Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    01-08-2024 07:22

General

  • Target

    7fa2962d464a1e6aaff03c09cf7e538b_JaffaCakes118.exe

  • Size

    592KB

  • MD5

    7fa2962d464a1e6aaff03c09cf7e538b

  • SHA1

    53ed1256ee387bd8fd015bba0bdc79d754d22c7c

  • SHA256

    f876c0b4cde4cf27754c95b605b62e1952f7c0416ac38a08db6178a895acb4c1

  • SHA512

    99f3f98690da192a7f495236501a40454fcf59bf62c5694f0208b5114886de50ccd23c2d8ad8911a41a670c39369585aa99140269a1534dbea0db4d6eaf6d2b9

  • SSDEEP

    6144:KdtifXN7XegqunP25EmcmiSZPoCE0H3tovCL6DJreQQf17E4oMkZ98gWNlPTGQQX:KOl7OgHP/kiSZBhtovE6SdOvINtTird

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

saw-88.no-ip.biz:1604

Mutex

DC_MUTEX-FAAE1T4

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    4chxqdwMXJlw

  • install

    true

  • offline_keylogger

    false

  • persistence

    true

  • reg_key

    MicroUpdate

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7fa2962d464a1e6aaff03c09cf7e538b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\7fa2962d464a1e6aaff03c09cf7e538b_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Loads dropped DLL
    • Adds Run key to start application
    • Writes to the Master Boot Record (MBR)
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2520
    • C:\Windows\SysWOW64\notepad.exe
      notepad
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1924
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1924 -s 220
        3⤵
        • Program crash
        PID:2472
    • C:\MSDCSC\msdcsc.exe
      "C:\MSDCSC\msdcsc.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Writes to the Master Boot Record (MBR)
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2804
      • C:\Program Files (x86)\Internet Explorer\iexplore.exe
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
        3⤵
          PID:2740
        • C:\Windows\explorer.exe
          "C:\Windows\explorer.exe"
          3⤵
            PID:2616

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\MSDCSC\msdcsc.exe

        Filesize

        592KB

        MD5

        7fa2962d464a1e6aaff03c09cf7e538b

        SHA1

        53ed1256ee387bd8fd015bba0bdc79d754d22c7c

        SHA256

        f876c0b4cde4cf27754c95b605b62e1952f7c0416ac38a08db6178a895acb4c1

        SHA512

        99f3f98690da192a7f495236501a40454fcf59bf62c5694f0208b5114886de50ccd23c2d8ad8911a41a670c39369585aa99140269a1534dbea0db4d6eaf6d2b9

      • memory/1924-25-0x0000000000180000-0x0000000000181000-memory.dmp

        Filesize

        4KB

      • memory/1924-11-0x0000000000080000-0x0000000000081000-memory.dmp

        Filesize

        4KB

      • memory/2520-6-0x0000000000620000-0x0000000000621000-memory.dmp

        Filesize

        4KB

      • memory/2520-5-0x00000000005E0000-0x00000000005E1000-memory.dmp

        Filesize

        4KB

      • memory/2520-4-0x00000000003A0000-0x00000000003A1000-memory.dmp

        Filesize

        4KB

      • memory/2520-3-0x00000000003B0000-0x00000000003B1000-memory.dmp

        Filesize

        4KB

      • memory/2520-2-0x0000000000600000-0x0000000000601000-memory.dmp

        Filesize

        4KB

      • memory/2520-8-0x0000000001F10000-0x0000000001F11000-memory.dmp

        Filesize

        4KB

      • memory/2520-35-0x0000000000400000-0x0000000000520000-memory.dmp

        Filesize

        1.1MB

      • memory/2520-7-0x0000000001E80000-0x0000000001E81000-memory.dmp

        Filesize

        4KB

      • memory/2520-0-0x0000000000400000-0x0000000000520000-memory.dmp

        Filesize

        1.1MB

      • memory/2520-36-0x0000000000520000-0x0000000000563000-memory.dmp

        Filesize

        268KB

      • memory/2520-1-0x0000000000520000-0x0000000000563000-memory.dmp

        Filesize

        268KB

      • memory/2804-40-0x0000000000400000-0x0000000000520000-memory.dmp

        Filesize

        1.1MB

      • memory/2804-47-0x0000000000400000-0x0000000000520000-memory.dmp

        Filesize

        1.1MB

      • memory/2804-38-0x0000000000400000-0x0000000000520000-memory.dmp

        Filesize

        1.1MB

      • memory/2804-41-0x0000000000270000-0x00000000002B3000-memory.dmp

        Filesize

        268KB

      • memory/2804-42-0x0000000000400000-0x0000000000520000-memory.dmp

        Filesize

        1.1MB

      • memory/2804-43-0x0000000000400000-0x0000000000520000-memory.dmp

        Filesize

        1.1MB

      • memory/2804-44-0x0000000000400000-0x0000000000520000-memory.dmp

        Filesize

        1.1MB

      • memory/2804-45-0x0000000000400000-0x0000000000520000-memory.dmp

        Filesize

        1.1MB

      • memory/2804-46-0x0000000000400000-0x0000000000520000-memory.dmp

        Filesize

        1.1MB

      • memory/2804-37-0x0000000000270000-0x00000000002B3000-memory.dmp

        Filesize

        268KB

      • memory/2804-48-0x0000000000400000-0x0000000000520000-memory.dmp

        Filesize

        1.1MB

      • memory/2804-49-0x0000000000400000-0x0000000000520000-memory.dmp

        Filesize

        1.1MB

      • memory/2804-50-0x0000000000400000-0x0000000000520000-memory.dmp

        Filesize

        1.1MB

      • memory/2804-51-0x0000000000400000-0x0000000000520000-memory.dmp

        Filesize

        1.1MB

      • memory/2804-52-0x0000000000400000-0x0000000000520000-memory.dmp

        Filesize

        1.1MB

      • memory/2804-53-0x0000000000400000-0x0000000000520000-memory.dmp

        Filesize

        1.1MB

      • memory/2804-54-0x0000000000400000-0x0000000000520000-memory.dmp

        Filesize

        1.1MB

      • memory/2804-55-0x0000000000400000-0x0000000000520000-memory.dmp

        Filesize

        1.1MB