Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/07/2024, 16:38

General

  • Target

    63f2fc876c09c7a6a1700612e479f251_JaffaCakes118.exe

  • Size

    668KB

  • MD5

    63f2fc876c09c7a6a1700612e479f251

  • SHA1

    36acdc5c72b3159ce9b2764259a3c208ff2d4f54

  • SHA256

    4a2b8775c52b3594c1e8889afdf96c1477853d5b912b3ede8248fa306da74bcd

  • SHA512

    9bdd352918b393a5a8d39f0b1535cea00f21a2127ebaca992dc159895549a6b5c7efe057442831d959dc7fdc166f5d3e5a9b77dd50fa0899c9abe117542e6647

  • SSDEEP

    12288:+oiyf03HDkrzviq6C09GZPQcxaBOzcL75WmnTKWfg0wxXSjqT9tMM/GU9fWXaFQI:+oIHgnq5IOKFQB2Fakn

Malware Config

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\63f2fc876c09c7a6a1700612e479f251_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\63f2fc876c09c7a6a1700612e479f251_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1508
    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
      2⤵
      • Modifies WinLogon for persistence
      • Drops file in Drivers directory
      • Checks BIOS information in registry
      • Adds Run key to start application
      • Checks processor information in registry
      • Enumerates system info in registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5116
      • C:\Windows\SysWOW64\explorer.exe
        "C:\Windows\SysWOW64\explorer.exe"
        3⤵
          PID:4904
        • C:\Users\Admin\AppData\Roaming\Windows\Updates\winupdate.exe
          "C:\Users\Admin\AppData\Roaming\Windows\Updates\winupdate.exe"
          3⤵
          • Executes dropped EXE
          PID:4252

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Windows\Updates\winupdate.exe

      Filesize

      1.1MB

      MD5

      d881de17aa8f2e2c08cbb7b265f928f9

      SHA1

      08936aebc87decf0af6e8eada191062b5e65ac2a

      SHA256

      b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

      SHA512

      5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

    • memory/1508-0-0x00000000751E2000-0x00000000751E3000-memory.dmp

      Filesize

      4KB

    • memory/1508-1-0x00000000751E0000-0x0000000075791000-memory.dmp

      Filesize

      5.7MB

    • memory/1508-2-0x00000000751E0000-0x0000000075791000-memory.dmp

      Filesize

      5.7MB

    • memory/1508-10-0x00000000751E0000-0x0000000075791000-memory.dmp

      Filesize

      5.7MB

    • memory/5116-3-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/5116-4-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/5116-6-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/5116-7-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/5116-8-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/5116-9-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

    • memory/5116-72-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB