Analysis

  • max time kernel
    140s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    27-06-2024 21:24

General

  • Target

    17952d6d362fb10f6feba49016730c98_JaffaCakes118.exe

  • Size

    797KB

  • MD5

    17952d6d362fb10f6feba49016730c98

  • SHA1

    5b8389cde6345a369a25bd2ae92c54392048b1da

  • SHA256

    838f0dfabc78e448aa17c69ad07715f89532ff8deb4081e4952179aafc4a44e2

  • SHA512

    caa9bbd20df19c6ce3663621a23ea68557ede61cf7249d60df626b699869ccd624534d6edbd73d46e3bbd7fac8460e6d66c052a5aa5e4fb1262cac38dbbb1be0

  • SSDEEP

    12288:sFLlJnnbWOtz6sVJhvaz1Qc/WdI//vfM4qwrbkniafLo6vUTyl0c/q:M3nbWmJVJFwSddIXvfhqbiaxvRFq

Malware Config

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Sets file to hidden 1 TTPs 2 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\17952d6d362fb10f6feba49016730c98_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\17952d6d362fb10f6feba49016730c98_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2972
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2796
      • C:\Windows\SysWOW64\attrib.exe
        attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
        3⤵
        • Sets file to hidden
        • Views/modifies file attributes
        PID:2928
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2660
      • C:\Windows\SysWOW64\attrib.exe
        attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
        3⤵
        • Sets file to hidden
        • Views/modifies file attributes
        PID:2664
    • C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
      2⤵
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2704

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat

    Filesize

    101B

    MD5

    dbff1287eec172111832ecaac475fc98

    SHA1

    e8f43497ddf34a7d0f23d49e5699661bb8f05d5e

    SHA256

    8c2e45a0bf8926a91a493c387075f515f20c5e71b28da9338c6fab0b13334018

    SHA512

    06ccfc09b0bdcd25c2c45913ed24e816b47dfb1ceac13f14a7df354fda0d526c05ad0f6fbc95bc4ae78bebb9ad026adbced1c97b370b4f4bfa5bf9034afb5989

  • C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat

    Filesize

    50B

    MD5

    b774ae3fb1da087e1f83b4f7b2060e5a

    SHA1

    97eb9be49ac3af9c851c9e1e84e32bfd53e325a8

    SHA256

    adaf4a84b41e410b02e261cfd0fe7739d98647eab73c3badd32ac6e39f26351b

    SHA512

    f75d0f95f7306d26a12b414bfe37b97fbd37546cb3c6e403def7077329ddffb4b45d5c5f0ba0e7bb6d72851d2d691b0a85267beead42f7cbf2e8c3d45a3b4701

  • memory/2704-19-0x0000000000400000-0x00000000004C9000-memory.dmp

    Filesize

    804KB

  • memory/2972-0-0x0000000000400000-0x00000000004C9000-memory.dmp

    Filesize

    804KB

  • memory/2972-1-0x0000000000260000-0x0000000000261000-memory.dmp

    Filesize

    4KB

  • memory/2972-20-0x0000000000400000-0x00000000004C9000-memory.dmp

    Filesize

    804KB