Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/07/2024, 16:46

General

  • Target

    63f9723347a7bea08e0fb6bd01f3ad88_JaffaCakes118.exe

  • Size

    636KB

  • MD5

    63f9723347a7bea08e0fb6bd01f3ad88

  • SHA1

    d54f9e900ecd96e4a4af07ae19ed6ca5c2e9c181

  • SHA256

    66bde5cc3371d495bdad3f685cf6dbbd911b2a8af5a507d00a126e2a2d85428d

  • SHA512

    4d6d0e43d082a13f99f3b9a5704432554b01dc81b620fc1f1c8711881c21ae02a9d4e7308fe573ef0d916a5679c0f965d793c9561c4fc6c5fcd4271113a4b385

  • SSDEEP

    12288:za/0nnPAmH26lASmzxheH9GwJRoTVxs5DIDZDh4Y3wJC/bWZ6P:TZDtChedJRYV5lb3wU/bh

Malware Config

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops desktop.ini file(s) 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\63f9723347a7bea08e0fb6bd01f3ad88_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\63f9723347a7bea08e0fb6bd01f3ad88_JaffaCakes118.exe"
    1⤵
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Suspicious use of SetThreadContext
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:4088
    • C:\Users\Admin\AppData\Local\Temp\plugtemp\svchost.exe
      C:\Users\Admin\AppData\Local\Temp\\plugtemp\svchost.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2020

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\plugtemp\svchost.exe

    Filesize

    1.1MB

    MD5

    d881de17aa8f2e2c08cbb7b265f928f9

    SHA1

    08936aebc87decf0af6e8eada191062b5e65ac2a

    SHA256

    b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

    SHA512

    5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

  • memory/2020-21-0x0000000074AE0000-0x00000000750E8000-memory.dmp

    Filesize

    6.0MB

  • memory/2020-29-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB

  • memory/2020-35-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB

  • memory/2020-8-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB

  • memory/2020-13-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB

  • memory/2020-14-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB

  • memory/2020-16-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB

  • memory/2020-34-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB

  • memory/2020-20-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB

  • memory/2020-19-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB

  • memory/2020-18-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB

  • memory/2020-33-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB

  • memory/2020-23-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB

  • memory/2020-32-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB

  • memory/2020-28-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB

  • memory/2020-25-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB

  • memory/2020-26-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB

  • memory/2020-27-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB

  • memory/2020-24-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB

  • memory/2020-22-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB

  • memory/2020-30-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB

  • memory/2020-31-0x0000000000400000-0x00000000004AF000-memory.dmp

    Filesize

    700KB

  • memory/4088-2-0x0000000074B30000-0x00000000750E1000-memory.dmp

    Filesize

    5.7MB

  • memory/4088-0-0x0000000074B32000-0x0000000074B33000-memory.dmp

    Filesize

    4KB

  • memory/4088-17-0x0000000074B30000-0x00000000750E1000-memory.dmp

    Filesize

    5.7MB

  • memory/4088-1-0x0000000074B30000-0x00000000750E1000-memory.dmp

    Filesize

    5.7MB