Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
28-10-2024 00:27
General
-
Target
76b9d8f69e9fb4a5a9d8efb9b98ded46_JaffaCakes118.exe
-
Size
760KB
-
MD5
76b9d8f69e9fb4a5a9d8efb9b98ded46
-
SHA1
5a700070c6fb5f6eac2012840f83e8e524711bf2
-
SHA256
cb46ff69389607aa3e2d0f24fe646dbba62b425f421db8322b9c58766375541a
-
SHA512
448d8163af31a2a068120b7a304ff1776a30114420c3a48b4ec9f9220ffe29372422473b4b85ee0a2bc8ffefb6d1bbc08d1cbe938dfbeaeefda7df3b1b13fa38
-
SSDEEP
12288:+x9PUtHiov1GOqUuD8Qauj5/e0PuAjF/6p0:+x9PfodGOqTD8QTd/e0JV6q
Malware Config
Extracted
latentbot
ayyashsanderoman.zapto.org
Signatures
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
Darkcomet family
-
LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
-
Latentbot family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\76b9d8f69e9fb4a5a9d8efb9b98ded46_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\76b9d8f69e9fb4a5a9d8efb9b98ded46_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
8KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
764KB
-
Filesize
764KB