Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-06-2024 03:13

General

  • Target

    14788f13fbdf9dca9a078e167f049348_JaffaCakes118.exe

  • Size

    1024KB

  • MD5

    14788f13fbdf9dca9a078e167f049348

  • SHA1

    919fcd377a1bc7f876b3ba90b25adc2a0d808d09

  • SHA256

    99d6639b702bcda9805095524f5feb987dd703f8c1b980977f2b6866ccb9c88d

  • SHA512

    d3741083a71fc8dbea1b2c340800d2891271da36b0f67c5d08bfbc4ecb23c82700e3a35197daf0883f655dfdaa8065b1f6876aacd54b6ef9d5d0b324a9b4d2d4

  • SSDEEP

    24576:RTibhnIkmyvFBOv034btz0MXsqafUaRzep+w/l/T9l:RGbZImk1GqAha/

Malware Config

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies firewall policy service 3 TTPs 3 IoCs
  • Modifies security service 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\14788f13fbdf9dca9a078e167f049348_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\14788f13fbdf9dca9a078e167f049348_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:656
    • C:\Users\Admin\AppData\Local\Temp\Office Home And Buisness Crack.exe
      "C:\Users\Admin\AppData\Local\Temp\Office Home And Buisness Crack.exe"
      2⤵
      • Executes dropped EXE
      PID:2500
    • C:\Users\Admin\AppData\Local\Temp\Server.exe
      "C:\Users\Admin\AppData\Local\Temp\Server.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in System32 directory
      • Suspicious use of SetThreadContext
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4256
      • C:\Windows\SysWOW64\explorer.exe
        "C:\Windows\SysWOW64\explorer.exe"
        3⤵
        • Modifies firewall policy service
        • Modifies security service
        • Windows security bypass
        • Checks BIOS information in registry
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:4636
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3712 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:2096

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Office Home And Buisness Crack.exe

      Filesize

      109KB

      MD5

      a57fde3926cc549d1e2dce186c4c69de

      SHA1

      eab6099758092c4aa748109fef256f94f23631f5

      SHA256

      ade23c84b641d036c010842dfbd451b4c5e63453b587970d79928a2e12a2b961

      SHA512

      4a6b05635f2acdd38ec75bc56546286e9b863d3757904c8b30f7c624f15f0ec9a79a4636708c8118642580002338c7cb5a36417a44c31cc2b7f6c841438b1429

    • C:\Users\Admin\AppData\Local\Temp\Server.exe

      Filesize

      635KB

      MD5

      2bd98472dc49e8f3c024330632f7489d

      SHA1

      8d94aa148634c2627e716429e694cd286f552676

      SHA256

      61775be71486b9a9853e712d1bcd69fb8aff6cc2a322ec1b483989b48c80ee4b

      SHA512

      d420098a39cefcaa9475b8aa00566af26f6915358d83b6b2337a3297abbcc27833565799b1f04d9b02df1e983188e2466859bd404a238af3645c39d3b755e4a5

    • memory/656-22-0x00007FF984580000-0x00007FF984F21000-memory.dmp

      Filesize

      9.6MB

    • memory/656-3-0x000000001B9C0000-0x000000001BA66000-memory.dmp

      Filesize

      664KB

    • memory/656-2-0x00007FF984580000-0x00007FF984F21000-memory.dmp

      Filesize

      9.6MB

    • memory/656-1-0x00007FF984580000-0x00007FF984F21000-memory.dmp

      Filesize

      9.6MB

    • memory/656-0-0x00007FF984835000-0x00007FF984836000-memory.dmp

      Filesize

      4KB

    • memory/2500-39-0x00000000054C0000-0x0000000005552000-memory.dmp

      Filesize

      584KB

    • memory/2500-25-0x00000000739EE000-0x00000000739EF000-memory.dmp

      Filesize

      4KB

    • memory/2500-26-0x00000000009B0000-0x00000000009D4000-memory.dmp

      Filesize

      144KB

    • memory/2500-46-0x00000000739EE000-0x00000000739EF000-memory.dmp

      Filesize

      4KB

    • memory/2500-28-0x0000000005420000-0x00000000054BC000-memory.dmp

      Filesize

      624KB

    • memory/2500-45-0x0000000005730000-0x0000000005786000-memory.dmp

      Filesize

      344KB

    • memory/2500-44-0x00000000053D0000-0x00000000053DA000-memory.dmp

      Filesize

      40KB

    • memory/2500-35-0x0000000005A70000-0x0000000006014000-memory.dmp

      Filesize

      5.6MB

    • memory/4256-37-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/4256-27-0x00000000006F0000-0x00000000006F1000-memory.dmp

      Filesize

      4KB

    • memory/4636-38-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/4636-33-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/4636-36-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/4636-41-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/4636-40-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/4636-42-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/4636-43-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/4636-34-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/4636-32-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB

    • memory/4636-47-0x0000000000400000-0x00000000004B0000-memory.dmp

      Filesize

      704KB