Analysis
-
max time kernel
144s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
09-09-2024 02:54
General
-
Target
d58b8a39a413e1cdafe366a2aa8be0bd_JaffaCakes118.exe
-
Size
1.4MB
-
MD5
d58b8a39a413e1cdafe366a2aa8be0bd
-
SHA1
03aff7d12482527cb69db88f0695179ae5e04461
-
SHA256
fa3f15ee92c063e81a7c10f2257ef6806b68f8836ef38202769a24935fc8253b
-
SHA512
7037c36586f3c4854110396460bbe7e67ca55d798c8b2260b08307381cf8ee780cbabf8418fe4c0cba0ca20ef12b5b8f78b01e927100d9b3a3dde5c2675e6d7a
-
SSDEEP
24576:DX60inDv9gGw6gMC9jC6upfF0w8Rp5TKXdeNQNuLswq3fEBIKwdukDT1/YOM4Qcp:gnD2G0e6afqwsp5TKXdqYIsJfSa3ZBlu
Malware Config
Extracted
darkcomet
aaaa606
handsomehearteng.zapto.org:1606
DC_MUTEX-TXHDLD1
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
W9fRuhVE2qYB
-
install
true
-
offline_keylogger
false
-
password
123456
-
persistence
false
-
reg_key
MicroUpdate
Extracted
latentbot
handsomehearteng.zapto.org
Signatures
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 48 IoCs
-
Suspicious use of FindShellTrayWindow 48 IoCs
-
Suspicious use of SendNotifyMessage 8 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d58b8a39a413e1cdafe366a2aa8be0bd_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d58b8a39a413e1cdafe366a2aa8be0bd_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\SEX PORN CELEBRITY HOT FIRST TIME FUCKED - COPY.WMV"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSDCSC\msdcsc.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5e0229f0e0829ed76033bcaeca02ba3d2
SHA1bcd9e8835c82bdf1eccd56f142d169f1a3c5130d
SHA256890b236da6eea440d080f11ee575f633b6deeccb6845b7ec5f45460638162118
SHA51226036b39ab1f3bc267e092823f1941155f47391ef7dab7e1e419f4ac0706b8c4482b687c974032abb3e543ade5dcf9519b9ccddc4b13e141640d865094d2f8d5
-
Filesize
1.4MB
MD5d58b8a39a413e1cdafe366a2aa8be0bd
SHA103aff7d12482527cb69db88f0695179ae5e04461
SHA256fa3f15ee92c063e81a7c10f2257ef6806b68f8836ef38202769a24935fc8253b
SHA5127037c36586f3c4854110396460bbe7e67ca55d798c8b2260b08307381cf8ee780cbabf8418fe4c0cba0ca20ef12b5b8f78b01e927100d9b3a3dde5c2675e6d7a
-
Filesize
2.1MB
-
Filesize
4KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
64KB
-
Filesize
1.5MB
-
Filesize
92KB
-
Filesize
2.7MB
-
Filesize
68KB
-
Filesize
116KB
-
Filesize
68KB
-
Filesize
92KB
-
Filesize
68KB
-
Filesize
96KB
-
Filesize
68KB
-
Filesize
348KB
-
Filesize
160KB
-
Filesize
2.0MB
-
Filesize
88KB
-
Filesize
68KB
-
Filesize
188KB
-
Filesize
392KB
-
Filesize
436KB
-
Filesize
80KB
-
Filesize
76KB
-
Filesize
264KB
-
Filesize
788KB
-
Filesize
72KB
-
Filesize
2.0MB
-
Filesize
264KB
-
Filesize
308KB
-
Filesize
208KB
-
Filesize
92KB
-
Filesize
16.7MB
-
Filesize
144KB
-
Filesize
496KB
-
Filesize
992KB
-
Filesize
412KB
-
Filesize
84KB
-
Filesize
1.4MB
-
Filesize
68KB
-
Filesize
76KB
-
Filesize
388KB
-
Filesize
140KB
-
Filesize
284KB
-
Filesize
192KB
-
Filesize
464KB
-
Filesize
96KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
312KB
-
Filesize
84KB
-
Filesize
72KB
-
Filesize
68KB
-
Filesize
348KB
-
Filesize
108KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
96KB
-
Filesize
132KB
-
Filesize
260KB
-
Filesize
208KB
-
Filesize
1.5MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB