Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    27-06-2024 11:20

General

  • Target

    15ce45fdf58db94c01d9379c4f0148f2_JaffaCakes118.exe

  • Size

    616KB

  • MD5

    15ce45fdf58db94c01d9379c4f0148f2

  • SHA1

    74aa27d81f3a3d1cf544f6b2c6e8ea160654fac0

  • SHA256

    8439f3656b12b448b15f43c7ea8a8871ea978aaa3f3140af622682d0ac06b8ce

  • SHA512

    651fe20068e868a418cb64af078470be30017fa71d25bca9a1781511f2b135bc71a7ab4a71e7401e11fc20f536b8aecb982ff131f390ca0c135ac2f9336f346f

  • SSDEEP

    12288:YePwlp7/N0+OLbetJZv5m0/VyVz9ZPYHm1GjD2JSmJVRC:fmS+OEZvMQAFAmMeJSmfw

Malware Config

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Modifies firewall policy service 3 TTPs 3 IoCs
  • Disables Task Manager via registry modification
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\15ce45fdf58db94c01d9379c4f0148f2_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\15ce45fdf58db94c01d9379c4f0148f2_JaffaCakes118.exe"
    1⤵
    • Modifies firewall policy service
    • Checks BIOS information in registry
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    PID:2108
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
    1⤵
    • Suspicious use of FindShellTrayWindow
    PID:1728

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\74696_340604496000945_100001541931043_1045151_1600342123_N.JPG

    Filesize

    17KB

    MD5

    2870e9e67d6d096fc68d5f4142f2c330

    SHA1

    81c2762a80b0780fb7ede89fc86cc3d9fc23a645

    SHA256

    0b175cd519a4e8323a6f335abbc65c450af719e72e3f34280ffc6f896887eec9

    SHA512

    caf2e2c12beace47ca7fdeaa27da3d0cef1a5e7aa103e71ebec06b4a7573a6fcadbfa501f1b1b65e9bb42351b39260009a1ff73f85346c66584769894960e5a0

  • memory/1728-9-0x00000000001E0000-0x00000000001E2000-memory.dmp

    Filesize

    8KB

  • memory/1728-10-0x0000000076040000-0x0000000076150000-memory.dmp

    Filesize

    1.1MB

  • memory/2108-13-0x0000000000260000-0x00000000002AE000-memory.dmp

    Filesize

    312KB

  • memory/2108-15-0x0000000000400000-0x00000000004EB000-memory.dmp

    Filesize

    940KB

  • memory/2108-4-0x00000000770C0000-0x00000000770C1000-memory.dmp

    Filesize

    4KB

  • memory/2108-6-0x0000000076040000-0x0000000076150000-memory.dmp

    Filesize

    1.1MB

  • memory/2108-8-0x0000000003E40000-0x0000000003E42000-memory.dmp

    Filesize

    8KB

  • memory/2108-2-0x0000000000400000-0x00000000004EB000-memory.dmp

    Filesize

    940KB

  • memory/2108-3-0x00000000005A0000-0x00000000005B0000-memory.dmp

    Filesize

    64KB

  • memory/2108-0-0x0000000000230000-0x0000000000231000-memory.dmp

    Filesize

    4KB

  • memory/2108-12-0x0000000000400000-0x00000000004EB000-memory.dmp

    Filesize

    940KB

  • memory/2108-1-0x0000000000260000-0x00000000002AE000-memory.dmp

    Filesize

    312KB

  • memory/2108-14-0x00000000005A0000-0x00000000005B0000-memory.dmp

    Filesize

    64KB

  • memory/2108-5-0x0000000076051000-0x0000000076052000-memory.dmp

    Filesize

    4KB

  • memory/2108-16-0x0000000000400000-0x00000000004EB000-memory.dmp

    Filesize

    940KB

  • memory/2108-17-0x0000000000400000-0x00000000004EB000-memory.dmp

    Filesize

    940KB

  • memory/2108-18-0x0000000000400000-0x00000000004EB000-memory.dmp

    Filesize

    940KB

  • memory/2108-19-0x0000000000400000-0x00000000004EB000-memory.dmp

    Filesize

    940KB

  • memory/2108-20-0x0000000000400000-0x00000000004EB000-memory.dmp

    Filesize

    940KB

  • memory/2108-21-0x0000000000400000-0x00000000004EB000-memory.dmp

    Filesize

    940KB

  • memory/2108-22-0x0000000000400000-0x00000000004EB000-memory.dmp

    Filesize

    940KB

  • memory/2108-23-0x0000000000400000-0x00000000004EB000-memory.dmp

    Filesize

    940KB

  • memory/2108-24-0x0000000000400000-0x00000000004EB000-memory.dmp

    Filesize

    940KB

  • memory/2108-25-0x0000000000400000-0x00000000004EB000-memory.dmp

    Filesize

    940KB

  • memory/2108-26-0x0000000000400000-0x00000000004EB000-memory.dmp

    Filesize

    940KB

  • memory/2108-27-0x0000000000400000-0x00000000004EB000-memory.dmp

    Filesize

    940KB