Analysis

  • max time kernel
    149s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    27-06-2024 03:07

General

  • Target

    1473f45c4c6b87fd879f61fcec4f5b79_JaffaCakes118.exe

  • Size

    777KB

  • MD5

    1473f45c4c6b87fd879f61fcec4f5b79

  • SHA1

    02d99ad8b9c1c43ad7c908763d4dc70bb1317f78

  • SHA256

    e028bb6a42ed8c3d0eae78dd91b2d90c3aadc7eb4bd7a899136cd8f5618f8dea

  • SHA512

    a337c4bcc1bc48ee418faabbb30b6396781dadda990dcb618e49c3dfce8670cd4b96acc6da63bb042e689711bafd8cf4477b8917600fb91da6525b9d27bf22d6

  • SSDEEP

    12288:dbI6TvLwVrZjSdlAk1++5kfkWdnA9JHjPNdCCv4C5PndYOaH2cqgw64e:lTDelSbA05kcenA9NPPCCHqD2cqin

Malware Config

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 4 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1473f45c4c6b87fd879f61fcec4f5b79_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\1473f45c4c6b87fd879f61fcec4f5b79_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2932
    • C:\Users\Admin\AppData\Local\Temp\1473f45c4c6b87fd879f61fcec4f5b79_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\1473f45c4c6b87fd879f61fcec4f5b79_JaffaCakes118.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Checks BIOS information in registry
      • Loads dropped DLL
      • Adds Run key to start application
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1812
      • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
        "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2976
      • C:\Users\Admin\AppData\Roaming\Windupdt\winupate.exe
        "C:\Users\Admin\AppData\Roaming\Windupdt\winupate.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2660
        • C:\Users\Admin\AppData\Roaming\Windupdt\winupate.exe
          "C:\Users\Admin\AppData\Roaming\Windupdt\winupate.exe"
          4⤵
          • Windows security bypass
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Windows security modification
          • Checks processor information in registry
          • Enumerates system info in registry
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:2712

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\KEYGEN.EXE

    Filesize

    16KB

    MD5

    f96da3c9807cac2aab5447f4fdc352c4

    SHA1

    4b11af9324aaaf3e0dbb7ba7619dcabf3d8ffe55

    SHA256

    27f6a85fbfa1622c93b099a3a86091a240ca31180636211dfa59013fef1abd27

    SHA512

    1695e098ff5c407e74fcd6283ec9f716c95d485dfbc5fefcd29de2abe1c3d966ee5bdfd700ab2d71d67bf42c623998123582f84d10184dce3d950f6f9094577f

  • \Users\Admin\AppData\Roaming\Windupdt\winupate.exe

    Filesize

    777KB

    MD5

    1473f45c4c6b87fd879f61fcec4f5b79

    SHA1

    02d99ad8b9c1c43ad7c908763d4dc70bb1317f78

    SHA256

    e028bb6a42ed8c3d0eae78dd91b2d90c3aadc7eb4bd7a899136cd8f5618f8dea

    SHA512

    a337c4bcc1bc48ee418faabbb30b6396781dadda990dcb618e49c3dfce8670cd4b96acc6da63bb042e689711bafd8cf4477b8917600fb91da6525b9d27bf22d6

  • memory/1812-36-0x0000000000400000-0x00000000004C5000-memory.dmp

    Filesize

    788KB

  • memory/1812-4-0x0000000000400000-0x00000000004C5000-memory.dmp

    Filesize

    788KB

  • memory/1812-38-0x0000000003750000-0x0000000003825000-memory.dmp

    Filesize

    852KB

  • memory/1812-5-0x0000000000400000-0x00000000004C5000-memory.dmp

    Filesize

    788KB

  • memory/1812-9-0x0000000000400000-0x00000000004C5000-memory.dmp

    Filesize

    788KB

  • memory/1812-12-0x0000000000400000-0x00000000004C5000-memory.dmp

    Filesize

    788KB

  • memory/1812-11-0x0000000000400000-0x00000000004C5000-memory.dmp

    Filesize

    788KB

  • memory/1812-10-0x0000000000400000-0x00000000004C5000-memory.dmp

    Filesize

    788KB

  • memory/2660-47-0x0000000000400000-0x00000000004D4C00-memory.dmp

    Filesize

    851KB

  • memory/2660-39-0x0000000000400000-0x00000000004D4C00-memory.dmp

    Filesize

    851KB

  • memory/2712-50-0x0000000000400000-0x00000000004C5000-memory.dmp

    Filesize

    788KB

  • memory/2712-57-0x0000000000400000-0x00000000004C5000-memory.dmp

    Filesize

    788KB

  • memory/2712-69-0x0000000000400000-0x00000000004C5000-memory.dmp

    Filesize

    788KB

  • memory/2712-48-0x0000000000400000-0x00000000004C5000-memory.dmp

    Filesize

    788KB

  • memory/2712-68-0x0000000000400000-0x00000000004C5000-memory.dmp

    Filesize

    788KB

  • memory/2712-49-0x0000000000400000-0x00000000004C5000-memory.dmp

    Filesize

    788KB

  • memory/2712-67-0x0000000000400000-0x00000000004C5000-memory.dmp

    Filesize

    788KB

  • memory/2712-52-0x0000000000400000-0x00000000004C5000-memory.dmp

    Filesize

    788KB

  • memory/2712-55-0x0000000000400000-0x00000000004C5000-memory.dmp

    Filesize

    788KB

  • memory/2712-54-0x0000000000400000-0x00000000004C5000-memory.dmp

    Filesize

    788KB

  • memory/2712-53-0x0000000000400000-0x00000000004C5000-memory.dmp

    Filesize

    788KB

  • memory/2712-51-0x0000000000400000-0x00000000004C5000-memory.dmp

    Filesize

    788KB

  • memory/2712-56-0x0000000000400000-0x00000000004C5000-memory.dmp

    Filesize

    788KB

  • memory/2712-66-0x0000000000400000-0x00000000004C5000-memory.dmp

    Filesize

    788KB

  • memory/2712-58-0x0000000000400000-0x00000000004C5000-memory.dmp

    Filesize

    788KB

  • memory/2712-59-0x0000000000400000-0x00000000004C5000-memory.dmp

    Filesize

    788KB

  • memory/2712-60-0x0000000000400000-0x00000000004C5000-memory.dmp

    Filesize

    788KB

  • memory/2712-61-0x0000000000400000-0x00000000004C5000-memory.dmp

    Filesize

    788KB

  • memory/2712-62-0x0000000000400000-0x00000000004C5000-memory.dmp

    Filesize

    788KB

  • memory/2712-63-0x0000000000400000-0x00000000004C5000-memory.dmp

    Filesize

    788KB

  • memory/2712-64-0x0000000000400000-0x00000000004C5000-memory.dmp

    Filesize

    788KB

  • memory/2712-65-0x0000000000400000-0x00000000004C5000-memory.dmp

    Filesize

    788KB

  • memory/2932-8-0x0000000000400000-0x00000000004D4C00-memory.dmp

    Filesize

    851KB

  • memory/2932-1-0x0000000000020000-0x0000000000023000-memory.dmp

    Filesize

    12KB

  • memory/2932-0-0x0000000000400000-0x00000000004D4C00-memory.dmp

    Filesize

    851KB

  • memory/2932-6-0x0000000002670000-0x0000000002745000-memory.dmp

    Filesize

    852KB