Analysis

  • max time kernel
    146s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    26-06-2024 21:21

General

  • Target

    13803ebdba0993bab5f7229fd955972b_JaffaCakes118.exe

  • Size

    960KB

  • MD5

    13803ebdba0993bab5f7229fd955972b

  • SHA1

    a5e977d4dcdd53be60f0f48910d1b92ea7628202

  • SHA256

    bbd2e79112498c9b3bf4c64a4843e7f54a260136846fcb3bbf123eee9c50225f

  • SHA512

    457d97542f2114f95a526ab771fca972c6cc41bc07aa4106fa75973ef429f7562dc2e0cce0b146b82648a21459424ec0a395923394cfe5ca4fba05479c60b391

  • SSDEEP

    12288:7kum12MecQTjV49hdWtuL+mi18X/x0JYBOVDaW9Aqhbfxb+FM9TqCPC04:hMXecGV4dRL+/1865VD7AAbJKuO

Score
10/10

Malware Config

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\13803ebdba0993bab5f7229fd955972b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\13803ebdba0993bab5f7229fd955972b_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2896
    • C:\Users\Admin\AppData\Local\Temp\plugtemp\Service.exe
      C:\Users\Admin\AppData\Local\Temp\\plugtemp\Service.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2076
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\tasmovav.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2748
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3AD0.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc3ACF.tmp"
        3⤵
          PID:2344
      • C:\Users\Admin\AppData\Roaming\13803ebdba0993bab5f7229fd955972b_JaffaCakes1181.exe
        "C:\Users\Admin\AppData\Roaming\13803ebdba0993bab5f7229fd955972b_JaffaCakes1181.exe"
        2⤵
        • Drops startup file
        • Executes dropped EXE
        PID:2808

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\RES3AD0.tmp

      Filesize

      1KB

      MD5

      9fb5a1f7edbd6f39e72288191f93f550

      SHA1

      8d9456cecfc37a677313536042a740495ba1b8d2

      SHA256

      a998adad2854730f7be5f574289d8683444411fa4408da14292accc0556b7f31

      SHA512

      1ebaa596f08096240249f211601da6d1ab9a6f34698ff5f36d2b499a5d52dabd378ad41b0cab30eb2511f214befbbfdb7ca3f9327bb621127534bcb65ef5c791

    • C:\Users\Admin\AppData\Local\Temp\tasmovav.0.vb

      Filesize

      348B

      MD5

      d007d837b472eb92cdc46f3a1ad562ee

      SHA1

      5b4774056e716551e93e1f6aa3da377713507430

      SHA256

      3abccaba5ad2e2f2b71694b24d616ebc2bcb93cdcbd1c74cbefa8b2948d8a44a

      SHA512

      a0054bb92d69daf3a27ff5878cb86018cd7606dcf45195daf7a983580d3407328f6c19aad34375047664d7167922461368e9354a3a7310691e7ee28d05fb45cd

    • C:\Users\Admin\AppData\Local\Temp\tasmovav.cmdline

      Filesize

      235B

      MD5

      a01e48c47091811bfe2ee385d259b9ff

      SHA1

      5796e5b2a0fb93da40a6512935b01be62957cb28

      SHA256

      1779ab68c145ea285bd6ffc93c34793fa3cf330fbd2d1dee5bf4bdc84b69c083

      SHA512

      5c22cd87a220b3dca2352d5c3db544b8f93d9796509bc4584fcf26530d14d8e02a5ca8efb4a518d8e367c1d9bd21aee65994b5ec6a3f95c18fd524b09a1a6675

    • C:\Users\Admin\AppData\Local\Temp\vbc3ACF.tmp

      Filesize

      804B

      MD5

      f61654d85e74e9ca8434cc7680914cb7

      SHA1

      030242438513a7c3c199b219382aa97c02cfcff7

      SHA256

      79baf021db0ac4da858028a3fa9043bd9a93e35f3e3d58b0f7ee9505d1659fe4

      SHA512

      29835920b2e4d19ba4c06f1b367185fc3a3b27d56972fea95a2a4ddd388bf83e64c2fdc34f4db43e42a83469851412333f80986e5b56858de220ad898e2f19c0

    • C:\Users\Admin\AppData\Roaming\13803ebdba0993bab5f7229fd955972b_JaffaCakes118.exe

      Filesize

      960KB

      MD5

      13803ebdba0993bab5f7229fd955972b

      SHA1

      a5e977d4dcdd53be60f0f48910d1b92ea7628202

      SHA256

      bbd2e79112498c9b3bf4c64a4843e7f54a260136846fcb3bbf123eee9c50225f

      SHA512

      457d97542f2114f95a526ab771fca972c6cc41bc07aa4106fa75973ef429f7562dc2e0cce0b146b82648a21459424ec0a395923394cfe5ca4fba05479c60b391

    • C:\Users\Admin\AppData\Roaming\13803ebdba0993bab5f7229fd955972b_JaffaCakes1181.exe

      Filesize

      6KB

      MD5

      db253db1f3be73caf2af745cc7038fcc

      SHA1

      13e2cfc7aa0ea7661831dee7bf9f6df05b5b489c

      SHA256

      e0a223c216fb18facdd7ad79d7d78b725d2b4391e2cc9162d1206c0607102b16

      SHA512

      1decc2db0ccea9bdd3d040951e26187ac9f5dbe660a61af2cc90a23e72b7cd3efdcd1cae7392a6d2cd6cc0b9d7bbc34fa45900e2ddea44f231de71a1d346c5c3

    • \Users\Admin\AppData\Local\Temp\plugtemp\Service.exe

      Filesize

      1.1MB

      MD5

      34aa912defa18c2c129f1e09d75c1d7e

      SHA1

      9c3046324657505a30ecd9b1fdb46c05bde7d470

      SHA256

      6df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386

      SHA512

      d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98

    • memory/2076-16-0x0000000000400000-0x00000000004B6000-memory.dmp

      Filesize

      728KB

    • memory/2076-20-0x0000000000400000-0x00000000004B6000-memory.dmp

      Filesize

      728KB

    • memory/2076-64-0x0000000000400000-0x00000000004B6000-memory.dmp

      Filesize

      728KB

    • memory/2076-15-0x0000000000400000-0x00000000004B6000-memory.dmp

      Filesize

      728KB

    • memory/2076-14-0x0000000000400000-0x00000000004B6000-memory.dmp

      Filesize

      728KB

    • memory/2076-13-0x0000000000400000-0x00000000004B6000-memory.dmp

      Filesize

      728KB

    • memory/2076-12-0x0000000000400000-0x00000000004B6000-memory.dmp

      Filesize

      728KB

    • memory/2076-10-0x0000000000400000-0x00000000004B6000-memory.dmp

      Filesize

      728KB

    • memory/2076-23-0x0000000000400000-0x00000000004B6000-memory.dmp

      Filesize

      728KB

    • memory/2076-24-0x0000000000400000-0x00000000004B6000-memory.dmp

      Filesize

      728KB

    • memory/2076-27-0x0000000000400000-0x00000000004B6000-memory.dmp

      Filesize

      728KB

    • memory/2076-26-0x0000000000400000-0x00000000004B6000-memory.dmp

      Filesize

      728KB

    • memory/2076-25-0x0000000000400000-0x00000000004B6000-memory.dmp

      Filesize

      728KB

    • memory/2076-18-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2076-62-0x0000000000400000-0x00000000004B6000-memory.dmp

      Filesize

      728KB

    • memory/2076-17-0x0000000000400000-0x00000000004B6000-memory.dmp

      Filesize

      728KB

    • memory/2076-22-0x0000000000400000-0x00000000004B6000-memory.dmp

      Filesize

      728KB

    • memory/2076-8-0x0000000000400000-0x00000000004B6000-memory.dmp

      Filesize

      728KB

    • memory/2076-61-0x0000000000400000-0x00000000004B6000-memory.dmp

      Filesize

      728KB

    • memory/2076-59-0x0000000000400000-0x00000000004B6000-memory.dmp

      Filesize

      728KB

    • memory/2076-58-0x0000000000400000-0x00000000004B6000-memory.dmp

      Filesize

      728KB

    • memory/2076-56-0x0000000000400000-0x00000000004B6000-memory.dmp

      Filesize

      728KB

    • memory/2076-51-0x0000000000400000-0x00000000004B6000-memory.dmp

      Filesize

      728KB

    • memory/2076-52-0x0000000000400000-0x00000000004B6000-memory.dmp

      Filesize

      728KB

    • memory/2076-54-0x0000000000400000-0x00000000004B6000-memory.dmp

      Filesize

      728KB

    • memory/2076-55-0x0000000000400000-0x00000000004B6000-memory.dmp

      Filesize

      728KB

    • memory/2748-42-0x0000000000400000-0x000000000051E000-memory.dmp

      Filesize

      1.1MB

    • memory/2748-33-0x0000000000400000-0x000000000051E000-memory.dmp

      Filesize

      1.1MB

    • memory/2896-50-0x0000000074650000-0x0000000074BFB000-memory.dmp

      Filesize

      5.7MB

    • memory/2896-1-0x0000000074650000-0x0000000074BFB000-memory.dmp

      Filesize

      5.7MB

    • memory/2896-2-0x0000000074650000-0x0000000074BFB000-memory.dmp

      Filesize

      5.7MB

    • memory/2896-0-0x0000000074651000-0x0000000074652000-memory.dmp

      Filesize

      4KB