Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-06-2024 03:07

General

  • Target

    1473f45c4c6b87fd879f61fcec4f5b79_JaffaCakes118.exe

  • Size

    777KB

  • MD5

    1473f45c4c6b87fd879f61fcec4f5b79

  • SHA1

    02d99ad8b9c1c43ad7c908763d4dc70bb1317f78

  • SHA256

    e028bb6a42ed8c3d0eae78dd91b2d90c3aadc7eb4bd7a899136cd8f5618f8dea

  • SHA512

    a337c4bcc1bc48ee418faabbb30b6396781dadda990dcb618e49c3dfce8670cd4b96acc6da63bb042e689711bafd8cf4477b8917600fb91da6525b9d27bf22d6

  • SSDEEP

    12288:dbI6TvLwVrZjSdlAk1++5kfkWdnA9JHjPNdCCv4C5PndYOaH2cqgw64e:lTDelSbA05kcenA9NPPCCHqD2cqin

Malware Config

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1473f45c4c6b87fd879f61fcec4f5b79_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\1473f45c4c6b87fd879f61fcec4f5b79_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3512
    • C:\Users\Admin\AppData\Local\Temp\1473f45c4c6b87fd879f61fcec4f5b79_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\1473f45c4c6b87fd879f61fcec4f5b79_JaffaCakes118.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Checks BIOS information in registry
      • Checks computer location settings
      • Adds Run key to start application
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:904
      • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE
        "C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:3704
      • C:\Users\Admin\AppData\Roaming\Windupdt\winupate.exe
        "C:\Users\Admin\AppData\Roaming\Windupdt\winupate.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2476
        • C:\Users\Admin\AppData\Roaming\Windupdt\winupate.exe
          "C:\Users\Admin\AppData\Roaming\Windupdt\winupate.exe"
          4⤵
          • Windows security bypass
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Windows security modification
          • Checks processor information in registry
          • Enumerates system info in registry
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:5060
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3852,i,1067197275908310731,12785105794523264014,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:8
    1⤵
      PID:3592

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\KEYGEN.EXE

      Filesize

      16KB

      MD5

      f96da3c9807cac2aab5447f4fdc352c4

      SHA1

      4b11af9324aaaf3e0dbb7ba7619dcabf3d8ffe55

      SHA256

      27f6a85fbfa1622c93b099a3a86091a240ca31180636211dfa59013fef1abd27

      SHA512

      1695e098ff5c407e74fcd6283ec9f716c95d485dfbc5fefcd29de2abe1c3d966ee5bdfd700ab2d71d67bf42c623998123582f84d10184dce3d950f6f9094577f

    • C:\Users\Admin\AppData\Roaming\Windupdt\winupate.exe

      Filesize

      777KB

      MD5

      1473f45c4c6b87fd879f61fcec4f5b79

      SHA1

      02d99ad8b9c1c43ad7c908763d4dc70bb1317f78

      SHA256

      e028bb6a42ed8c3d0eae78dd91b2d90c3aadc7eb4bd7a899136cd8f5618f8dea

      SHA512

      a337c4bcc1bc48ee418faabbb30b6396781dadda990dcb618e49c3dfce8670cd4b96acc6da63bb042e689711bafd8cf4477b8917600fb91da6525b9d27bf22d6

    • memory/904-5-0x0000000000400000-0x00000000004C5000-memory.dmp

      Filesize

      788KB

    • memory/904-6-0x0000000000400000-0x00000000004C5000-memory.dmp

      Filesize

      788KB

    • memory/904-9-0x0000000000400000-0x00000000004C5000-memory.dmp

      Filesize

      788KB

    • memory/904-10-0x0000000000400000-0x00000000004C5000-memory.dmp

      Filesize

      788KB

    • memory/904-4-0x0000000000400000-0x00000000004C5000-memory.dmp

      Filesize

      788KB

    • memory/904-35-0x0000000000400000-0x00000000004C5000-memory.dmp

      Filesize

      788KB

    • memory/2476-48-0x0000000000400000-0x00000000004D4C00-memory.dmp

      Filesize

      851KB

    • memory/2476-39-0x0000000000400000-0x00000000004D4C00-memory.dmp

      Filesize

      851KB

    • memory/3512-8-0x0000000000400000-0x00000000004D4C00-memory.dmp

      Filesize

      851KB

    • memory/3512-1-0x00000000001C0000-0x00000000001C3000-memory.dmp

      Filesize

      12KB

    • memory/3512-0-0x0000000000400000-0x00000000004D4C00-memory.dmp

      Filesize

      851KB

    • memory/5060-51-0x0000000000400000-0x00000000004C5000-memory.dmp

      Filesize

      788KB

    • memory/5060-58-0x0000000000400000-0x00000000004C5000-memory.dmp

      Filesize

      788KB

    • memory/5060-46-0x0000000000400000-0x00000000004C5000-memory.dmp

      Filesize

      788KB

    • memory/5060-45-0x0000000000400000-0x00000000004C5000-memory.dmp

      Filesize

      788KB

    • memory/5060-54-0x0000000000400000-0x00000000004C5000-memory.dmp

      Filesize

      788KB

    • memory/5060-52-0x0000000000400000-0x00000000004C5000-memory.dmp

      Filesize

      788KB

    • memory/5060-50-0x0000000000400000-0x00000000004C5000-memory.dmp

      Filesize

      788KB

    • memory/5060-53-0x0000000000400000-0x00000000004C5000-memory.dmp

      Filesize

      788KB

    • memory/5060-55-0x0000000000400000-0x00000000004C5000-memory.dmp

      Filesize

      788KB

    • memory/5060-56-0x0000000000400000-0x00000000004C5000-memory.dmp

      Filesize

      788KB

    • memory/5060-57-0x0000000000400000-0x00000000004C5000-memory.dmp

      Filesize

      788KB

    • memory/5060-49-0x0000000000400000-0x00000000004C5000-memory.dmp

      Filesize

      788KB

    • memory/5060-59-0x0000000000400000-0x00000000004C5000-memory.dmp

      Filesize

      788KB

    • memory/5060-60-0x0000000000400000-0x00000000004C5000-memory.dmp

      Filesize

      788KB

    • memory/5060-61-0x0000000000400000-0x00000000004C5000-memory.dmp

      Filesize

      788KB

    • memory/5060-62-0x0000000000400000-0x00000000004C5000-memory.dmp

      Filesize

      788KB

    • memory/5060-63-0x0000000000400000-0x00000000004C5000-memory.dmp

      Filesize

      788KB

    • memory/5060-64-0x0000000000400000-0x00000000004C5000-memory.dmp

      Filesize

      788KB

    • memory/5060-65-0x0000000000400000-0x00000000004C5000-memory.dmp

      Filesize

      788KB

    • memory/5060-66-0x0000000000400000-0x00000000004C5000-memory.dmp

      Filesize

      788KB

    • memory/5060-67-0x0000000000400000-0x00000000004C5000-memory.dmp

      Filesize

      788KB

    • memory/5060-68-0x0000000000400000-0x00000000004C5000-memory.dmp

      Filesize

      788KB