Overview

overview

10

Static

static

3

83c318fb4d...18.exe

windows7-x64

10

83c318fb4d...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-10-2024 23:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    83c318fb4da8950bf50f8533ef1d293b_JaffaCakes118.exe

  • Size

    564KB

  • MD5

    83c318fb4da8950bf50f8533ef1d293b

  • SHA1

    37d890ec897788f21e958e31a2a7275a17784f0d

  • SHA256

    901f4ee6d85a6727cf4698ee30ebd8c1898350fc55f644ce3c0417d9669d27ac

  • SHA512

    468ecd34af6f61d2dbe883213f7fbe73152f8efed012c4a2b0fc8483b3810c57e55e18ebca6f51bc1e9a30c418e530b3e075c94f32076f86eff1ade0b1ca2771

  • SSDEEP

    12288:5Mu4Ll1rkHbSuPpjrYIOdHTPbZY/KArakBo9O:5MuAl1SbSyjrYnz9YC0u4

Score
10/10
darkcometdiscoverypersistencerattrojan

Malware Config

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet
  • Darkcomet family
    darkcomet
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 52 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 56 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\83c318fb4da8950bf50f8533ef1d293b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\83c318fb4da8950bf50f8533ef1d293b_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4428
    • C:\Users\Admin\AppData\Local\Temp\83c318fb4da8950bf50f8533ef1d293b_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\83c318fb4da8950bf50f8533ef1d293b_JaffaCakes118.exe
      2⤵
      • Modifies WinLogon for persistence
      • Checks BIOS information in registry
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3248
      • C:\Windows\SysWOW64\notepad.exe
        notepad
        3⤵
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        PID:4616
      • C:\Windows\SysWOW64\explorer.exe
        "C:\Windows\SysWOW64\explorer.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3672
        • C:\Windows\SysWOW64\explorer.exe
          C:\Windows\SysWOW64\explorer.exe
          4⤵
          • Checks BIOS information in registry
          • System Location Discovery: System Language Discovery
          • Checks processor information in registry
          • Enumerates system info in registry
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:4584
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3108
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:4420
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1508
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4516

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133748923597748705.txt
    Filesize

    74KB

    MD5

    e1a71a6976ee8ebca22c516a0647c7f8

    SHA1

    03cc0bc475d5e518c6607a8c80261bc6eb1378fe

    SHA256

    38220fa1d2535db56b52cdb12efc02206817f2dd2dc57ce9faa1de4eb3e1689f

    SHA512

    2a5166496c921ace0c7e2532f654e0e07fe57a6cfed2fa7271c67e3044787ab331e9f4c0f38bcc98ddfcff3d402c3140ed127a6855db10131eff536c76e755a9

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\MGA6_crack
    Filesize

    564KB

    MD5

    83c318fb4da8950bf50f8533ef1d293b

    SHA1

    37d890ec897788f21e958e31a2a7275a17784f0d

    SHA256

    901f4ee6d85a6727cf4698ee30ebd8c1898350fc55f644ce3c0417d9669d27ac

    SHA512

    468ecd34af6f61d2dbe883213f7fbe73152f8efed012c4a2b0fc8483b3810c57e55e18ebca6f51bc1e9a30c418e530b3e075c94f32076f86eff1ade0b1ca2771

    Download Submit

  • memory/3248-5-0x0000000013140000-0x000000001320F000-memory.dmp

    Filesize

    828KB

    Download

  • memory/3248-2-0x0000000013140000-0x000000001320F000-memory.dmp

    Filesize

    828KB

    Download

  • memory/3248-6-0x0000000002260000-0x0000000002261000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3248-4-0x0000000013140000-0x000000001320F000-memory.dmp

    Filesize

    828KB

    Download

  • memory/3248-3-0x0000000013140000-0x000000001320F000-memory.dmp

    Filesize

    828KB

    Download

  • memory/3248-22-0x0000000013140000-0x000000001320F000-memory.dmp

    Filesize

    828KB

    Download

  • memory/3672-14-0x0000000000400000-0x000000000048D000-memory.dmp

    Filesize

    564KB

    Download

  • memory/3672-16-0x0000000000400000-0x000000000048D000-memory.dmp

    Filesize

    564KB

    Download

  • memory/3672-28-0x0000000000400000-0x000000000048D000-memory.dmp

    Filesize

    564KB

    Download

  • memory/4420-33-0x0000000004990000-0x0000000004991000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4516-66-0x00000281AA7D0000-0x00000281AA7F0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/4516-49-0x00000281AA3C0000-0x00000281AA3E0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/4516-40-0x00000281AA400000-0x00000281AA420000-memory.dmp

    Filesize

    128KB

    Download

  • memory/4584-24-0x0000000013140000-0x000000001320F000-memory.dmp

    Filesize

    828KB

    Download

  • memory/4584-27-0x0000000013140000-0x000000001320F000-memory.dmp

    Filesize

    828KB

    Download

  • memory/4584-26-0x0000000013140000-0x000000001320F000-memory.dmp

    Filesize

    828KB

    Download

  • memory/4584-25-0x0000000013140000-0x000000001320F000-memory.dmp

    Filesize

    828KB

    Download

  • memory/4584-23-0x0000000013140000-0x000000001320F000-memory.dmp

    Filesize

    828KB

    Download

  • memory/4584-21-0x0000000013140000-0x000000001320F000-memory.dmp

    Filesize

    828KB

    Download

  • memory/4584-196-0x0000000013140000-0x000000001320F000-memory.dmp

    Filesize

    828KB

    Download

  • memory/4616-8-0x0000000000930000-0x0000000000931000-memory.dmp

    Filesize

    4KB

    Download