000000074A80000-0x000000007502B000-memory.dmp

    Filesize

    5.7MB

  • memory/3068-13-0x0000000074A80000-0x000000007502B000-memory.dmp

    Filesize

    5.7MB

  • memory/3068-14-0x00000000001C0000-0x0000000000200000-memory.dmp

    Filesize

    256KB

  • memory/3068-37-0x0000000074A80000-0x000000007502B000-memory.dmp

    Filesize

    5.7MB