Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
27-06-2024 10:49
Static task
static1
Behavioral task
behavioral1
Sample
15b7e0abf99ca0d676029e8b22498209_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
15b7e0abf99ca0d676029e8b22498209_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
15b7e0abf99ca0d676029e8b22498209_JaffaCakes118.exe
-
Size
1.2MB
-
MD5
15b7e0abf99ca0d676029e8b22498209
-
SHA1
81ddddb411c2e52c38756d2844b9697655884bb4
-
SHA256
1b42202ece42ad388bfc7130f23945748a26ef286e8478e3f800d7f552fe340f
-
SHA512
025330e1576eb9010f77df11404f984bebcfa7dbef3ec543bc6cfdcbb4c623495b4963c4c7e088dda418eb8b6c734e4b297f69d5668b38598310498b5ad346c4
-
SSDEEP
24576:K9b43KRo7xvu2Ui+mBvqvtEWvRk8Ml6uOdbI:e4ay7xui/wRk9suQE
Malware Config
Extracted
darkcomet
Victim
hackingrats.no-ip.biz:1604
DCMIN_MUTEX-KXAVH1D
-
InstallPath
System32.exe
-
gencode
DERuPJ12yzN9
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
DarkComet RAT
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\System32.exe" vbc.exe -
Executes dropped EXE 2 IoCs
Processes:
vbc.exeSystem32.exepid process 1664 vbc.exe 2516 System32.exe -
Loads dropped DLL 2 IoCs
Processes:
15b7e0abf99ca0d676029e8b22498209_JaffaCakes118.exevbc.exepid process 2096 15b7e0abf99ca0d676029e8b22498209_JaffaCakes118.exe 1664 vbc.exe -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
vbc.exe15b7e0abf99ca0d676029e8b22498209_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\DarkComet RAT = "C:\\Windows\\system32\\System32.exe" vbc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\JavaUpdtr = "C:\\Users\\Admin\\AppData\\Roaming\\JavaUpdtr\\15b7e0abf99ca0d676029e8b22498209_JaffaCakes118.exe" 15b7e0abf99ca0d676029e8b22498209_JaffaCakes118.exe -
Drops file in System32 directory 2 IoCs
Processes:
vbc.exedescription ioc process File opened for modification C:\Windows\SysWOW64\System32.exe vbc.exe File created C:\Windows\SysWOW64\System32.exe vbc.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
15b7e0abf99ca0d676029e8b22498209_JaffaCakes118.exedescription pid process target process PID 2096 set thread context of 1664 2096 15b7e0abf99ca0d676029e8b22498209_JaffaCakes118.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
vbc.exedescription pid process Token: SeIncreaseQuotaPrivilege 1664 vbc.exe Token: SeSecurityPrivilege 1664 vbc.exe Token: SeTakeOwnershipPrivilege 1664 vbc.exe Token: SeLoadDriverPrivilege 1664 vbc.exe Token: SeSystemProfilePrivilege 1664 vbc.exe Token: SeSystemtimePrivilege 1664 vbc.exe Token: SeProfSingleProcessPrivilege 1664 vbc.exe Token: SeIncBasePriorityPrivilege 1664 vbc.exe Token: SeCreatePagefilePrivilege 1664 vbc.exe Token: SeBackupPrivilege 1664 vbc.exe Token: SeRestorePrivilege 1664 vbc.exe Token: SeShutdownPrivilege 1664 vbc.exe Token: SeDebugPrivilege 1664 vbc.exe Token: SeSystemEnvironmentPrivilege 1664 vbc.exe Token: SeChangeNotifyPrivilege 1664 vbc.exe Token: SeRemoteShutdownPrivilege 1664 vbc.exe Token: SeUndockPrivilege 1664 vbc.exe Token: SeManageVolumePrivilege 1664 vbc.exe Token: SeImpersonatePrivilege 1664 vbc.exe Token: SeCreateGlobalPrivilege 1664 vbc.exe Token: 33 1664 vbc.exe Token: 34 1664 vbc.exe Token: 35 1664 vbc.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
15b7e0abf99ca0d676029e8b22498209_JaffaCakes118.exevbc.exedescription pid process target process PID 2096 wrote to memory of 1664 2096 15b7e0abf99ca0d676029e8b22498209_JaffaCakes118.exe vbc.exe PID 2096 wrote to memory of 1664 2096 15b7e0abf99ca0d676029e8b22498209_JaffaCakes118.exe vbc.exe PID 2096 wrote to memory of 1664 2096 15b7e0abf99ca0d676029e8b22498209_JaffaCakes118.exe vbc.exe PID 2096 wrote to memory of 1664 2096 15b7e0abf99ca0d676029e8b22498209_JaffaCakes118.exe vbc.exe PID 2096 wrote to memory of 1664 2096 15b7e0abf99ca0d676029e8b22498209_JaffaCakes118.exe vbc.exe PID 2096 wrote to memory of 1664 2096 15b7e0abf99ca0d676029e8b22498209_JaffaCakes118.exe vbc.exe PID 2096 wrote to memory of 1664 2096 15b7e0abf99ca0d676029e8b22498209_JaffaCakes118.exe vbc.exe PID 2096 wrote to memory of 1664 2096 15b7e0abf99ca0d676029e8b22498209_JaffaCakes118.exe vbc.exe PID 2096 wrote to memory of 1664 2096 15b7e0abf99ca0d676029e8b22498209_JaffaCakes118.exe vbc.exe PID 2096 wrote to memory of 1664 2096 15b7e0abf99ca0d676029e8b22498209_JaffaCakes118.exe vbc.exe PID 2096 wrote to memory of 1664 2096 15b7e0abf99ca0d676029e8b22498209_JaffaCakes118.exe vbc.exe PID 2096 wrote to memory of 1664 2096 15b7e0abf99ca0d676029e8b22498209_JaffaCakes118.exe vbc.exe PID 2096 wrote to memory of 1664 2096 15b7e0abf99ca0d676029e8b22498209_JaffaCakes118.exe vbc.exe PID 1664 wrote to memory of 2516 1664 vbc.exe System32.exe PID 1664 wrote to memory of 2516 1664 vbc.exe System32.exe PID 1664 wrote to memory of 2516 1664 vbc.exe System32.exe PID 1664 wrote to memory of 2516 1664 vbc.exe System32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\15b7e0abf99ca0d676029e8b22498209_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\15b7e0abf99ca0d676029e8b22498209_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\vbc.exeC:\Users\Admin\AppData\Local\Temp\vbc.exe2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Windows\SysWOW64\System32.exe"C:\Windows\system32\System32.exe"3⤵
- Executes dropped EXE
PID:2516
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98