Analysis

  • max time kernel
    149s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    27-06-2024 06:20

General

  • Target

    14f834063c40133fdefcdbd19a7812c8_JaffaCakes118.exe

  • Size

    758KB

  • MD5

    14f834063c40133fdefcdbd19a7812c8

  • SHA1

    1160b1bf5c5ad7da930e61cb551567d46c776978

  • SHA256

    ca49d40f50afa04de7070c16f4c85a92eeed5e5dcbb03b59d0c416f2b5fa2d92

  • SHA512

    883565109505dc171247f8dcfd1d98b9043308055e8bd1be3c2efee8dee90fdd32a85be476259f29047ac8bf9f0334bfef96c79cd7b10a40c010ebfbbe99bcf1

  • SSDEEP

    12288:yzSF3nFo/1NATB7Ilv18BqIWioYcpVVpEeiO0kDjy6eindvQr:zpnqfATtIEiCGpxioS2Qr

Score
10/10

Malware Config

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Uses the VBS compiler for execution 1 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\14f834063c40133fdefcdbd19a7812c8_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\14f834063c40133fdefcdbd19a7812c8_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2756
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      2⤵
      • Checks BIOS information in registry
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious use of AdjustPrivilegeToken
      PID:2408

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2408-27-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/2408-3-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/2408-25-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/2408-26-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/2408-5-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/2408-9-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/2408-11-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/2408-22-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/2408-21-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/2408-19-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2408-17-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/2408-15-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/2408-13-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/2408-7-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/2408-23-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/2408-44-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/2408-43-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/2408-42-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/2408-41-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/2408-29-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/2408-28-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/2408-30-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/2408-31-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/2408-32-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/2408-33-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/2408-34-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/2408-35-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/2408-36-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/2408-37-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/2408-38-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/2408-39-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/2408-40-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/2756-1-0x0000000074F60000-0x000000007550B000-memory.dmp

    Filesize

    5.7MB

  • memory/2756-0-0x0000000074F61000-0x0000000074F62000-memory.dmp

    Filesize

    4KB

  • memory/2756-2-0x0000000074F60000-0x000000007550B000-memory.dmp

    Filesize

    5.7MB

  • memory/2756-24-0x0000000074F60000-0x000000007550B000-memory.dmp

    Filesize

    5.7MB