darkcomet | 379f02a6c2c3fd95ea8079da6564125a77720256061e562b7c7897a17c021d7e

General

Target

460a54a2494603102b7b86afeb11a89c_JaffaCakes118.exe
Size

808KB
MD5

460a54a2494603102b7b86afeb11a89c
SHA1

5ed8881b620fc408764e77e95ce7bef8c41b531d
SHA256

379f02a6c2c3fd95ea8079da6564125a77720256061e562b7c7897a17c021d7e
SHA512

a83423ecb164ec30e25fdea09cba1bc73b7ae6ca8c249584dbbaae2fdac55a77872e716855aed9935bf2c01db77f602f705ec2d19feaa4cba824fa34d12d65d5
SSDEEP

12288:W6A84PaHhfD/tV9sj5NKR0pau9XGyu2qBVGLQyTPfhvK2m:7AmBpVKHu0Mu9Xo20VGLVP5vK

Score

10^/10

darkcomet evasion rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	460a54a2494603102b7b86afeb11a89c_JaffaCakes118.exe

Windows security bypass 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	460a54a2494603102b7b86afeb11a89c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	460a54a2494603102b7b86afeb11a89c_JaffaCakes118.exe

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
3560	attrib.exe
3576	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	460a54a2494603102b7b86afeb11a89c_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
4844	PHOTOSHOPCS5EXTENDED EDITION_KEYGEN.EXE

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	460a54a2494603102b7b86afeb11a89c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	460a54a2494603102b7b86afeb11a89c_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3252	460a54a2494603102b7b86afeb11a89c_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3252	460a54a2494603102b7b86afeb11a89c_JaffaCakes118.exe
Token: SeSecurityPrivilege	3252	460a54a2494603102b7b86afeb11a89c_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	3252	460a54a2494603102b7b86afeb11a89c_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	3252	460a54a2494603102b7b86afeb11a89c_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	3252	460a54a2494603102b7b86afeb11a89c_JaffaCakes118.exe
Token: SeSystemtimePrivilege	3252	460a54a2494603102b7b86afeb11a89c_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	3252	460a54a2494603102b7b86afeb11a89c_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	3252	460a54a2494603102b7b86afeb11a89c_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	3252	460a54a2494603102b7b86afeb11a89c_JaffaCakes118.exe
Token: SeBackupPrivilege	3252	460a54a2494603102b7b86afeb11a89c_JaffaCakes118.exe
Token: SeRestorePrivilege	3252	460a54a2494603102b7b86afeb11a89c_JaffaCakes118.exe
Token: SeShutdownPrivilege	3252	460a54a2494603102b7b86afeb11a89c_JaffaCakes118.exe
Token: SeDebugPrivilege	3252	460a54a2494603102b7b86afeb11a89c_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	3252	460a54a2494603102b7b86afeb11a89c_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	3252	460a54a2494603102b7b86afeb11a89c_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	3252	460a54a2494603102b7b86afeb11a89c_JaffaCakes118.exe
Token: SeUndockPrivilege	3252	460a54a2494603102b7b86afeb11a89c_JaffaCakes118.exe
Token: SeManageVolumePrivilege	3252	460a54a2494603102b7b86afeb11a89c_JaffaCakes118.exe
Token: SeImpersonatePrivilege	3252	460a54a2494603102b7b86afeb11a89c_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	3252	460a54a2494603102b7b86afeb11a89c_JaffaCakes118.exe
Token: 33	3252	460a54a2494603102b7b86afeb11a89c_JaffaCakes118.exe
Token: 34	3252	460a54a2494603102b7b86afeb11a89c_JaffaCakes118.exe
Token: 35	3252	460a54a2494603102b7b86afeb11a89c_JaffaCakes118.exe
Token: 36	3252	460a54a2494603102b7b86afeb11a89c_JaffaCakes118.exe
Token: 33	2196	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2196	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3252	460a54a2494603102b7b86afeb11a89c_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3252 wrote to memory of 2072	3252	460a54a2494603102b7b86afeb11a89c_JaffaCakes118.exe	86
PID 3252 wrote to memory of 2072	3252	460a54a2494603102b7b86afeb11a89c_JaffaCakes118.exe	86
PID 3252 wrote to memory of 2072	3252	460a54a2494603102b7b86afeb11a89c_JaffaCakes118.exe	86
PID 3252 wrote to memory of 2476	3252	460a54a2494603102b7b86afeb11a89c_JaffaCakes118.exe	88
PID 3252 wrote to memory of 2476	3252	460a54a2494603102b7b86afeb11a89c_JaffaCakes118.exe	88
PID 3252 wrote to memory of 2476	3252	460a54a2494603102b7b86afeb11a89c_JaffaCakes118.exe	88
PID 3252 wrote to memory of 4844	3252	460a54a2494603102b7b86afeb11a89c_JaffaCakes118.exe	90
PID 3252 wrote to memory of 4844	3252	460a54a2494603102b7b86afeb11a89c_JaffaCakes118.exe	90
PID 3252 wrote to memory of 4844	3252	460a54a2494603102b7b86afeb11a89c_JaffaCakes118.exe	90
PID 2072 wrote to memory of 3560	2072	cmd.exe	91
PID 2072 wrote to memory of 3560	2072	cmd.exe	91
PID 2072 wrote to memory of 3560	2072	cmd.exe	91
PID 2476 wrote to memory of 3576	2476	cmd.exe	92
PID 2476 wrote to memory of 3576	2476	cmd.exe	92
PID 2476 wrote to memory of 3576	2476	cmd.exe	92

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion	460a54a2494603102b7b86afeb11a89c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern	460a54a2494603102b7b86afeb11a89c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1"	460a54a2494603102b7b86afeb11a89c_JaffaCakes118.exe

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3560	attrib.exe
3576	attrib.exe

C:\Users\Admin\AppData\Local\Temp\460a54a2494603102b7b86afeb11a89c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\460a54a2494603102b7b86afeb11a89c_JaffaCakes118.exe"
1⤵
- Modifies security service
- Windows security bypass
- Checks computer location settings
- Windows security modification
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3252
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\460a54a2494603102b7b86afeb11a89c_JaffaCakes118.exe" +s +h
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2072
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Users\Admin\AppData\Local\Temp\460a54a2494603102b7b86afeb11a89c_JaffaCakes118.exe" +s +h
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:3560
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2476
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:3576
- C:\Users\Admin\AppData\Local\Temp\PHOTOSHOPCS5EXTENDED EDITION_KEYGEN.EXE
  "C:\Users\Admin\AppData\Local\Temp\PHOTOSHOPCS5EXTENDED EDITION_KEYGEN.EXE"
  2⤵
  - Executes dropped EXE
  PID:4844

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x510 0x50c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Hide Artifacts

2

T1564

Hidden Files and Directories

2

T1564.001

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\PHOTOSHOPCS5EXTENDED EDITION_KEYGEN.EXE

Filesize
61KB

MD5
b6ac9256dc2c68751facf49b48ffe16e

SHA1
99137f9c21403db6a0c4db70f9c4adca28f46447

SHA256
e11434558518a2b9a43ce0857e1149c927916c208931f6c3a03a921a307ad628

SHA512
69e5eae1595f07c1015760c14e36e47f66030e0a584668579cdbc364033070339bbc1fae3714730fc5ce671d40180dad9a83b984257a9d5390ff70698f7295b6

Download Submit
memory/3252-14-0x0000000000400000-0x00000000004DB000-memory.dmp

Filesize
876KB

Download
memory/3252-0-0x00000000022A0000-0x00000000022A1000-memory.dmp

Filesize
4KB

Download
memory/3252-10-0x0000000000400000-0x00000000004DB000-memory.dmp

Filesize
876KB

Download
memory/4844-20-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4844-22-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4844-11-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4844-15-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4844-16-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4844-18-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4844-9-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4844-13-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4844-25-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4844-26-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4844-28-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4844-30-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4844-32-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4844-35-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4844-36-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/4844-38-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads