Analysis

  • max time kernel
    150s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    27-06-2024 01:59

General

  • Target

    144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe

  • Size

    3.1MB

  • MD5

    144769859640eab70ec9ed969401e8e3

  • SHA1

    cb6603e8867a74d2d27059cdc47438cf2340920a

  • SHA256

    7a9776c90605606de12e06a0088cbf44c12e8be266c13c5894304eda81035711

  • SHA512

    9a9d4b67a04ef8a1cbea7bc2574dbc42db6e1460650b951a322d62e6e92c64b3ee6924ce0bec5664a4c4668224f62a5ca1d3ed81430a77d31e40fb56c7fdbbef

  • SSDEEP

    24576:9lW4wul8bp7gzsRMgZsdfbk/OwSsvKf1ympTTdD+dFCx2gdtsdsqo:9lW4wulcgGMos6ONsydympTZD+3CXw

Malware Config

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies firewall policy service 3 TTPs 3 IoCs
  • Modifies security service 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 2 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Disables Task Manager via registry modification
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 2 IoCs
  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 61 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\144769859640eab70ec9ed969401e8e3_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Writes to the Master Boot Record (MBR)
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2124
    • C:\Windows\SysWOW64\notepad.exe
      notepad
      2⤵
      • Adds Run key to start application
      PID:2700
    • C:\Users\Admin\AppData\Local\Temp\BROUF_POP.EXE
      "C:\Users\Admin\AppData\Local\Temp\BROUF_POP.EXE"
      2⤵
      • Executes dropped EXE
      PID:2540
    • C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\SysWOW64\explorer.exe"
      2⤵
      • Modifies firewall policy service
      • Modifies security service
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Checks BIOS information in registry
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Writes to the Master Boot Record (MBR)
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2480
      • C:\Windows\SysWOW64\notepad.exe
        C:\Windows\SysWOW64\notepad.exe
        3⤵
          PID:1988
        • C:\Users\Admin\AppData\Local\Temp\BROUF_POP.EXE
          "C:\Users\Admin\AppData\Local\Temp\BROUF_POP.EXE"
          3⤵
          • Executes dropped EXE
          PID:1628

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\BsDD_tmp

      Filesize

      260B

      MD5

      d98926e26231d491cd5d40854453f3cf

      SHA1

      3a3a1d71b37b7c8b54a80a7917c12c63ba2480fd

      SHA256

      8f523b0f039109f042f5a0a807ae36a1cde13ee7a9512bb746e2c6e8bf90beab

      SHA512

      565e295523e06a56507ea6096d23f0ce2a00acd5c376b3badea4f6aa591991b5e21c831d45e24b33f34d4dcf7eaa5263077cf86f9d905952ff944aab6d11399a

    • C:\setup

      Filesize

      3.1MB

      MD5

      144769859640eab70ec9ed969401e8e3

      SHA1

      cb6603e8867a74d2d27059cdc47438cf2340920a

      SHA256

      7a9776c90605606de12e06a0088cbf44c12e8be266c13c5894304eda81035711

      SHA512

      9a9d4b67a04ef8a1cbea7bc2574dbc42db6e1460650b951a322d62e6e92c64b3ee6924ce0bec5664a4c4668224f62a5ca1d3ed81430a77d31e40fb56c7fdbbef

    • \Users\Admin\AppData\Local\Temp\BROUF_POP.EXE

      Filesize

      323KB

      MD5

      3bed4a376b5fce52fc08539e95ae369f

      SHA1

      feb471bdf3f78a2140fecfa474eda876e3f75e78

      SHA256

      7cb7d9efb92bfbb8aaee1df39c63a02092c6e6552bec1fd0cda3c68c3eb2d034

      SHA512

      e25578774eac1d88b883c32446096e7b882fcb4256b901ae8cba277a6f1ba948a311e61f64ee5d43661e72f72f5c96aacdc285176304df5a0867ea39669c62b7

    • memory/2124-1-0x0000000013141000-0x000000001318D000-memory.dmp

      Filesize

      304KB

    • memory/2124-2-0x0000000013140000-0x000000001340F000-memory.dmp

      Filesize

      2.8MB

    • memory/2124-3-0x0000000013140000-0x000000001340F000-memory.dmp

      Filesize

      2.8MB

    • memory/2124-6-0x0000000013140000-0x000000001340F000-memory.dmp

      Filesize

      2.8MB

    • memory/2124-5-0x0000000013140000-0x000000001340F000-memory.dmp

      Filesize

      2.8MB

    • memory/2124-0-0x0000000013140000-0x000000001340F000-memory.dmp

      Filesize

      2.8MB

    • memory/2124-37-0x0000000013140000-0x000000001340F000-memory.dmp

      Filesize

      2.8MB

    • memory/2124-68-0x0000000013140000-0x000000001340F000-memory.dmp

      Filesize

      2.8MB

    • memory/2124-40-0x0000000013140000-0x000000001340F000-memory.dmp

      Filesize

      2.8MB

    • memory/2480-85-0x0000000013140000-0x000000001340F000-memory.dmp

      Filesize

      2.8MB

    • memory/2480-86-0x0000000013140000-0x000000001340F000-memory.dmp

      Filesize

      2.8MB

    • memory/2480-64-0x0000000013140000-0x000000001340F000-memory.dmp

      Filesize

      2.8MB

    • memory/2480-69-0x0000000013140000-0x000000001340F000-memory.dmp

      Filesize

      2.8MB

    • memory/2480-158-0x0000000013140000-0x000000001340F000-memory.dmp

      Filesize

      2.8MB

    • memory/2480-67-0x0000000013140000-0x000000001340F000-memory.dmp

      Filesize

      2.8MB

    • memory/2480-62-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2480-70-0x0000000013140000-0x000000001340F000-memory.dmp

      Filesize

      2.8MB

    • memory/2480-71-0x0000000013140000-0x000000001340F000-memory.dmp

      Filesize

      2.8MB

    • memory/2480-82-0x0000000013140000-0x000000001340F000-memory.dmp

      Filesize

      2.8MB

    • memory/2480-94-0x0000000013140000-0x000000001340F000-memory.dmp

      Filesize

      2.8MB

    • memory/2480-93-0x0000000013140000-0x000000001340F000-memory.dmp

      Filesize

      2.8MB

    • memory/2480-92-0x0000000013140000-0x000000001340F000-memory.dmp

      Filesize

      2.8MB

    • memory/2480-91-0x0000000013140000-0x000000001340F000-memory.dmp

      Filesize

      2.8MB

    • memory/2480-90-0x0000000013140000-0x000000001340F000-memory.dmp

      Filesize

      2.8MB

    • memory/2480-88-0x0000000013140000-0x000000001340F000-memory.dmp

      Filesize

      2.8MB

    • memory/2480-87-0x0000000013140000-0x000000001340F000-memory.dmp

      Filesize

      2.8MB

    • memory/2480-61-0x0000000013140000-0x000000001340F000-memory.dmp

      Filesize

      2.8MB

    • memory/2480-84-0x0000000013140000-0x000000001340F000-memory.dmp

      Filesize

      2.8MB

    • memory/2480-89-0x0000000013140000-0x000000001340F000-memory.dmp

      Filesize

      2.8MB

    • memory/2480-83-0x0000000013140000-0x000000001340F000-memory.dmp

      Filesize

      2.8MB

    • memory/2480-81-0x0000000013140000-0x000000001340F000-memory.dmp

      Filesize

      2.8MB

    • memory/2480-80-0x0000000013140000-0x000000001340F000-memory.dmp

      Filesize

      2.8MB

    • memory/2480-78-0x0000000013140000-0x000000001340F000-memory.dmp

      Filesize

      2.8MB

    • memory/2480-77-0x0000000013140000-0x000000001340F000-memory.dmp

      Filesize

      2.8MB

    • memory/2480-74-0x0000000013140000-0x000000001340F000-memory.dmp

      Filesize

      2.8MB

    • memory/2480-73-0x0000000013140000-0x000000001340F000-memory.dmp

      Filesize

      2.8MB

    • memory/2480-72-0x0000000013140000-0x000000001340F000-memory.dmp

      Filesize

      2.8MB

    • memory/2480-79-0x0000000013140000-0x000000001340F000-memory.dmp

      Filesize

      2.8MB

    • memory/2480-75-0x0000000013140000-0x000000001340F000-memory.dmp

      Filesize

      2.8MB

    • memory/2480-76-0x0000000013140000-0x000000001340F000-memory.dmp

      Filesize

      2.8MB

    • memory/2480-95-0x0000000013140000-0x000000001340F000-memory.dmp

      Filesize

      2.8MB

    • memory/2480-96-0x0000000013140000-0x000000001340F000-memory.dmp

      Filesize

      2.8MB

    • memory/2700-35-0x0000000000230000-0x0000000000231000-memory.dmp

      Filesize

      4KB

    • memory/2700-7-0x0000000000080000-0x0000000000081000-memory.dmp

      Filesize

      4KB