Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21/10/2024, 12:44
General
-
Target
66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe
-
Size
1.1MB
-
MD5
66bf2bd6bcd6c3a39c5499a68a63e756
-
SHA1
839c75ada4d42132b318e8485af1bef13f161f7a
-
SHA256
05d8b7fd8054a5edda812894f1eab9d3fb91e18035851b1caed217a6bde18c41
-
SHA512
ac894fa159a50a43b493c69bf397640d3356a8803f1edbf53aa95d256ebee3df21a02ef5767b1388ad3f5636b4b96f6e9a128b8906ee651b12640c8f01ed6739
-
SSDEEP
24576:OSTr6jNMfUpY99HJnRigrOy4GSJcH+ns4:V6jXm999RiqOyiJceb
Malware Config
Signatures
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Modifies firewall policy service 3 TTPs 2 IoCs
-
UAC bypass 3 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Windows security modification 2 TTPs 1 IoCs
-
Checks for any installed AV software in registry 1 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory 2 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 49 IoCs
-
Suspicious use of AdjustPrivilegeToken 48 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 29 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe2⤵
- Modifies WinLogon for persistence
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sharedaccess3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sharedaccess4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\66bf2bd6bcd6c3a39c5499a68a63e756_JaffaCakes118.exe3⤵
- Checks BIOS information in registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
4KB
-
Filesize
768KB
-
Filesize
56KB
-
Filesize
100KB
-
Filesize
664KB
-
Filesize
612KB
-
Filesize
612KB
-
Filesize
144KB
-
Filesize
308KB
-
Filesize
44KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
56KB
-
Filesize
300KB
-
Filesize
44KB
-
Filesize
8KB
-
Filesize
100KB
-
Filesize
452KB
-
Filesize
32KB
-
Filesize
452KB
-
Filesize
196KB
-
Filesize
196KB
-
Filesize
52KB
-
Filesize
52KB
-
Filesize
428KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
144KB
-
Filesize
196KB
-
Filesize
308KB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
8KB
-
Filesize
100KB
-
Filesize
56KB
-
Filesize
428KB
-
Filesize
52KB
-
Filesize
52KB
-
Filesize
196KB
-
Filesize
56KB
-
Filesize
300KB
-
Filesize
44KB
-
Filesize
300KB
-
Filesize
44KB
-
Filesize
144KB
-
Filesize
144KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB
-
Filesize
300KB