Analysis

  • max time kernel
    149s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    27-06-2024 18:46

General

  • Target

    171bef4ec12a568a8496e2c39e5f4e8e_JaffaCakes118.exe

  • Size

    927KB

  • MD5

    171bef4ec12a568a8496e2c39e5f4e8e

  • SHA1

    d019dd3f9004920f13b20e5d95586d7a384ebb0b

  • SHA256

    85112b77cbc006585648662b56b53fa526093e2689398078ff7ee14d0929bf01

  • SHA512

    e58a473c16c973f5f29bddfb93dbdc36440e63869ecd7af32f0761f2e38e73088b54e5f88d6183ab34606b5a0e6444b5f479c5e9f0f5092c525b824f411bc847

  • SSDEEP

    24576:wFC/G4K2wSSSMjwvgFS5bJ5TMhmvviZ46hq+:wFR4/lgiKaIq

Malware Config

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\171bef4ec12a568a8496e2c39e5f4e8e_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\171bef4ec12a568a8496e2c39e5f4e8e_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2064
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2688

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2064-11-0x0000000074A20000-0x000000007510E000-memory.dmp

    Filesize

    6.9MB

  • memory/2064-1-0x0000000000AC0000-0x0000000000BAE000-memory.dmp

    Filesize

    952KB

  • memory/2064-2-0x00000000047B0000-0x000000000489C000-memory.dmp

    Filesize

    944KB

  • memory/2064-20-0x0000000004770000-0x00000000047B0000-memory.dmp

    Filesize

    256KB

  • memory/2064-17-0x0000000074A20000-0x000000007510E000-memory.dmp

    Filesize

    6.9MB

  • memory/2064-6-0x00000000003B0000-0x00000000003C0000-memory.dmp

    Filesize

    64KB

  • memory/2064-16-0x0000000074A2E000-0x0000000074A2F000-memory.dmp

    Filesize

    4KB

  • memory/2064-14-0x0000000004770000-0x00000000047B0000-memory.dmp

    Filesize

    256KB

  • memory/2064-0-0x0000000074A2E000-0x0000000074A2F000-memory.dmp

    Filesize

    4KB

  • memory/2688-9-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB

  • memory/2688-21-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB

  • memory/2688-13-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB

  • memory/2688-10-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB

  • memory/2688-8-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB

  • memory/2688-15-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB

  • memory/2688-7-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB

  • memory/2688-4-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB

  • memory/2688-18-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB

  • memory/2688-19-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB

  • memory/2688-5-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB

  • memory/2688-12-0x0000000000270000-0x0000000000271000-memory.dmp

    Filesize

    4KB

  • memory/2688-22-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB

  • memory/2688-23-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB

  • memory/2688-24-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB

  • memory/2688-25-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB

  • memory/2688-26-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB

  • memory/2688-27-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB

  • memory/2688-28-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB

  • memory/2688-29-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB

  • memory/2688-30-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB

  • memory/2688-31-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB

  • memory/2688-32-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB