Analysis

  • max time kernel
    133s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    27-06-2024 08:21

General

  • Target

    154e078a01c64594670fc142909254ee_JaffaCakes118.exe

  • Size

    723KB

  • MD5

    154e078a01c64594670fc142909254ee

  • SHA1

    22cae4c77eb6e3ff4163b39b65dafceb935e1f11

  • SHA256

    7c76299e3ac43fd7282eb0a981138f2e4e8a6521cc2ba7486049c8c92ad68900

  • SHA512

    323d1ac93b1676834c21d267f23a0e08aced1677fe939cc8d205d3a49da3c834729799a7f31983cfae16da1e5908093481732653cb8aa7bbdd70ba8968a3c172

  • SSDEEP

    12288:7FLlJnnbWOtz6sVJhvaz1Qc/WdI//vfM4qwrbkniafBo6vnTylKM/q9jJr:Z3nbWmJVJFwSddIXvfhqbia/v2jq9V

Malware Config

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies firewall policy service 3 TTPs 3 IoCs
  • Modifies security service 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 2 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Disables Task Manager via registry modification
  • Sets file to hidden 1 TTPs 2 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs
  • System policy modification 1 TTPs 3 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\154e078a01c64594670fc142909254ee_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\154e078a01c64594670fc142909254ee_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1212
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2688
      • C:\Windows\SysWOW64\attrib.exe
        attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
        3⤵
        • Sets file to hidden
        • Views/modifies file attributes
        PID:1112
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2872
      • C:\Windows\SysWOW64\attrib.exe
        attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
        3⤵
        • Sets file to hidden
        • Views/modifies file attributes
        PID:2712
    • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
      "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
      2⤵
      • Modifies firewall policy service
      • Modifies security service
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Adds Run key to start application
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • System policy modification
      PID:2768

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat

    Filesize

    101B

    MD5

    8734f7e235865690196a15b301d7adb5

    SHA1

    a684328c2a5bc40cd020832330a82085c4e0722a

    SHA256

    1461e7548c2d87c8eac0d9dded0e8b5d4c9008da701a3e4bf2a76e0bbfaf65f9

    SHA512

    45450daae5227fee95339b78721b99d3270206fddc20a1022b6790bd2f3a8b0cecd6463b8fe0fd2045fd6e29b0c2161e12c7e3550290b3a31ffc05d37b0a2110

  • C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat

    Filesize

    50B

    MD5

    b774ae3fb1da087e1f83b4f7b2060e5a

    SHA1

    97eb9be49ac3af9c851c9e1e84e32bfd53e325a8

    SHA256

    adaf4a84b41e410b02e261cfd0fe7739d98647eab73c3badd32ac6e39f26351b

    SHA512

    f75d0f95f7306d26a12b414bfe37b97fbd37546cb3c6e403def7077329ddffb4b45d5c5f0ba0e7bb6d72851d2d691b0a85267beead42f7cbf2e8c3d45a3b4701

  • \Users\Admin\Documents\MSDCSC\msdcsc.exe

    Filesize

    723KB

    MD5

    154e078a01c64594670fc142909254ee

    SHA1

    22cae4c77eb6e3ff4163b39b65dafceb935e1f11

    SHA256

    7c76299e3ac43fd7282eb0a981138f2e4e8a6521cc2ba7486049c8c92ad68900

    SHA512

    323d1ac93b1676834c21d267f23a0e08aced1677fe939cc8d205d3a49da3c834729799a7f31983cfae16da1e5908093481732653cb8aa7bbdd70ba8968a3c172

  • memory/1212-0-0x00000000003F0000-0x00000000003F1000-memory.dmp

    Filesize

    4KB

  • memory/1212-29-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/2768-33-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/2768-37-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/2768-32-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/2768-30-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/2768-34-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/2768-35-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/2768-36-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/2768-31-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/2768-38-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/2768-39-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/2768-40-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/2768-41-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/2768-42-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/2768-43-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB