Analysis
-
max time kernel
141s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
03-11-2024 22:57
General
-
Target
8de865647d2cdfff8f15a2f66da4cf96_JaffaCakes118.exe
-
Size
1.5MB
-
MD5
8de865647d2cdfff8f15a2f66da4cf96
-
SHA1
379b9c86d30691d683353a039352bb763e160f49
-
SHA256
ce3b8c803e3f620ab6a4fe0448b87102e4578713b1355e0359f8e6243caeff66
-
SHA512
4f1f3d097f521d8cc3f94c6c38a6d7ad8eda53be804407a106da404961a8a14a35b1b0bf204e8f052bd72fe7397483fa94b69b80b7bac61f0965ad23b5c52af2
-
SSDEEP
24576:mgdX4AEE3uBDhynCylQgi63O9+VuNY3WSxLNO3KCxZyNfF3tvYTJ:h4AE3JX63OMha66qD6
Malware Config
Signatures
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
Darkcomet family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Modifies firewall policy service 3 TTPs 3 IoCs
-
Modifies security service 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 2 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 2 IoCs
-
Modifies registry class 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 48 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8de865647d2cdfff8f15a2f66da4cf96_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8de865647d2cdfff8f15a2f66da4cf96_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windupdt\winupdate.exe"C:\Windupdt\winupdate.exe"2⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Checks BIOS information in registry
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 436 -s 15403⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 436 -s 15403⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 436 -s 15483⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 23⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 436 -ip 4361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 436 -ip 4361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 436 -ip 4361⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Defense Evasion
Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
119B
MD5999315918b148faa52a07dde1e826234
SHA11ea2e2b660c46f0d53a514f867364db7624f1544
SHA2561d64ce8e3458942ab0cba94b7a1584e710ac0f60c8c8ebfd6297ca63afeded69
SHA51283dae6ea9a1836d37f5aec6254224be598645fe6c41e97ecc80f42cf9bc7862035db35513d9b51c141eaeb25ebd7a4b92675fa093c78daf2249341243d9b06e7
-
Filesize
1.5MB
MD58de865647d2cdfff8f15a2f66da4cf96
SHA1379b9c86d30691d683353a039352bb763e160f49
SHA256ce3b8c803e3f620ab6a4fe0448b87102e4578713b1355e0359f8e6243caeff66
SHA5124f1f3d097f521d8cc3f94c6c38a6d7ad8eda53be804407a106da404961a8a14a35b1b0bf204e8f052bd72fe7397483fa94b69b80b7bac61f0965ad23b5c52af2
-
Filesize
2.3MB
-
Filesize
284KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
4KB
-
Filesize
284KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
8KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
20KB
-
Filesize
2.3MB
-
Filesize
284KB
-
Filesize
60KB
-
Filesize
2.3MB
-
Filesize
284KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
284KB
-
Filesize
2.3MB