Analysis

  • max time kernel
    149s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    27-06-2024 22:22

General

  • Target

    17bf1dab80dbd72e6deb76b0a7e854f3_JaffaCakes118.exe

  • Size

    336KB

  • MD5

    17bf1dab80dbd72e6deb76b0a7e854f3

  • SHA1

    88357e8a37c05b139739f5d35d7afa19724ee8e0

  • SHA256

    ad469345f26ad5850bce8cca103d2ae8ef90c0da50b2f9e6696e914d1745646c

  • SHA512

    32bda4c1f6745817e44cea12b4e5569467f399769bfa7742f00ab8671a6b1cf7dd843c8ca9c3bc0e376bfcf3e4e58cd6fbc1fa4f3de254067acb075a83bedc99

  • SSDEEP

    6144:v/abvDPPofih8jWlwDJ6YIighbtPYJPzXix80G6QNEfyBFmjBYlc+eJUQvA23ss:Xn8hXx80GTayBuBYlc+IUr233

Malware Config

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • UPX packed file 14 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\17bf1dab80dbd72e6deb76b0a7e854f3_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\17bf1dab80dbd72e6deb76b0a7e854f3_JaffaCakes118.exe"
    1⤵
    • Adds policy Run key to start application
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3056
    • C:\Users\Admin\AppData\Local\Temp\17bf1dab80dbd72e6deb76b0a7e854f3_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\17bf1dab80dbd72e6deb76b0a7e854f3_JaffaCakes118.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:900

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/900-5-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/900-13-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/900-14-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/900-15-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/900-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/900-9-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/900-7-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/900-16-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/900-17-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/900-18-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/900-19-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/900-20-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/900-22-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/900-23-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/900-21-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/900-24-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB