Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    27-06-2024 03:13

General

  • Target

    14788f13fbdf9dca9a078e167f049348_JaffaCakes118.exe

  • Size

    1024KB

  • MD5

    14788f13fbdf9dca9a078e167f049348

  • SHA1

    919fcd377a1bc7f876b3ba90b25adc2a0d808d09

  • SHA256

    99d6639b702bcda9805095524f5feb987dd703f8c1b980977f2b6866ccb9c88d

  • SHA512

    d3741083a71fc8dbea1b2c340800d2891271da36b0f67c5d08bfbc4ecb23c82700e3a35197daf0883f655dfdaa8065b1f6876aacd54b6ef9d5d0b324a9b4d2d4

  • SSDEEP

    24576:RTibhnIkmyvFBOv034btz0MXsqafUaRzep+w/l/T9l:RGbZImk1GqAha/

Malware Config

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies firewall policy service 3 TTPs 6 IoCs
  • Modifies security service 2 TTPs 2 IoCs
  • Windows security bypass 2 TTPs 2 IoCs
  • Checks BIOS information in registry 2 TTPs 3 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 2 IoCs
  • Windows security modification 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 12 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\14788f13fbdf9dca9a078e167f049348_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\14788f13fbdf9dca9a078e167f049348_JaffaCakes118.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2212
    • C:\Users\Admin\AppData\Local\Temp\Office Home And Buisness Crack.exe
      "C:\Users\Admin\AppData\Local\Temp\Office Home And Buisness Crack.exe"
      2⤵
      • Executes dropped EXE
      PID:2740
    • C:\Users\Admin\AppData\Local\Temp\Server.exe
      "C:\Users\Admin\AppData\Local\Temp\Server.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3000
      • C:\Windows\SysWOW64\explorer.exe
        "C:\Windows\SysWOW64\explorer.exe"
        3⤵
          PID:2712
        • C:\Windows\system32\LogFiles\luvme.exe
          "C:\Windows\system32\LogFiles\luvme.exe"
          3⤵
          • Modifies firewall policy service
          • Modifies security service
          • Windows security bypass
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Windows security modification
          • Suspicious use of SetThreadContext
          • Checks processor information in registry
          • Enumerates system info in registry
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2556
          • C:\Windows\SysWOW64\explorer.exe
            "C:\Windows\SysWOW64\explorer.exe"
            4⤵
            • Modifies firewall policy service
            • Modifies security service
            • Windows security bypass
            • Checks BIOS information in registry
            • Checks processor information in registry
            • Enumerates system info in registry
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:2612

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Office Home And Buisness Crack.exe

      Filesize

      109KB

      MD5

      a57fde3926cc549d1e2dce186c4c69de

      SHA1

      eab6099758092c4aa748109fef256f94f23631f5

      SHA256

      ade23c84b641d036c010842dfbd451b4c5e63453b587970d79928a2e12a2b961

      SHA512

      4a6b05635f2acdd38ec75bc56546286e9b863d3757904c8b30f7c624f15f0ec9a79a4636708c8118642580002338c7cb5a36417a44c31cc2b7f6c841438b1429

    • C:\Users\Admin\AppData\Local\Temp\Server.exe

      Filesize

      635KB

      MD5

      2bd98472dc49e8f3c024330632f7489d

      SHA1

      8d94aa148634c2627e716429e694cd286f552676

      SHA256

      61775be71486b9a9853e712d1bcd69fb8aff6cc2a322ec1b483989b48c80ee4b

      SHA512

      d420098a39cefcaa9475b8aa00566af26f6915358d83b6b2337a3297abbcc27833565799b1f04d9b02df1e983188e2466859bd404a238af3645c39d3b755e4a5

    • memory/2212-0-0x000007FEF5D3E000-0x000007FEF5D3F000-memory.dmp

      Filesize

      4KB

    • memory/2212-2-0x000007FEF5A80000-0x000007FEF641D000-memory.dmp

      Filesize

      9.6MB

    • memory/2212-15-0x000007FEF5A80000-0x000007FEF641D000-memory.dmp

      Filesize

      9.6MB

    • memory/2556-36-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2612-32-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2612-37-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2612-35-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2612-34-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2612-38-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2612-41-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2612-40-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2612-39-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2612-42-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/2740-17-0x0000000000E60000-0x0000000000E84000-memory.dmp

      Filesize

      144KB

    • memory/2740-16-0x000000007454E000-0x000000007454F000-memory.dmp

      Filesize

      4KB

    • memory/2740-43-0x000000007454E000-0x000000007454F000-memory.dmp

      Filesize

      4KB

    • memory/3000-30-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB