Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
20-04-2024 01:21
General
-
Target
fb9b44bc678d3c0643ec3a71ebfd0fcb_JaffaCakes118.exe
-
Size
1.2MB
-
MD5
fb9b44bc678d3c0643ec3a71ebfd0fcb
-
SHA1
b626c604a7197f359f42b084e0f809a92a11130a
-
SHA256
6b5eba8e34bf5f62a1f2e93b5ffde5e2b9e866d2d1c9eb2db7f7acd07214daea
-
SHA512
515647cfaac8a7fd08cf7424ad5d6f0f38ca51c1feb59fc67eac19735ede4d9d0b9e5ba75e2b9c5f4d0814bf2b2b15c2b7839310f1680e3711b43d7c32e119cc
-
SSDEEP
24576:arrNfdFl6dojThZyQBkkSy6oCbVKjrNgcGKSbj+HMd0p0yowv:arR6IthA+YVYpnMdz
Malware Config
Signatures
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Modifies firewall policy service 2 TTPs 3 IoCs
-
Modifies security service 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 1 IoCs
-
Disables RegEdit via registry modification 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Windows security modification 2 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 48 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
-
System policy modification 1 TTPs 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fb9b44bc678d3c0643ec3a71ebfd0fcb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fb9b44bc678d3c0643ec3a71ebfd0fcb_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Users\Admin\AppData\Local\Temp\fb9b44bc678d3c0643ec3a71ebfd0fcb_JaffaCakes118.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 43⤵
- Runs ping.exe
-
-
-
C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\explorer.exe"C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\explorer.exe"2⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5fb9b44bc678d3c0643ec3a71ebfd0fcb
SHA1b626c604a7197f359f42b084e0f809a92a11130a
SHA2566b5eba8e34bf5f62a1f2e93b5ffde5e2b9e866d2d1c9eb2db7f7acd07214daea
SHA512515647cfaac8a7fd08cf7424ad5d6f0f38ca51c1feb59fc67eac19735ede4d9d0b9e5ba75e2b9c5f4d0814bf2b2b15c2b7839310f1680e3711b43d7c32e119cc
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
4KB
-
Filesize
2.6MB