Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
13/07/2024, 02:55
General
- Target 3fea74f54c3c4415efc1981bc1c0c3dd_JaffaCakes118.exe
- Size 2.1MB
- Sample240713-deyefssfjr
- SHA256 c333e72e51bfb19293dda47865b518b74c2b99e7f2e7e5e603764aa336bf16bb
Malware Config
Signatures
- Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
- Modifies firewall policy service 3 TTPs 3 IoCs
- Modifies security service 2 TTPs 1 IoCs
- Windows security bypass 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Loads dropped DLL 1 IoCs
- Windows security modification 2 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 1 IoCs
- Suspicious use of AdjustPrivilegeToken 24 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3fea74f54c3c4415efc1981bc1c0c3dd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\3fea74f54c3c4415efc1981bc1c0c3dd_JaffaCakes118.exe"1⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Checks BIOS information in registry
- Loads dropped DLL
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
SEB2C5.tmp
memory/60-6554-0x0000000000400000-0x0000000000693000-memory.dmp
memory/60-6565-0x0000000000400000-0x0000000000693000-memory.dmp
memory/60-1494-0x0000000076710000-0x00000000768B0000-memory.dmp
memory/60-4058-0x00000000772B0000-0x000000007732A000-memory.dmp
memory/60-3-0x0000000076430000-0x0000000076645000-memory.dmp
memory/60-6546-0x0000000000400000-0x0000000000693000-memory.dmp
memory/60-6547-0x0000000000400000-0x0000000000693000-memory.dmp
memory/60-6548-0x0000000000400000-0x0000000000693000-memory.dmp
memory/60-6549-0x0000000000400000-0x0000000000693000-memory.dmp
memory/60-6568-0x0000000000400000-0x0000000000693000-memory.dmp
memory/60-6567-0x0000000000400000-0x0000000000693000-memory.dmp
memory/60-0-0x0000000000400000-0x0000000000693000-memory.dmp
memory/60-1492-0x0000000002AA0000-0x0000000002C54000-memory.dmp
memory/60-6555-0x0000000000400000-0x0000000000693000-memory.dmp
memory/60-6561-0x0000000000400000-0x0000000000693000-memory.dmp
memory/60-6558-0x0000000000400000-0x0000000000693000-memory.dmp
memory/60-6559-0x0000000000400000-0x0000000000693000-memory.dmp
memory/60-6560-0x0000000000400000-0x0000000000693000-memory.dmp
memory/60-6557-0x0000000000400000-0x0000000000693000-memory.dmp
memory/60-6562-0x0000000000400000-0x0000000000693000-memory.dmp
memory/60-6563-0x0000000000400000-0x0000000000693000-memory.dmp
memory/60-6564-0x0000000000400000-0x0000000000693000-memory.dmp
memory/60-6556-0x0000000002AA0000-0x0000000002C54000-memory.dmp
memory/60-6566-0x0000000000400000-0x0000000000693000-memory.dmp
memory/5876-6551-0x0000000000400000-0x0000000000444000-memory.dmp
memory/5876-6550-0x0000000000400000-0x0000000000444000-memory.dmp