darkcomet | 604aa8aa914e5f1f38f61ddba4af256643fec5be7382518d33b430869a11d08f

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 16:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4a7e8cdeac07d38686385b6c2829b43c_JaffaCakes118.exe
Size 1.1MB
Sample240715-t16wqasdkb
SHA256 604aa8aa914e5f1f38f61ddba4af256643fec5be7382518d33b430869a11d08f
MD5 4a7e8cdeac07d38686385b6c2829b43c
SHA1 a53711570a86c1759bdc11845a94e5a977932a0c
SHA512 728e52eba565f96b715859f75ebf398612ef56565ba5a29250c3f9597ca18c882faf7b49d56028238ce21b233f99da5be6b9ba875518f73cbe7bb41faa2b258d
SSDEEP 24576:G3nbWmJVJFwSddIXvfhqbiaxvRFq/j/rdpuj:QamdZdcBYKbnu
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcomet evasion persistence rat trojan upx

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	4a7e8cdeac07d38686385b6c2829b43c_JaffaCakes118.exe

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	msdcsc.exe

Windows security bypass 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	msdcsc.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	4a7e8cdeac07d38686385b6c2829b43c_JaffaCakes118.exe

Executes dropped EXE 2 IoCs

pid	Process
100	LOL RP HACK.EXE
5560	msdcsc.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5336-0-0x0000000000400000-0x0000000000516000-memory.dmp	upx
behavioral2/files/0x0008000000023475-28.dat	upx
behavioral2/memory/5336-86-0x0000000000400000-0x0000000000516000-memory.dmp	upx
behavioral2/memory/5560-88-0x0000000000400000-0x0000000000516000-memory.dmp	upx

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	msdcsc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe"	4a7e8cdeac07d38686385b6c2829b43c_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3224	100	WerFault.exe	85

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	4a7e8cdeac07d38686385b6c2829b43c_JaffaCakes118.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4064	PING.EXE

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5336	4a7e8cdeac07d38686385b6c2829b43c_JaffaCakes118.exe
Token: SeSecurityPrivilege	5336	4a7e8cdeac07d38686385b6c2829b43c_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	5336	4a7e8cdeac07d38686385b6c2829b43c_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	5336	4a7e8cdeac07d38686385b6c2829b43c_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	5336	4a7e8cdeac07d38686385b6c2829b43c_JaffaCakes118.exe
Token: SeSystemtimePrivilege	5336	4a7e8cdeac07d38686385b6c2829b43c_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	5336	4a7e8cdeac07d38686385b6c2829b43c_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	5336	4a7e8cdeac07d38686385b6c2829b43c_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	5336	4a7e8cdeac07d38686385b6c2829b43c_JaffaCakes118.exe
Token: SeBackupPrivilege	5336	4a7e8cdeac07d38686385b6c2829b43c_JaffaCakes118.exe
Token: SeRestorePrivilege	5336	4a7e8cdeac07d38686385b6c2829b43c_JaffaCakes118.exe
Token: SeShutdownPrivilege	5336	4a7e8cdeac07d38686385b6c2829b43c_JaffaCakes118.exe
Token: SeDebugPrivilege	5336	4a7e8cdeac07d38686385b6c2829b43c_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	5336	4a7e8cdeac07d38686385b6c2829b43c_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	5336	4a7e8cdeac07d38686385b6c2829b43c_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	5336	4a7e8cdeac07d38686385b6c2829b43c_JaffaCakes118.exe
Token: SeUndockPrivilege	5336	4a7e8cdeac07d38686385b6c2829b43c_JaffaCakes118.exe
Token: SeManageVolumePrivilege	5336	4a7e8cdeac07d38686385b6c2829b43c_JaffaCakes118.exe
Token: SeImpersonatePrivilege	5336	4a7e8cdeac07d38686385b6c2829b43c_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	5336	4a7e8cdeac07d38686385b6c2829b43c_JaffaCakes118.exe
Token: 33	5336	4a7e8cdeac07d38686385b6c2829b43c_JaffaCakes118.exe
Token: 34	5336	4a7e8cdeac07d38686385b6c2829b43c_JaffaCakes118.exe
Token: 35	5336	4a7e8cdeac07d38686385b6c2829b43c_JaffaCakes118.exe
Token: 36	5336	4a7e8cdeac07d38686385b6c2829b43c_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	5560	msdcsc.exe
Token: SeSecurityPrivilege	5560	msdcsc.exe
Token: SeTakeOwnershipPrivilege	5560	msdcsc.exe
Token: SeLoadDriverPrivilege	5560	msdcsc.exe
Token: SeSystemProfilePrivilege	5560	msdcsc.exe
Token: SeSystemtimePrivilege	5560	msdcsc.exe
Token: SeProfSingleProcessPrivilege	5560	msdcsc.exe
Token: SeIncBasePriorityPrivilege	5560	msdcsc.exe
Token: SeCreatePagefilePrivilege	5560	msdcsc.exe
Token: SeBackupPrivilege	5560	msdcsc.exe
Token: SeRestorePrivilege	5560	msdcsc.exe
Token: SeShutdownPrivilege	5560	msdcsc.exe
Token: SeDebugPrivilege	5560	msdcsc.exe
Token: SeSystemEnvironmentPrivilege	5560	msdcsc.exe
Token: SeChangeNotifyPrivilege	5560	msdcsc.exe
Token: SeRemoteShutdownPrivilege	5560	msdcsc.exe
Token: SeUndockPrivilege	5560	msdcsc.exe
Token: SeManageVolumePrivilege	5560	msdcsc.exe
Token: SeImpersonatePrivilege	5560	msdcsc.exe
Token: SeCreateGlobalPrivilege	5560	msdcsc.exe
Token: 33	5560	msdcsc.exe
Token: 34	5560	msdcsc.exe
Token: 35	5560	msdcsc.exe
Token: 36	5560	msdcsc.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 5336 wrote to memory of 100	5336	4a7e8cdeac07d38686385b6c2829b43c_JaffaCakes118.exe	85
PID 5336 wrote to memory of 100	5336	4a7e8cdeac07d38686385b6c2829b43c_JaffaCakes118.exe	85
PID 5336 wrote to memory of 100	5336	4a7e8cdeac07d38686385b6c2829b43c_JaffaCakes118.exe	85
PID 5336 wrote to memory of 5804	5336	4a7e8cdeac07d38686385b6c2829b43c_JaffaCakes118.exe	88
PID 5336 wrote to memory of 5804	5336	4a7e8cdeac07d38686385b6c2829b43c_JaffaCakes118.exe	88
PID 5336 wrote to memory of 5804	5336	4a7e8cdeac07d38686385b6c2829b43c_JaffaCakes118.exe	88
PID 5804 wrote to memory of 4064	5804	cmd.exe	91
PID 5804 wrote to memory of 4064	5804	cmd.exe	91
PID 5804 wrote to memory of 4064	5804	cmd.exe	91
PID 5336 wrote to memory of 5560	5336	4a7e8cdeac07d38686385b6c2829b43c_JaffaCakes118.exe	94
PID 5336 wrote to memory of 5560	5336	4a7e8cdeac07d38686385b6c2829b43c_JaffaCakes118.exe	94
PID 5336 wrote to memory of 5560	5336	4a7e8cdeac07d38686385b6c2829b43c_JaffaCakes118.exe	94
PID 5560 wrote to memory of 5692	5560	msdcsc.exe	95
PID 5560 wrote to memory of 5692	5560	msdcsc.exe	95
PID 5560 wrote to memory of 5692	5560	msdcsc.exe	95
PID 5560 wrote to memory of 5564	5560	msdcsc.exe	96
PID 5560 wrote to memory of 5564	5560	msdcsc.exe	96

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion	msdcsc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern	msdcsc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1"	msdcsc.exe

C:\Users\Admin\AppData\Local\Temp\4a7e8cdeac07d38686385b6c2829b43c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4a7e8cdeac07d38686385b6c2829b43c_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5336
- C:\Users\Admin\AppData\Local\Temp\LOL RP HACK.EXE
  "C:\Users\Admin\AppData\Local\Temp\LOL RP HACK.EXE"
  2⤵
  - Executes dropped EXE
  PID:100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 100 -s 1076
    3⤵
    - Program crash
    PID:3224
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5804
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - Runs ping.exe
    PID:4064
- C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
  "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
  2⤵
  - Modifies security service
  - Windows security bypass
  - Executes dropped EXE
  - Windows security modification
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:5560
- - C:\Program Files (x86)\Internet Explorer\iexplore.exe
    "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
    3⤵
    PID:5692
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    PID:5564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 100 -ip 100
1⤵
PID:2924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LOL RP HACK.EXE

Path C:\Users\Admin\AppData\Local\Temp\LOL RP HACK.EXE
Size 308KB
SHA256 1d3681b6bcf5fea7b7e57a2aa2165b28f7b4389ff7f45e51eec9248938499170
MD5 011fcf3cb12182820ef81f4e51a1b540
SHA1 4d422ee6957034a74157dae0e5c2a3c7b92d22b7
SHA512 a3d6373afb2ca4c097d523273be7e7030385ad6c754c204f14f5e652074522e6d09d76b2b7c767f28a26c49ece8a598c4865343831a884e2517918040103dbb3
SSDEEP 6144:qACgXo01hTrgKNSUy0uiQjd2rACgXo01:qAjDTrdNSV0uB2Aj
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpcmd.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat
Size 113B
SHA256 02e841599e8d7947451a9fa78fc314114b443c9471192f652e12c1ab283ef42c
MD5 0a32a5a78cab083d81167fce11a8baeb
SHA1 ceb9681257b7b2e6df5482671ff2e7b012f45972
SHA512 9b949c9b7e88e1dff9373e30dea280ab1d4d33f6c17d89981cace85d4a553f219d8de85bd137c66fa3b2164cf109efe24eb7c273121958988335ab03d316b9a6
MD5 SHA1 SHA512

Submit Download

msdcsc.exe

Path C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
Size 1.1MB
SHA256 604aa8aa914e5f1f38f61ddba4af256643fec5be7382518d33b430869a11d08f
MD5 4a7e8cdeac07d38686385b6c2829b43c
SHA1 a53711570a86c1759bdc11845a94e5a977932a0c
SHA512 728e52eba565f96b715859f75ebf398612ef56565ba5a29250c3f9597ca18c882faf7b49d56028238ce21b233f99da5be6b9ba875518f73cbe7bb41faa2b258d
SSDEEP 24576:G3nbWmJVJFwSddIXvfhqbiaxvRFq/j/rdpuj:QamdZdcBYKbnu
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/100-17-0x0000000000200000-0x0000000000254000-memory.dmp

Download

memory/100-18-0x0000000004C20000-0x0000000004CBC000-memory.dmp

Download

memory/100-19-0x0000000005270000-0x0000000005814000-memory.dmp

Download

memory/100-20-0x0000000004D60000-0x0000000004DF2000-memory.dmp

Download

memory/100-24-0x0000000004CE0000-0x0000000004CEA000-memory.dmp

Download

memory/100-25-0x0000000004F70000-0x0000000004FC6000-memory.dmp

Download

memory/100-16-0x0000000072DEE000-0x0000000072DEF000-memory.dmp

Download

memory/100-27-0x0000000072DE0000-0x0000000073590000-memory.dmp

Download

memory/100-87-0x0000000072DE0000-0x0000000073590000-memory.dmp

Download

memory/5336-0-0x0000000000400000-0x0000000000516000-memory.dmp

Download

memory/5336-1-0x0000000000730000-0x0000000000731000-memory.dmp

Download

memory/5336-86-0x0000000000400000-0x0000000000516000-memory.dmp

Download

memory/5560-88-0x0000000000400000-0x0000000000516000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads