Analysis
- max time kernel
147s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
15/07/2024, 21:14
General
- Target 4b6dd4aa643980638b53a105cf40a855_JaffaCakes118.exe
- Size 2.9MB
- Sample240715-z3llfssbqa
- SHA256 c06fa85592e65981a30e2bc860f3ef29bc2b72849874e759bc6304d9acba192a
Malware Config
Signatures
- Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
- Modifies security service 2 TTPs 2 IoCs
- Windows security bypass 2 TTPs 4 IoCs
- Drops file in Drivers directory 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Windows security modification 2 TTPs 2 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 48 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b6dd4aa643980638b53a105cf40a855_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\4b6dd4aa643980638b53a105cf40a855_JaffaCakes118.exe"1⤵
- Modifies security service
- Windows security bypass
- Drops file in Drivers directory
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Windows security modification
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Modifies security service
- Windows security bypass
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Pre-OS Boot
1Bootkit
1Defense Evasion
Impair Defenses
2Disable or Modify Tools
2Modify Registry
3Pre-OS Boot
1Bootkit
1Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
memory/4376-0-0x0000000013140000-0x00000000139C7301-memory.dmp
memory/4376-5-0x00000000136DB000-0x00000000136DC000-memory.dmp
memory/4376-6-0x0000000013140000-0x00000000139C7301-memory.dmp
memory/4376-1-0x0000000013140000-0x00000000139C7301-memory.dmp
memory/4376-7-0x0000000013140000-0x00000000139C7301-memory.dmp
memory/4376-8-0x0000000013140000-0x00000000139C7301-memory.dmp
memory/4376-9-0x0000000013140000-0x00000000139C7301-memory.dmp
memory/4376-10-0x0000000013140000-0x00000000139C7301-memory.dmp
memory/4376-11-0x0000000013140000-0x00000000139C7301-memory.dmp
memory/4376-12-0x0000000013140000-0x00000000139C7301-memory.dmp
memory/4376-13-0x0000000013140000-0x00000000139C7301-memory.dmp
memory/4376-14-0x0000000013140000-0x00000000139C7301-memory.dmp
memory/4376-28-0x0000000013140000-0x00000000139C7301-memory.dmp
memory/4928-16-0x0000000013140000-0x00000000139C8000-memory.dmp
memory/4928-19-0x0000000013140000-0x00000000139C8000-memory.dmp
memory/4928-21-0x0000000013140000-0x00000000139C8000-memory.dmp
memory/4928-18-0x0000000013140000-0x00000000139C8000-memory.dmp
memory/4928-29-0x0000000013140000-0x00000000139C8000-memory.dmp
memory/4928-30-0x0000000013140000-0x00000000139C8000-memory.dmp
memory/4928-31-0x0000000013140000-0x00000000139C8000-memory.dmp
memory/4928-33-0x0000000013140000-0x00000000139C8000-memory.dmp
memory/4928-32-0x0000000013140000-0x00000000139C8000-memory.dmp
memory/4928-44-0x0000000013140000-0x00000000139C8000-memory.dmp
memory/4928-42-0x0000000013140000-0x00000000139C8000-memory.dmp
memory/4928-40-0x0000000013140000-0x00000000139C8000-memory.dmp
memory/4928-51-0x0000000013140000-0x00000000139C8000-memory.dmp
memory/4928-55-0x0000000013140000-0x00000000139C8000-memory.dmp
memory/4928-56-0x0000000013140000-0x00000000139C8000-memory.dmp
memory/4928-54-0x0000000013140000-0x00000000139C8000-memory.dmp
memory/4928-53-0x0000000013140000-0x00000000139C8000-memory.dmp
memory/4928-58-0x0000000013140000-0x00000000139C8000-memory.dmp
memory/4928-57-0x0000000013140000-0x00000000139C8000-memory.dmp
memory/4928-61-0x0000000013140000-0x00000000139C8000-memory.dmp
memory/4928-60-0x0000000013140000-0x00000000139C8000-memory.dmp
memory/4928-65-0x0000000013140000-0x00000000139C8000-memory.dmp
memory/4928-68-0x0000000013140000-0x00000000139C8000-memory.dmp
memory/4928-89-0x0000000004390000-0x0000000004391000-memory.dmp
memory/4928-88-0x00000000043A0000-0x00000000043A1000-memory.dmp
memory/4928-87-0x0000000004270000-0x0000000004271000-memory.dmp
memory/4928-86-0x00000000042C0000-0x00000000042C1000-memory.dmp
memory/4928-85-0x0000000004120000-0x0000000004121000-memory.dmp
memory/4928-84-0x00000000042D0000-0x00000000042D1000-memory.dmp
memory/4928-83-0x0000000004290000-0x0000000004291000-memory.dmp
memory/4928-82-0x00000000044D0000-0x00000000044D2000-memory.dmp
memory/4928-81-0x00000000042F0000-0x00000000042F1000-memory.dmp
memory/4928-80-0x0000000004330000-0x0000000004331000-memory.dmp
memory/4928-79-0x0000000004280000-0x0000000004281000-memory.dmp
memory/4928-78-0x0000000004350000-0x0000000004351000-memory.dmp
memory/4928-77-0x00000000042E0000-0x00000000042E1000-memory.dmp
memory/4928-76-0x00000000043D0000-0x00000000043D2000-memory.dmp
memory/4928-75-0x0000000004230000-0x0000000004231000-memory.dmp
memory/4928-74-0x0000000004220000-0x0000000004221000-memory.dmp
memory/4928-73-0x0000000004240000-0x0000000004242000-memory.dmp
memory/4928-72-0x0000000004210000-0x0000000004211000-memory.dmp
memory/4928-71-0x0000000004250000-0x0000000004251000-memory.dmp
memory/4928-70-0x0000000013140000-0x00000000139C8000-memory.dmp
memory/4928-67-0x0000000013140000-0x00000000139C8000-memory.dmp
memory/4928-66-0x0000000013140000-0x00000000139C8000-memory.dmp
memory/4928-64-0x0000000013140000-0x00000000139C8000-memory.dmp
memory/4928-63-0x0000000013140000-0x00000000139C8000-memory.dmp
memory/4928-62-0x0000000013140000-0x00000000139C8000-memory.dmp
memory/4928-59-0x0000000013140000-0x00000000139C8000-memory.dmp
memory/4928-52-0x0000000013140000-0x00000000139C8000-memory.dmp
memory/4928-50-0x0000000013140000-0x00000000139C8000-memory.dmp
memory/4928-49-0x0000000013140000-0x00000000139C8000-memory.dmp
memory/4928-47-0x0000000013140000-0x00000000139C8000-memory.dmp
memory/4928-45-0x0000000013140000-0x00000000139C8000-memory.dmp
memory/4928-39-0x0000000013140000-0x00000000139C8000-memory.dmp
memory/4928-38-0x0000000013140000-0x00000000139C8000-memory.dmp
memory/4928-36-0x0000000013140000-0x00000000139C8000-memory.dmp
memory/4928-34-0x0000000013140000-0x00000000139C8000-memory.dmp
memory/4928-48-0x0000000013140000-0x00000000139C8000-memory.dmp
memory/4928-46-0x0000000013140000-0x00000000139C8000-memory.dmp
memory/4928-43-0x0000000013140000-0x00000000139C8000-memory.dmp
memory/4928-41-0x0000000013140000-0x00000000139C8000-memory.dmp
memory/4928-37-0x0000000013140000-0x00000000139C8000-memory.dmp
memory/4928-35-0x0000000013140000-0x00000000139C8000-memory.dmp
memory/4928-69-0x0000000013140000-0x00000000139C8000-memory.dmp
memory/4928-90-0x0000000013140000-0x00000000139C8000-memory.dmp
memory/4928-91-0x0000000013140000-0x00000000139C8000-memory.dmp
memory/4928-92-0x0000000013140000-0x00000000139C8000-memory.dmp