Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/07/2024, 15:12

General

  • Target

    63aed92ceccf6514098ba33e643fa903_JaffaCakes118.exe

  • Size

    432KB

  • MD5

    63aed92ceccf6514098ba33e643fa903

  • SHA1

    596be6d69a6c0eebcc1281d3a191104ba1416d22

  • SHA256

    5aef3519c7815eb14cad402be02941092a90eb4d1f27d76584c968ba187822b3

  • SHA512

    9f86234f1f63a2cc30b1b0f8e13088cbac740b9083a8d2848275e96096b57890722b88459a353bb2081162428269ea956c9b51786435c966793e9326be25a7d1

  • SSDEEP

    12288:UmeVQkTrvj43tCLU/rciX8Dl6L8wLX0ePjRWAdNH/G:UTQkTf4dCwgiulJCAmHO

Score
10/10

Malware Config

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • UPX packed file 24 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Uses the VBS compiler for execution 1 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 25 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\63aed92ceccf6514098ba33e643fa903_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\63aed92ceccf6514098ba33e643fa903_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2860
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      2⤵
      • Checks BIOS information in registry
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:60

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/60-66-0x0000000075D20000-0x0000000075E10000-memory.dmp

    Filesize

    960KB

  • memory/60-68-0x0000000075D20000-0x0000000075E10000-memory.dmp

    Filesize

    960KB

  • memory/60-64-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/60-63-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/60-62-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/60-85-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/60-84-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/60-83-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/60-82-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/60-81-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/60-80-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/60-79-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/60-78-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/60-77-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/60-76-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/60-75-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/60-74-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/60-72-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/60-73-0x0000000075D20000-0x0000000075E10000-memory.dmp

    Filesize

    960KB

  • memory/60-71-0x0000000075D20000-0x0000000075E10000-memory.dmp

    Filesize

    960KB

  • memory/60-60-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/60-57-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/60-56-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/60-70-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/60-69-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/60-58-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/60-65-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/60-67-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/2860-35-0x0000000000550000-0x00000000005AC000-memory.dmp

    Filesize

    368KB

  • memory/2860-21-0x0000000000550000-0x00000000005AC000-memory.dmp

    Filesize

    368KB

  • memory/2860-39-0x0000000000550000-0x00000000005AC000-memory.dmp

    Filesize

    368KB

  • memory/2860-52-0x0000000000550000-0x00000000005AC000-memory.dmp

    Filesize

    368KB

  • memory/2860-38-0x0000000000550000-0x00000000005AC000-memory.dmp

    Filesize

    368KB

  • memory/2860-37-0x0000000000550000-0x00000000005AC000-memory.dmp

    Filesize

    368KB

  • memory/2860-42-0x0000000000550000-0x00000000005AC000-memory.dmp

    Filesize

    368KB

  • memory/2860-36-0x0000000000550000-0x00000000005AC000-memory.dmp

    Filesize

    368KB

  • memory/2860-45-0x0000000000550000-0x00000000005AC000-memory.dmp

    Filesize

    368KB

  • memory/2860-46-0x0000000000550000-0x00000000005AC000-memory.dmp

    Filesize

    368KB

  • memory/2860-43-0x0000000000550000-0x00000000005AC000-memory.dmp

    Filesize

    368KB

  • memory/2860-34-0x0000000000550000-0x00000000005AC000-memory.dmp

    Filesize

    368KB

  • memory/2860-33-0x0000000000550000-0x00000000005AC000-memory.dmp

    Filesize

    368KB

  • memory/2860-32-0x0000000000550000-0x00000000005AC000-memory.dmp

    Filesize

    368KB

  • memory/2860-31-0x0000000000550000-0x00000000005AC000-memory.dmp

    Filesize

    368KB

  • memory/2860-30-0x0000000000550000-0x00000000005AC000-memory.dmp

    Filesize

    368KB

  • memory/2860-29-0x0000000000550000-0x00000000005AC000-memory.dmp

    Filesize

    368KB

  • memory/2860-28-0x0000000000550000-0x00000000005AC000-memory.dmp

    Filesize

    368KB

  • memory/2860-27-0x0000000000550000-0x00000000005AC000-memory.dmp

    Filesize

    368KB

  • memory/2860-26-0x0000000000550000-0x00000000005AC000-memory.dmp

    Filesize

    368KB

  • memory/2860-25-0x0000000000550000-0x00000000005AC000-memory.dmp

    Filesize

    368KB

  • memory/2860-23-0x0000000000550000-0x00000000005AC000-memory.dmp

    Filesize

    368KB

  • memory/2860-22-0x0000000000550000-0x00000000005AC000-memory.dmp

    Filesize

    368KB

  • memory/2860-40-0x0000000000550000-0x00000000005AC000-memory.dmp

    Filesize

    368KB

  • memory/2860-20-0x0000000000550000-0x00000000005AC000-memory.dmp

    Filesize

    368KB

  • memory/2860-19-0x0000000000550000-0x00000000005AC000-memory.dmp

    Filesize

    368KB

  • memory/2860-50-0x0000000000550000-0x00000000005AC000-memory.dmp

    Filesize

    368KB

  • memory/2860-48-0x0000000000550000-0x00000000005AC000-memory.dmp

    Filesize

    368KB

  • memory/2860-44-0x0000000000550000-0x00000000005AC000-memory.dmp

    Filesize

    368KB

  • memory/2860-41-0x0000000000550000-0x00000000005AC000-memory.dmp

    Filesize

    368KB

  • memory/2860-47-0x0000000000550000-0x00000000005AC000-memory.dmp

    Filesize

    368KB

  • memory/2860-51-0x0000000000550000-0x00000000005AC000-memory.dmp

    Filesize

    368KB

  • memory/2860-61-0x0000000075D20000-0x0000000075E10000-memory.dmp

    Filesize

    960KB

  • memory/2860-49-0x0000000000550000-0x00000000005AC000-memory.dmp

    Filesize

    368KB

  • memory/2860-53-0x0000000000550000-0x00000000005AC000-memory.dmp

    Filesize

    368KB

  • memory/2860-24-0x0000000000550000-0x00000000005AC000-memory.dmp

    Filesize

    368KB

  • memory/2860-17-0x0000000075D20000-0x0000000075E10000-memory.dmp

    Filesize

    960KB

  • memory/2860-18-0x0000000075D20000-0x0000000075E10000-memory.dmp

    Filesize

    960KB

  • memory/2860-15-0x0000000075D20000-0x0000000075E10000-memory.dmp

    Filesize

    960KB

  • memory/2860-16-0x0000000075D20000-0x0000000075E10000-memory.dmp

    Filesize

    960KB

  • memory/2860-14-0x0000000075D20000-0x0000000075E10000-memory.dmp

    Filesize

    960KB

  • memory/2860-13-0x0000000075D20000-0x0000000075E10000-memory.dmp

    Filesize

    960KB

  • memory/2860-12-0x0000000075D20000-0x0000000075E10000-memory.dmp

    Filesize

    960KB

  • memory/2860-11-0x0000000075D20000-0x0000000075E10000-memory.dmp

    Filesize

    960KB

  • memory/2860-10-0x0000000075D20000-0x0000000075E10000-memory.dmp

    Filesize

    960KB

  • memory/2860-9-0x0000000075D40000-0x0000000075D41000-memory.dmp

    Filesize

    4KB

  • memory/2860-0-0x0000000000550000-0x00000000005AC000-memory.dmp

    Filesize

    368KB