Analysis

  • max time kernel
    145s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-06-2024 19:57

General

  • Target

    1753e5c51e39ae8b979d2b7ce213a446_JaffaCakes118.exe

  • Size

    804KB

  • MD5

    1753e5c51e39ae8b979d2b7ce213a446

  • SHA1

    52e63b19aee9ba61c753593b0089cc6e352bf5cc

  • SHA256

    c3bab0f648527f6f1ce39bd437ca304d57264c4d45dd2bddef79f39be956640e

  • SHA512

    879ec0e1b861b574062d20d5aa9be06020870103c86c932a014826882c9ba48443142cc660630fd8da467c8470a6cf4d59d70e6fb2c6767898a5199c328368d0

  • SSDEEP

    12288:bK1q+iF0S+Xi+FSiSFVpIfi7CQc8FTnE97SFdmFnItdDlM2j:bICmS+XNF3aEsCQc8CSDo0dj

Malware Config

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Modifies registry class 1 IoCs
  • Runs ping.exe 1 TTPs 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1753e5c51e39ae8b979d2b7ce213a446_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\1753e5c51e39ae8b979d2b7ce213a446_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2136
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      2⤵
      • Modifies WinLogon for persistence
      • Adds Run key to start application
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1120
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2612
        • C:\Windows\SysWOW64\PING.EXE
          ping 127.0.0.1 -n 5
          4⤵
          • Runs ping.exe
          PID:1852
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2520
        • C:\Windows\SysWOW64\PING.EXE
          ping 127.0.0.1 -n 5
          4⤵
          • Runs ping.exe
          PID:1544
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:564
        • C:\Windows\SysWOW64\PING.EXE
          ping 127.0.0.1 -n 5
          4⤵
          • Runs ping.exe
          PID:928
      • C:\Windows\SysWOW64\system32dll.exe
        "C:\Windows\system32\system32dll.exe"
        3⤵
        • Executes dropped EXE
        PID:3280
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4112 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:2780

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat

      Filesize

      82B

      MD5

      638415f09175908af6b20ffa78526db1

      SHA1

      87c3527c6ad7721245820f68bfa32be11e0a916c

      SHA256

      0a46d339ddfa8ccdfe17c055190f19e873120e9ae3722f6601464281d0011d60

      SHA512

      85198b6a713218ed7d0ecf0b49c79d8ced0f7ff38f20ef11baa4a63fcbe1201069de08b79153d5a26d0efa3c1fefbfdb19326cf77335065abaf417cd21fd8a9b

    • C:\Windows\SysWOW64\system32dll.exe

      Filesize

      1.1MB

      MD5

      d881de17aa8f2e2c08cbb7b265f928f9

      SHA1

      08936aebc87decf0af6e8eada191062b5e65ac2a

      SHA256

      b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

      SHA512

      5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

    • memory/1120-3-0x0000000000400000-0x00000000004CB000-memory.dmp

      Filesize

      812KB

    • memory/1120-4-0x0000000000400000-0x00000000004CB000-memory.dmp

      Filesize

      812KB

    • memory/1120-6-0x0000000000400000-0x00000000004CB000-memory.dmp

      Filesize

      812KB

    • memory/1120-8-0x0000000000400000-0x00000000004CB000-memory.dmp

      Filesize

      812KB

    • memory/1120-9-0x0000000000400000-0x00000000004CB000-memory.dmp

      Filesize

      812KB

    • memory/1120-83-0x0000000000400000-0x00000000004CB000-memory.dmp

      Filesize

      812KB

    • memory/2136-0-0x0000000074FB2000-0x0000000074FB3000-memory.dmp

      Filesize

      4KB

    • memory/2136-1-0x0000000074FB0000-0x0000000075561000-memory.dmp

      Filesize

      5.7MB

    • memory/2136-2-0x0000000074FB0000-0x0000000075561000-memory.dmp

      Filesize

      5.7MB

    • memory/2136-7-0x0000000074FB0000-0x0000000075561000-memory.dmp

      Filesize

      5.7MB