darkcomet | 7b3e2af8f39bcf2eda1f99830f4a0c8fc9a2d27fe6887208dbdd240dbd0b73c8

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 00:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe
Size 346KB
Sample240719-aflv9stdkk
SHA256 7b3e2af8f39bcf2eda1f99830f4a0c8fc9a2d27fe6887208dbdd240dbd0b73c8
MD5 59ac156dc89fec0e11f948f5f910dc07
SHA1 83e97a2cc60b79bc486f5ce2595f767451a4d470
SHA512 56e3de12d0b2a96f94d693a81fd59ca11164edc5bca744e6fac9e98061c9a892d48c9729a073f6b09eadc048523aeaf57a155759f5de0999e654a1d91bb0ca10
SSDEEP 6144:RFRaI2EqBP/WsZL1PgLl4w0AidVym0EnarUBYVsfwc4LLsMdWnpQZh9h4:jR72EqluswR45JTnaEY2fpXMd0QZh9u
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

darkcomet evasion rat trojan upx

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies firewall policy service 3 TTPs 6 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	iexplore.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	iexplore.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	iexplore.exe

Modifies security service 2 TTPs 2 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	iexplore.exe

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	iexplore.exe

Disables Task Manager via registry modification
evasion

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
3848	attrib.exe
2256	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation	59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4372-0-0x0000000000400000-0x00000000004E5000-memory.dmp	upx
behavioral2/memory/4064-2-0x0000000000400000-0x00000000004E5000-memory.dmp	upx
behavioral2/memory/4372-4-0x0000000000400000-0x00000000004E5000-memory.dmp	upx

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4372 set thread context of 4064	4372	59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe	95

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4064	iexplore.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4372	59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe
Token: SeSecurityPrivilege	4372	59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	4372	59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	4372	59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	4372	59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe
Token: SeSystemtimePrivilege	4372	59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	4372	59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	4372	59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	4372	59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe
Token: SeBackupPrivilege	4372	59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe
Token: SeRestorePrivilege	4372	59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe
Token: SeShutdownPrivilege	4372	59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe
Token: SeDebugPrivilege	4372	59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	4372	59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	4372	59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	4372	59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe
Token: SeUndockPrivilege	4372	59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe
Token: SeManageVolumePrivilege	4372	59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe
Token: SeImpersonatePrivilege	4372	59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	4372	59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe
Token: 33	4372	59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe
Token: 34	4372	59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe
Token: 35	4372	59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe
Token: 36	4372	59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	4064	iexplore.exe
Token: SeSecurityPrivilege	4064	iexplore.exe
Token: SeTakeOwnershipPrivilege	4064	iexplore.exe
Token: SeLoadDriverPrivilege	4064	iexplore.exe
Token: SeSystemProfilePrivilege	4064	iexplore.exe
Token: SeSystemtimePrivilege	4064	iexplore.exe
Token: SeProfSingleProcessPrivilege	4064	iexplore.exe
Token: SeIncBasePriorityPrivilege	4064	iexplore.exe
Token: SeCreatePagefilePrivilege	4064	iexplore.exe
Token: SeBackupPrivilege	4064	iexplore.exe
Token: SeRestorePrivilege	4064	iexplore.exe
Token: SeShutdownPrivilege	4064	iexplore.exe
Token: SeDebugPrivilege	4064	iexplore.exe
Token: SeSystemEnvironmentPrivilege	4064	iexplore.exe
Token: SeChangeNotifyPrivilege	4064	iexplore.exe
Token: SeRemoteShutdownPrivilege	4064	iexplore.exe
Token: SeUndockPrivilege	4064	iexplore.exe
Token: SeManageVolumePrivilege	4064	iexplore.exe
Token: SeImpersonatePrivilege	4064	iexplore.exe
Token: SeCreateGlobalPrivilege	4064	iexplore.exe
Token: 33	4064	iexplore.exe
Token: 34	4064	iexplore.exe
Token: 35	4064	iexplore.exe
Token: 36	4064	iexplore.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4064	iexplore.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 1144	4372	59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe	92
PID 4372 wrote to memory of 1144	4372	59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe	92
PID 4372 wrote to memory of 1144	4372	59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe	92
PID 4372 wrote to memory of 3152	4372	59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe	93
PID 4372 wrote to memory of 3152	4372	59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe	93
PID 4372 wrote to memory of 3152	4372	59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe	93
PID 4372 wrote to memory of 4064	4372	59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe	95
PID 4372 wrote to memory of 4064	4372	59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe	95
PID 4372 wrote to memory of 4064	4372	59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe	95
PID 4372 wrote to memory of 4064	4372	59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe	95
PID 4372 wrote to memory of 4064	4372	59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe	95
PID 1144 wrote to memory of 3848	1144	cmd.exe	97
PID 1144 wrote to memory of 3848	1144	cmd.exe	97
PID 1144 wrote to memory of 3848	1144	cmd.exe	97
PID 3152 wrote to memory of 2256	3152	cmd.exe	98
PID 3152 wrote to memory of 2256	3152	cmd.exe	98
PID 3152 wrote to memory of 2256	3152	cmd.exe	98

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion	59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern	59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1"	59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3848	attrib.exe
2256	attrib.exe

C:\Users\Admin\AppData\Local\Temp\59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe"
1⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Checks computer location settings
- Windows security modification
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4372
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe" +s +h
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1144
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Users\Admin\AppData\Local\Temp\59ac156dc89fec0e11f948f5f910dc07_JaffaCakes118.exe" +s +h
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:3848
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3152
- - C:\Windows\SysWOW64\attrib.exe
    attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:2256
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
  "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
  2⤵
  - Modifies firewall policy service
  - Modifies security service
  - Windows security bypass
  - Disables RegEdit via registry modification
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4064