Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    28-06-2024 00:11

General

  • Target

    181283c3e130b102c86e6ef049d0071a_JaffaCakes118.exe

  • Size

    713KB

  • MD5

    181283c3e130b102c86e6ef049d0071a

  • SHA1

    e58e8eac541416c306f8edb0b8d9821cc0690bf7

  • SHA256

    93a3d616794bbc999144bf30e2189c84b8a2b89c3c27cc08151103062a37d259

  • SHA512

    ebbbf9bed204ca27379a1cac0d1bb8aaaa701bdf0e11b2d0b7d70200aa88173ee113d17fdc6962425b8ac0ea68d684ee534c42956947f9b7c8f42d78c12f6e61

  • SSDEEP

    12288:+kfeLRmTb7mevlEure1m1+gPhQSVCSLzlwqzmHtc9UTD+eEsjfCh:ucj1vyure1m1+gJQSV1XlJCHtcaumr

Malware Config

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 13 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 59 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\181283c3e130b102c86e6ef049d0071a_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\181283c3e130b102c86e6ef049d0071a_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2372
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\winlogon.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\winlogon.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3028
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\winlogon.exe
        "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\winlogon.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2384
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\SysWOW64\explorer.exe"
          4⤵
            PID:2344
          • C:\Users\Admin\AppData\Roaming\Windupdate\winupdate.exe
            "C:\Users\Admin\AppData\Roaming\Windupdate\winupdate.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1896
            • C:\Users\Admin\AppData\Roaming\Windupdate\winupdate.exe
              "C:\Users\Admin\AppData\Roaming\Windupdate\winupdate.exe"
              5⤵
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Loads dropped DLL
              • Checks processor information in registry
              • Enumerates system info in registry
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:2396
              • C:\Windows\SysWOW64\explorer.exe
                "C:\Windows\SysWOW64\explorer.exe"
                6⤵
                  PID:2236
        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UNTITL~1.EXE
          C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UNTITL~1.EXE
          2⤵
          • Executes dropped EXE
          PID:2692

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\UNTITL~1.EXE

        Filesize

        463KB

        MD5

        f1e9169a3e85f072ee0d002b7d03a774

        SHA1

        8283fe30a23eb26b024f97aac94618b53664f8e2

        SHA256

        1ddab1b1b589f3bd4e272c2325cb2478d33feb6a6807b8a6c02260832ff2a67f

        SHA512

        84beac45f7b78575ac228fa62e7b4848f7efde79122acee513d9cda6e8b9b1219d5ec9a38c6050ef052195e83eb8d81b8d05200094692ad43a124f0a862f9179

      • \Users\Admin\AppData\Local\Temp\IXP000.TMP\winlogon.exe

        Filesize

        607KB

        MD5

        4ab6e467a63140fb44bea280cea542fc

        SHA1

        9993678b64516307e17a76f0f2ac2694269da873

        SHA256

        429dd67ce05b487ef57a5e55158441ba3e914b8b6db2f7f0dac34a123e17a130

        SHA512

        f76b8fc5d6802db034719c59f791534dd83f062dc9044e4381aa3636b43aeaf52417951e765537c5e9ebd06d726d9499f93e1dae4a0eafd45b19738ec4e76556

      • memory/1896-131-0x0000000000260000-0x0000000000280000-memory.dmp

        Filesize

        128KB

      • memory/1896-123-0x0000000000260000-0x0000000000280000-memory.dmp

        Filesize

        128KB

      • memory/1896-134-0x0000000000260000-0x0000000000280000-memory.dmp

        Filesize

        128KB

      • memory/1896-121-0x0000000000260000-0x0000000000280000-memory.dmp

        Filesize

        128KB

      • memory/1896-133-0x0000000000260000-0x0000000000280000-memory.dmp

        Filesize

        128KB

      • memory/1896-124-0x0000000000260000-0x0000000000280000-memory.dmp

        Filesize

        128KB

      • memory/1896-125-0x0000000000260000-0x0000000000280000-memory.dmp

        Filesize

        128KB

      • memory/1896-126-0x0000000000260000-0x0000000000280000-memory.dmp

        Filesize

        128KB

      • memory/1896-127-0x0000000000260000-0x0000000000280000-memory.dmp

        Filesize

        128KB

      • memory/1896-128-0x0000000000260000-0x0000000000280000-memory.dmp

        Filesize

        128KB

      • memory/1896-129-0x0000000000260000-0x0000000000280000-memory.dmp

        Filesize

        128KB

      • memory/1896-118-0x0000000000260000-0x0000000000280000-memory.dmp

        Filesize

        128KB

      • memory/1896-117-0x0000000000260000-0x0000000000280000-memory.dmp

        Filesize

        128KB

      • memory/1896-132-0x0000000000260000-0x0000000000280000-memory.dmp

        Filesize

        128KB

      • memory/1896-120-0x0000000000260000-0x0000000000280000-memory.dmp

        Filesize

        128KB

      • memory/1896-119-0x0000000000260000-0x0000000000280000-memory.dmp

        Filesize

        128KB

      • memory/1896-130-0x0000000000260000-0x0000000000280000-memory.dmp

        Filesize

        128KB

      • memory/1896-122-0x0000000000260000-0x0000000000280000-memory.dmp

        Filesize

        128KB

      • memory/1896-116-0x0000000000260000-0x0000000000280000-memory.dmp

        Filesize

        128KB

      • memory/1896-107-0x0000000000260000-0x0000000000280000-memory.dmp

        Filesize

        128KB

      • memory/2384-103-0x0000000076340000-0x0000000076450000-memory.dmp

        Filesize

        1.1MB

      • memory/2384-98-0x0000000000400000-0x00000000004B0000-memory.dmp

        Filesize

        704KB

      • memory/2384-91-0x0000000000400000-0x00000000004B0000-memory.dmp

        Filesize

        704KB

      • memory/2384-83-0x0000000076340000-0x0000000076450000-memory.dmp

        Filesize

        1.1MB

      • memory/2384-74-0x0000000000400000-0x00000000004B0000-memory.dmp

        Filesize

        704KB

      • memory/2384-80-0x0000000000400000-0x00000000004B0000-memory.dmp

        Filesize

        704KB

      • memory/2384-77-0x0000000000400000-0x00000000004B0000-memory.dmp

        Filesize

        704KB

      • memory/2384-79-0x0000000000400000-0x00000000004B0000-memory.dmp

        Filesize

        704KB

      • memory/2692-92-0x0000000000400000-0x0000000000449000-memory.dmp

        Filesize

        292KB

      • memory/3028-38-0x0000000000020000-0x0000000000040000-memory.dmp

        Filesize

        128KB

      • memory/3028-35-0x0000000000020000-0x0000000000040000-memory.dmp

        Filesize

        128KB

      • memory/3028-78-0x0000000076340000-0x0000000076450000-memory.dmp

        Filesize

        1.1MB

      • memory/3028-70-0x0000000076340000-0x0000000076450000-memory.dmp

        Filesize

        1.1MB

      • memory/3028-68-0x0000000076340000-0x0000000076450000-memory.dmp

        Filesize

        1.1MB

      • memory/3028-76-0x0000000076340000-0x0000000076450000-memory.dmp

        Filesize

        1.1MB

      • memory/3028-31-0x0000000000020000-0x0000000000040000-memory.dmp

        Filesize

        128KB

      • memory/3028-29-0x0000000000020000-0x0000000000040000-memory.dmp

        Filesize

        128KB

      • memory/3028-28-0x0000000000020000-0x0000000000040000-memory.dmp

        Filesize

        128KB

      • memory/3028-27-0x0000000000020000-0x0000000000040000-memory.dmp

        Filesize

        128KB

      • memory/3028-26-0x0000000000020000-0x0000000000040000-memory.dmp

        Filesize

        128KB

      • memory/3028-24-0x0000000000020000-0x0000000000040000-memory.dmp

        Filesize

        128KB

      • memory/3028-23-0x0000000000020000-0x0000000000040000-memory.dmp

        Filesize

        128KB

      • memory/3028-41-0x0000000000020000-0x0000000000040000-memory.dmp

        Filesize

        128KB

      • memory/3028-22-0x0000000000020000-0x0000000000040000-memory.dmp

        Filesize

        128KB

      • memory/3028-67-0x0000000076340000-0x0000000076450000-memory.dmp

        Filesize

        1.1MB

      • memory/3028-32-0x0000000000020000-0x0000000000040000-memory.dmp

        Filesize

        128KB

      • memory/3028-63-0x0000000076340000-0x0000000076450000-memory.dmp

        Filesize

        1.1MB

      • memory/3028-33-0x0000000000020000-0x0000000000040000-memory.dmp

        Filesize

        128KB

      • memory/3028-34-0x0000000000020000-0x0000000000040000-memory.dmp

        Filesize

        128KB

      • memory/3028-60-0x0000000076340000-0x0000000076450000-memory.dmp

        Filesize

        1.1MB

      • memory/3028-64-0x0000000076340000-0x0000000076450000-memory.dmp

        Filesize

        1.1MB

      • memory/3028-36-0x0000000000020000-0x0000000000040000-memory.dmp

        Filesize

        128KB

      • memory/3028-37-0x0000000000020000-0x0000000000040000-memory.dmp

        Filesize

        128KB

      • memory/3028-39-0x0000000000020000-0x0000000000040000-memory.dmp

        Filesize

        128KB

      • memory/3028-40-0x0000000000020000-0x0000000000040000-memory.dmp

        Filesize

        128KB

      • memory/3028-42-0x0000000000020000-0x0000000000040000-memory.dmp

        Filesize

        128KB

      • memory/3028-43-0x0000000000020000-0x0000000000040000-memory.dmp

        Filesize

        128KB

      • memory/3028-44-0x0000000000020000-0x0000000000040000-memory.dmp

        Filesize

        128KB

      • memory/3028-45-0x0000000000020000-0x0000000000040000-memory.dmp

        Filesize

        128KB

      • memory/3028-46-0x0000000000020000-0x0000000000040000-memory.dmp

        Filesize

        128KB

      • memory/3028-47-0x0000000000020000-0x0000000000040000-memory.dmp

        Filesize

        128KB

      • memory/3028-48-0x0000000000020000-0x0000000000040000-memory.dmp

        Filesize

        128KB

      • memory/3028-49-0x0000000000020000-0x0000000000040000-memory.dmp

        Filesize

        128KB

      • memory/3028-50-0x0000000000020000-0x0000000000040000-memory.dmp

        Filesize

        128KB

      • memory/3028-51-0x0000000000020000-0x0000000000040000-memory.dmp

        Filesize

        128KB

      • memory/3028-30-0x0000000000020000-0x0000000000040000-memory.dmp

        Filesize

        128KB

      • memory/3028-25-0x0000000000020000-0x0000000000040000-memory.dmp

        Filesize

        128KB

      • memory/3028-21-0x0000000076340000-0x0000000076450000-memory.dmp

        Filesize

        1.1MB

      • memory/3028-20-0x0000000076354000-0x0000000076355000-memory.dmp

        Filesize

        4KB

      • memory/3028-11-0x0000000000020000-0x0000000000040000-memory.dmp

        Filesize

        128KB