Analysis

  • max time kernel
    122s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    22/07/2024, 17:33

General

  • Target

    641eee36a837e78938443a37bdba829f_JaffaCakes118.exe

  • Size

    484KB

  • MD5

    641eee36a837e78938443a37bdba829f

  • SHA1

    6a270b234c96d1102ede2082ad51a7c9285c749b

  • SHA256

    5e933618f0cca94e548037a4f8e0c3603e1f38175f6bd8085bfb64ed8c5f1a34

  • SHA512

    2e0059582be9648d2bb7143d17d179a335537cebfcef18037a84823d65e01d9b202a4b6d495443a386dab7b7e39b7251bf86640ea351eda070b813e9997ef29c

  • SSDEEP

    6144:8NvQ7ettISBED2zX5AhGU+CLfu5qPZkGSRuq0ud:8NDgSBED27OhqmLSGSRx

Malware Config

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Deletes itself 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • UPX packed file 15 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\641eee36a837e78938443a37bdba829f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\641eee36a837e78938443a37bdba829f_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2956
    • C:\Users\Admin\AppData\Local\Temp\641eee36a837e78938443a37bdba829f_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\641eee36a837e78938443a37bdba829f_JaffaCakes118.exe
      2⤵
      • Modifies WinLogon for persistence
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2476
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 4 && del "C:\Users\Admin\AppData\Local\Temp\641eee36a837e78938443a37bdba829f_JaffaCakes118.exe"
        3⤵
        • Deletes itself
        • Suspicious use of WriteProcessMemory
        PID:2004
        • C:\Windows\SysWOW64\PING.EXE
          ping 127.0.0.1 -n 4
          4⤵
          • Runs ping.exe
          PID:2644
      • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
        "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2696
        • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
          C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2712
          • C:\Program Files (x86)\Internet Explorer\iexplore.exe
            "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
            5⤵
            • Suspicious use of SetThreadContext
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2200
            • C:\Program Files (x86)\Internet Explorer\iexplore.exe
              "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
              6⤵
                PID:2720

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Users\Admin\Documents\MSDCSC\msdcsc.exe

      Filesize

      484KB

      MD5

      641eee36a837e78938443a37bdba829f

      SHA1

      6a270b234c96d1102ede2082ad51a7c9285c749b

      SHA256

      5e933618f0cca94e548037a4f8e0c3603e1f38175f6bd8085bfb64ed8c5f1a34

      SHA512

      2e0059582be9648d2bb7143d17d179a335537cebfcef18037a84823d65e01d9b202a4b6d495443a386dab7b7e39b7251bf86640ea351eda070b813e9997ef29c

    • memory/2200-48-0x0000000000400000-0x0000000000479000-memory.dmp

      Filesize

      484KB

    • memory/2476-16-0x0000000000400000-0x00000000004B6000-memory.dmp

      Filesize

      728KB

    • memory/2476-15-0x0000000000400000-0x00000000004B6000-memory.dmp

      Filesize

      728KB

    • memory/2476-5-0x0000000000400000-0x00000000004B6000-memory.dmp

      Filesize

      728KB

    • memory/2476-10-0x0000000000400000-0x00000000004B6000-memory.dmp

      Filesize

      728KB

    • memory/2476-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2476-7-0x0000000000400000-0x00000000004B6000-memory.dmp

      Filesize

      728KB

    • memory/2476-3-0x0000000000400000-0x00000000004B6000-memory.dmp

      Filesize

      728KB

    • memory/2476-14-0x0000000000400000-0x00000000004B6000-memory.dmp

      Filesize

      728KB

    • memory/2476-30-0x0000000000400000-0x00000000004B6000-memory.dmp

      Filesize

      728KB

    • memory/2476-12-0x0000000000400000-0x00000000004B6000-memory.dmp

      Filesize

      728KB

    • memory/2476-17-0x0000000000400000-0x00000000004B6000-memory.dmp

      Filesize

      728KB

    • memory/2476-13-0x0000000000400000-0x00000000004B6000-memory.dmp

      Filesize

      728KB

    • memory/2712-46-0x0000000000400000-0x00000000004B6000-memory.dmp

      Filesize

      728KB

    • memory/2712-45-0x0000000000400000-0x00000000004B6000-memory.dmp

      Filesize

      728KB

    • memory/2712-44-0x0000000000400000-0x00000000004B6000-memory.dmp

      Filesize

      728KB

    • memory/2712-47-0x0000000000400000-0x00000000004B6000-memory.dmp

      Filesize

      728KB

    • memory/2712-52-0x0000000000400000-0x00000000004B6000-memory.dmp

      Filesize

      728KB

    • memory/2956-2-0x0000000000401000-0x0000000000411000-memory.dmp

      Filesize

      64KB

    • memory/2956-11-0x0000000000401000-0x0000000000411000-memory.dmp

      Filesize

      64KB