Resubmissions

31-07-2024 19:45

240731-ygsxzazerp 10

31-07-2024 19:07

240731-xslscstbqf 10

Analysis

  • max time kernel
    37s
  • max time network
    38s
  • platform
    windows10-1703_x64
  • resource
    win10-20240611-en
  • resource tags

    arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
  • submitted
    31-07-2024 19:45

General

  • Target

    7d9512b4df2dd9a08b99bb5d4f644a1b_JaffaCakes118.exe

  • Size

    379KB

  • MD5

    7d9512b4df2dd9a08b99bb5d4f644a1b

  • SHA1

    1972b0cdc54764b5df7fb94176bca0f8d812fe2c

  • SHA256

    6da662c998ef51d63aba6cccdf510e7e584b4d8505e2fa0dbe19a70632dba4c6

  • SHA512

    4d71364bab0946cc892a36a0bb85f2f68f17d7c958e8427e78666063674fdfd5dd81c5b01be90f9a1a48c9f476e80ad219b1e9a37aa696dac63877dced66d815

  • SSDEEP

    6144:CovtRpmsVeVTPuoEW2pAFNOGkR4nZg7Yf1YbE5lCJ8IIQaJ6a7a2CEbxBqirpRO1:CqtONjhEW5FNeR4ZG76lzIIRJ6u4EFou

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

smr9.no-ip.org:1604

Mutex

DC_MUTEX-NJSZLY8

Attributes
  • InstallPath

    MSDCSC\lsass.exe

  • gencode

    6xtSkc229rlk

  • install

    true

  • offline_keylogger

    false

  • password

    123456

  • persistence

    true

  • reg_key

    lsass.exe

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Modifies registry class 13 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 37 IoCs
  • Suspicious use of AdjustPrivilegeToken 51 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7d9512b4df2dd9a08b99bb5d4f644a1b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\7d9512b4df2dd9a08b99bb5d4f644a1b_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Checks computer location settings
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4764
    • C:\MSDCSC\lsass.exe
      "C:\MSDCSC\lsass.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:208
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4448
    • C:\Windows\system32\mspaint.exe
      "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\CheckpointSuspend.png" /ForceBootstrapPaint3D
      1⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:4936
    • C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe
      "C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe" -ServerName:Microsoft.MSPaint.AppX437q68k2qc2asvaagas2prv9tjej6ja9.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:4388

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\MSDCSC\lsass.exe

      Filesize

      379KB

      MD5

      7d9512b4df2dd9a08b99bb5d4f644a1b

      SHA1

      1972b0cdc54764b5df7fb94176bca0f8d812fe2c

      SHA256

      6da662c998ef51d63aba6cccdf510e7e584b4d8505e2fa0dbe19a70632dba4c6

      SHA512

      4d71364bab0946cc892a36a0bb85f2f68f17d7c958e8427e78666063674fdfd5dd81c5b01be90f9a1a48c9f476e80ad219b1e9a37aa696dac63877dced66d815

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\Projects\Projects.json

      Filesize

      2B

      MD5

      d751713988987e9331980363e24189ce

      SHA1

      97d170e1550eee4afc0af065b78cda302a97674c

      SHA256

      4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

      SHA512

      b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\Projects\Projects.json

      Filesize

      233B

      MD5

      74e6792bd2d877b4f9c977302290f8c6

      SHA1

      a18e2de661e53ff4cc2ceaed142a3ce60c658c9c

      SHA256

      96a36d99486ece284c9c227b853fa656e1f15a0c4a1463fde1af90aaf33893f6

      SHA512

      5e8a60a464d11a10d30c76185c7f9eda3ac7e12cc6b562736c979e0765578a8e15a8d0100176f49e2b6664767f428ab5c402e6406ccaea855614fba322e2877e

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.MSPaint_8wekyb3d8bbwe\LocalState\cloudCommunitySettings.json

      Filesize

      2KB

      MD5

      404a3ec24e3ebf45be65e77f75990825

      SHA1

      1e05647cf0a74cedfdeabfa3e8ee33b919780a61

      SHA256

      cc45905af3aaa62601a69c748a06a2fa48eca3b28d44d8ec18764a7e8e4c3da2

      SHA512

      a55382b72267375821b0a229d3529ed54cef0f295f550d1e95661bafccec606aa1cd72e059d37d78e7d2927ae72e2919941251d233152f5eeb32ffdfc96023e5

    • memory/208-81-0x0000000000400000-0x00000000004D1000-memory.dmp

      Filesize

      836KB

    • memory/208-69-0x0000000000400000-0x00000000004D1000-memory.dmp

      Filesize

      836KB

    • memory/208-163-0x0000000000400000-0x00000000004D1000-memory.dmp

      Filesize

      836KB

    • memory/208-152-0x0000000000400000-0x00000000004D1000-memory.dmp

      Filesize

      836KB

    • memory/208-82-0x0000000000400000-0x00000000004D1000-memory.dmp

      Filesize

      836KB

    • memory/208-74-0x0000000000400000-0x00000000004D1000-memory.dmp

      Filesize

      836KB

    • memory/208-64-0x0000000000400000-0x00000000004D1000-memory.dmp

      Filesize

      836KB

    • memory/208-65-0x0000000000400000-0x00000000004D1000-memory.dmp

      Filesize

      836KB

    • memory/208-68-0x0000000000400000-0x00000000004D1000-memory.dmp

      Filesize

      836KB

    • memory/208-67-0x0000000000400000-0x00000000004D1000-memory.dmp

      Filesize

      836KB

    • memory/208-66-0x0000000000400000-0x00000000004D1000-memory.dmp

      Filesize

      836KB

    • memory/208-73-0x0000000000400000-0x00000000004D1000-memory.dmp

      Filesize

      836KB

    • memory/208-71-0x0000000000400000-0x00000000004D1000-memory.dmp

      Filesize

      836KB

    • memory/208-70-0x0000000000400000-0x00000000004D1000-memory.dmp

      Filesize

      836KB

    • memory/4764-72-0x0000000000400000-0x00000000004D1000-memory.dmp

      Filesize

      836KB

    • memory/4764-1-0x0000000000400000-0x00000000004D1000-memory.dmp

      Filesize

      836KB

    • memory/4764-2-0x0000000000400000-0x00000000004D1000-memory.dmp

      Filesize

      836KB

    • memory/4764-0-0x0000000000400000-0x00000000004D1000-memory.dmp

      Filesize

      836KB

    • memory/4764-8-0x0000000000400000-0x00000000004D1000-memory.dmp

      Filesize

      836KB

    • memory/4764-3-0x0000000000400000-0x00000000004D1000-memory.dmp

      Filesize

      836KB

    • memory/4764-5-0x00000000004CF000-0x00000000004D0000-memory.dmp

      Filesize

      4KB

    • memory/4764-4-0x0000000000400000-0x00000000004D1000-memory.dmp

      Filesize

      836KB

    • memory/4764-7-0x0000000000400000-0x00000000004D1000-memory.dmp

      Filesize

      836KB

    • memory/4764-6-0x0000000000400000-0x00000000004D1000-memory.dmp

      Filesize

      836KB