Analysis

  • max time kernel
    118s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    22/07/2024, 14:36

General

  • Target

    6390b876f7a9236842427d1aa64c47cb_JaffaCakes118.exe

  • Size

    763KB

  • MD5

    6390b876f7a9236842427d1aa64c47cb

  • SHA1

    d5a728fb6f1e8339a61076d499d47d932df3fcf5

  • SHA256

    23ec9eebb57bc2df3edcc310629f9320fdd2d5f52026f07fe7a280abe77b57f2

  • SHA512

    bb7cfee5576c193c5147b7faae1e390db22a28b942ae4111f10994984bbd8713ce23e29ec93438aa9cd4f3bfe6504192892da5d84570ac203282b0fb7b6e6e8e

  • SSDEEP

    12288:ugmEDIvbiPjXLrhW1cKG8fz0hY2lglVCCeOWROCehzXLWgMC9R1Xv9WJhN41gpuv:ugmuITiPj/LKBb0C2ulVClRhozXLW1GT

Malware Config

Extracted

Family

darkcomet

Botnet

Matt

C2

yuk.no-ip.biz:100

Mutex

DC_MUTEX-BZJHQWP

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    ACd9Gmmlygjr

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    MicroUpdate

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Sets file to hidden 1 TTPs 2 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6390b876f7a9236842427d1aa64c47cb_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\6390b876f7a9236842427d1aa64c47cb_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2680
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C ren C:\Users\Admin\AppData\Roaming\windowshostmanagerupdate windowshostmanagerupdate.exe && exit
      2⤵
        PID:2800
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        2⤵
        • Modifies WinLogon for persistence
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2736
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe" +s +h
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2580
          • C:\Windows\SysWOW64\attrib.exe
            attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe" +s +h
            4⤵
            • Sets file to hidden
            • Drops file in Windows directory
            • Views/modifies file attributes
            PID:2344
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727" +s +h
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2600
          • C:\Windows\SysWOW64\attrib.exe
            attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727" +s +h
            4⤵
            • Sets file to hidden
            • Drops file in Windows directory
            • Views/modifies file attributes
            PID:1032
        • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
          "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
          3⤵
          • Executes dropped EXE
          PID:1120

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\windowshostmanagerupdate

      Filesize

      763KB

      MD5

      6390b876f7a9236842427d1aa64c47cb

      SHA1

      d5a728fb6f1e8339a61076d499d47d932df3fcf5

      SHA256

      23ec9eebb57bc2df3edcc310629f9320fdd2d5f52026f07fe7a280abe77b57f2

      SHA512

      bb7cfee5576c193c5147b7faae1e390db22a28b942ae4111f10994984bbd8713ce23e29ec93438aa9cd4f3bfe6504192892da5d84570ac203282b0fb7b6e6e8e

    • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe

      Filesize

      31KB

      MD5

      ed797d8dc2c92401985d162e42ffa450

      SHA1

      0f02fc517c7facc4baefde4fe9467fb6488ebabe

      SHA256

      b746362010a101cb5931bc066f0f4d3fc740c02a68c1f37fc3c8e6c87fd7cb1e

      SHA512

      e831a6ff987f3ef29982da16afad06938b68eddd43c234ba88d1c96a1b5547f2284baf35cbb3a5bfd75e7f0445d14daa014e0ba00b4db72c67f83f0a314c80c2

    • memory/2680-0-0x0000000074711000-0x0000000074712000-memory.dmp

      Filesize

      4KB

    • memory/2680-1-0x0000000074710000-0x0000000074CBB000-memory.dmp

      Filesize

      5.7MB

    • memory/2680-2-0x0000000074710000-0x0000000074CBB000-memory.dmp

      Filesize

      5.7MB

    • memory/2680-29-0x0000000074710000-0x0000000074CBB000-memory.dmp

      Filesize

      5.7MB

    • memory/2736-16-0x0000000000400000-0x00000000004CD000-memory.dmp

      Filesize

      820KB

    • memory/2736-9-0x0000000000400000-0x00000000004CD000-memory.dmp

      Filesize

      820KB

    • memory/2736-20-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2736-18-0x0000000000400000-0x00000000004CD000-memory.dmp

      Filesize

      820KB

    • memory/2736-23-0x0000000000400000-0x00000000004CD000-memory.dmp

      Filesize

      820KB

    • memory/2736-12-0x0000000000400000-0x00000000004CD000-memory.dmp

      Filesize

      820KB

    • memory/2736-10-0x0000000000400000-0x00000000004CD000-memory.dmp

      Filesize

      820KB

    • memory/2736-22-0x0000000000400000-0x00000000004CD000-memory.dmp

      Filesize

      820KB

    • memory/2736-24-0x0000000000400000-0x00000000004CD000-memory.dmp

      Filesize

      820KB

    • memory/2736-7-0x0000000000400000-0x00000000004CD000-memory.dmp

      Filesize

      820KB

    • memory/2736-26-0x0000000000400000-0x00000000004CD000-memory.dmp

      Filesize

      820KB

    • memory/2736-25-0x0000000000280000-0x0000000000281000-memory.dmp

      Filesize

      4KB

    • memory/2736-14-0x0000000000400000-0x00000000004CD000-memory.dmp

      Filesize

      820KB

    • memory/2736-5-0x0000000000400000-0x00000000004CD000-memory.dmp

      Filesize

      820KB

    • memory/2736-37-0x0000000000400000-0x00000000004CD000-memory.dmp

      Filesize

      820KB