Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-06-2024 21:24

General

  • Target

    17952d6d362fb10f6feba49016730c98_JaffaCakes118.exe

  • Size

    797KB

  • MD5

    17952d6d362fb10f6feba49016730c98

  • SHA1

    5b8389cde6345a369a25bd2ae92c54392048b1da

  • SHA256

    838f0dfabc78e448aa17c69ad07715f89532ff8deb4081e4952179aafc4a44e2

  • SHA512

    caa9bbd20df19c6ce3663621a23ea68557ede61cf7249d60df626b699869ccd624534d6edbd73d46e3bbd7fac8460e6d66c052a5aa5e4fb1262cac38dbbb1be0

  • SSDEEP

    12288:sFLlJnnbWOtz6sVJhvaz1Qc/WdI//vfM4qwrbkniafLo6vUTyl0c/q:M3nbWmJVJFwSddIXvfhqbiaxvRFq

Malware Config

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Sets file to hidden 1 TTPs 2 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\17952d6d362fb10f6feba49016730c98_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\17952d6d362fb10f6feba49016730c98_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2084
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2824
      • C:\Windows\SysWOW64\attrib.exe
        attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
        3⤵
        • Sets file to hidden
        • Views/modifies file attributes
        PID:3884
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1824
      • C:\Windows\SysWOW64\attrib.exe
        attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
        3⤵
        • Sets file to hidden
        • Views/modifies file attributes
        PID:3380
    • C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
      2⤵
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1668

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat

    Filesize

    50B

    MD5

    b774ae3fb1da087e1f83b4f7b2060e5a

    SHA1

    97eb9be49ac3af9c851c9e1e84e32bfd53e325a8

    SHA256

    adaf4a84b41e410b02e261cfd0fe7739d98647eab73c3badd32ac6e39f26351b

    SHA512

    f75d0f95f7306d26a12b414bfe37b97fbd37546cb3c6e403def7077329ddffb4b45d5c5f0ba0e7bb6d72851d2d691b0a85267beead42f7cbf2e8c3d45a3b4701

  • memory/1668-9-0x0000000000400000-0x00000000004C9000-memory.dmp

    Filesize

    804KB

  • memory/2084-0-0x0000000000400000-0x00000000004C9000-memory.dmp

    Filesize

    804KB

  • memory/2084-1-0x00000000023D0000-0x00000000023D1000-memory.dmp

    Filesize

    4KB

  • memory/2084-10-0x0000000000400000-0x00000000004C9000-memory.dmp

    Filesize

    804KB