Overview

overview

10

Static

static

3

72a931ef0a...18.exe

windows7-x64

10

72a931ef0a...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    142s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-10-2024 06:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    72a931ef0a159a189c4f0ad9a414d6bb_JaffaCakes118.exe

  • Size

    876KB

  • MD5

    72a931ef0a159a189c4f0ad9a414d6bb

  • SHA1

    b3c75801c9532c5c4309c3d261699f71be1d818d

  • SHA256

    a95d57e251e2fc8f0b9426e0f94bd00186610221f0d10642fafc01e9875eb80b

  • SHA512

    2b6c7d34c65cded16fe04a3f780deb7cda40e45be02b2039f2b85b0ec0d6de925525daa74fe314520eb8a623aecc5f5927b1658b64018bdd402ff2ba153d11be

  • SSDEEP

    24576:fS/nGK9VN/BOUqhCqTeMXMEuH3Iqg2if9IwZVbALQd+N:anNBOUWCOxXM7HI9DVsLQM

Score
10/10
darkcometbootkitdiscoveryevasionpersistencerattrojan

Malware Config

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet
  • Modifies firewall policy service 3 TTPs 4 IoCs
    evasion
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 1 IoCs
    evasiontrojan
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Windows security modification 2 TTPs 1 IoCs
    evasiontrojan
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 22 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 25 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\72a931ef0a159a189c4f0ad9a414d6bb_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\72a931ef0a159a189c4f0ad9a414d6bb_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:676
    • C:\Users\Admin\AppData\Local\Temp\72a931ef0a159a189c4f0ad9a414d6bb_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\72a931ef0a159a189c4f0ad9a414d6bb_JaffaCakes118.exe
      2⤵
      • Modifies firewall policy service
      • UAC bypass
      • Windows security bypass
      • Checks computer location settings
      • Windows security modification
      • Checks whether UAC is enabled
      • Writes to the Master Boot Record (MBR)
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:35528
      • C:\Windows\SysWOW64\net.exe
        "C:\Windows\System32\net.exe" stop sharedaccess
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:34856
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop sharedaccess
          4⤵
          • System Location Discovery: System Language Discovery
          PID:34928
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\dfshim.dll",ShOpenVerbApplication C:\Users\Admin\AppData\Local\Temp\Checker.application
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5124
        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
          4⤵
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          PID:5232
      • C:\Users\Admin\AppData\Local\Temp\72a931ef0a159a189c4f0ad9a414d6bb_JaffaCakes118.exe
        C:\Users\Admin\AppData\Local\Temp\72a931ef0a159a189c4f0ad9a414d6bb_JaffaCakes118.exe
        3⤵
          PID:5328
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 5328 -s 12
            4⤵
            • Program crash
            PID:5832
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5328 -ip 5328
      1⤵
        PID:5648

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      Persistence

      Create or Modify System Process

      1
      T1543

      Windows Service

      1
      T1543.003

      Pre-OS Boot

      1
      T1542

      Bootkit

      1
      T1542.003

      Privilege Escalation

      Abuse Elevation Control Mechanism

      1
      T1548

      Bypass User Account Control

      1
      T1548.002

      Create or Modify System Process

      1
      T1543

      Windows Service

      1
      T1543.003

      Defense Evasion

      Abuse Elevation Control Mechanism

      1
      T1548

      Bypass User Account Control

      1
      T1548.002

      Impair Defenses

      4
      T1562

      Disable or Modify System Firewall

      1
      T1562.004

      Disable or Modify Tools

      3
      T1562.001

      Modify Registry

      5
      T1112

      Pre-OS Boot

      1
      T1542

      Bootkit

      1
      T1542.003

      Credential Access

      Discovery

      Network Share Discovery

      1
      T1135

      Query Registry

      1
      T1012

      System Information Discovery

      3
      T1082

      System Location Discovery

      1
      T1614

      System Language Discovery

      1
      T1614.001

      Lateral Movement

      Collection

      Command and Control

      Exfiltration

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\Checker.application
        Filesize

        5KB

        MD5

        989b52043f54eb95b95714abe032f61e

        SHA1

        0af5f4bfa4e042e695aea5f2e0eaa12770f55bf2

        SHA256

        ce3d7cda38310b909d4fd2ce95f8f8839ca24a96b539d5ba0d3ff82158d91130

        SHA512

        67f28b3231ec0c7af4af945d2a479039b4cbd41a53a6a0be304bdf3a4ae3fde7e3d195d0f9906b3b46c4bbc19603f16214915ac0f49123acd392e13b75baa330

        Download Submit

      • memory/5232-15873-0x00000225EA380000-0x00000225EA3D0000-memory.dmp

        Filesize

        320KB

        Download

      • memory/5232-15865-0x00000225CF840000-0x00000225CF848000-memory.dmp

        Filesize

        32KB

        Download

      • memory/5232-15866-0x00000225E9E30000-0x00000225E9FB6000-memory.dmp

        Filesize

        1.5MB

        Download

      • memory/5232-15880-0x00000225E9FC0000-0x00000225EA148000-memory.dmp

        Filesize

        1.5MB

        Download

      • memory/5232-15882-0x00000225E9FC0000-0x00000225EA148000-memory.dmp

        Filesize

        1.5MB

        Download

      • memory/5328-15869-0x0000000013140000-0x00000000131F6000-memory.dmp

        Filesize

        728KB

        Download

      • memory/35528-15544-0x0000000000400000-0x000000000044C000-memory.dmp

        Filesize

        304KB

        Download

      • memory/35528-15543-0x0000000000400000-0x000000000044C000-memory.dmp

        Filesize

        304KB

        Download

      • memory/35528-15541-0x0000000000400000-0x000000000044C000-memory.dmp

        Filesize

        304KB

        Download

      • memory/35528-15540-0x0000000000400000-0x000000000044C000-memory.dmp

        Filesize

        304KB

        Download

      • memory/35528-15537-0x0000000000400000-0x000000000044C000-memory.dmp

        Filesize

        304KB

        Download

      • memory/35528-15877-0x0000000000400000-0x000000000044C000-memory.dmp

        Filesize

        304KB

        Download