Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
10-08-2024 19:40
General
-
Target
8765a5e1f007f0063ab6d1f55a986fe8_JaffaCakes118.exe
-
Size
1.5MB
-
MD5
8765a5e1f007f0063ab6d1f55a986fe8
-
SHA1
0df249f5c7d9e6bb91c73a8fd7651d186571b97c
-
SHA256
df11a1c9b0f856c56cde814e93905525b87b81ad089fee0e5f8ac685fd582fba
-
SHA512
4eb5ca1663b452f80062df5a5f91630d3c7def41c334118d1b4a4862ad642fb3d7960f56b32082ff5fbff2b78a9fbc11961b949c4f1e765a144fa4f959658038
-
SSDEEP
24576:6MKL7S6ZU6+7oiXkgPDBfvWuljngt1ZNmPDPe9NrR2Df8oasV7qwMpELbQIplqVT:6pL7SVRciXFteuljuZMPavrRytaIqzuR
Malware Config
Extracted
darkcomet
aaaa608
handsomehearteng.zapto.org:1608
DC_MUTEX-WPKUFHB
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
nlbQUbAhW2Ce
-
install
true
-
offline_keylogger
false
-
password
123456
-
persistence
false
-
reg_key
MicroUpdate
Extracted
latentbot
handsomehearteng.zapto.org
Signatures
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
ASPack v2.12-2.42 1 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 48 IoCs
-
Suspicious use of FindShellTrayWindow 61 IoCs
-
Suspicious use of SendNotifyMessage 8 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8765a5e1f007f0063ab6d1f55a986fe8_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8765a5e1f007f0063ab6d1f55a986fe8_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\SEX PORN CELEBRITY HOT FIRST TIME FUCKED - COPY.WMV"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD58765a5e1f007f0063ab6d1f55a986fe8
SHA10df249f5c7d9e6bb91c73a8fd7651d186571b97c
SHA256df11a1c9b0f856c56cde814e93905525b87b81ad089fee0e5f8ac685fd582fba
SHA5124eb5ca1663b452f80062df5a5f91630d3c7def41c334118d1b4a4862ad642fb3d7960f56b32082ff5fbff2b78a9fbc11961b949c4f1e765a144fa4f959658038
-
Filesize
1.3MB
MD5e0229f0e0829ed76033bcaeca02ba3d2
SHA1bcd9e8835c82bdf1eccd56f142d169f1a3c5130d
SHA256890b236da6eea440d080f11ee575f633b6deeccb6845b7ec5f45460638162118
SHA51226036b39ab1f3bc267e092823f1941155f47391ef7dab7e1e419f4ac0706b8c4482b687c974032abb3e543ade5dcf9519b9ccddc4b13e141640d865094d2f8d5
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
144KB
-
Filesize
1.5MB
-
Filesize
208KB
-
Filesize
1.5MB
-
Filesize
92KB
-
Filesize
992KB
-
Filesize
92KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
116KB
-
Filesize
2.7MB
-
Filesize
68KB
-
Filesize
92KB
-
Filesize
96KB
-
Filesize
2.0MB
-
Filesize
68KB
-
Filesize
260KB
-
Filesize
96KB
-
Filesize
132KB
-
Filesize
68KB
-
Filesize
96KB
-
Filesize
108KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
192KB
-
Filesize
208KB
-
Filesize
160KB
-
Filesize
412KB
-
Filesize
348KB
-
Filesize
68KB
-
Filesize
496KB
-
Filesize
188KB
-
Filesize
64KB
-
Filesize
68KB
-
Filesize
2.3MB
-
Filesize
68KB
-
Filesize
388KB
-
Filesize
68KB
-
Filesize
312KB
-
Filesize
72KB
-
Filesize
68KB
-
Filesize
84KB
-
Filesize
348KB
-
Filesize
464KB
-
Filesize
284KB
-
Filesize
84KB
-
Filesize
2.7MB
-
Filesize
348KB
-
Filesize
1.4MB
-
Filesize
16.7MB
-
Filesize
308KB
-
Filesize
264KB
-
Filesize
2.0MB
-
Filesize
72KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB