Overview

overview

10

Static

static

3

8d8c928d44...18.exe

windows7-x64

10

8d8c928d44...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-11-2024 21:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8d8c928d447e8a694c79328d7e122ff9_JaffaCakes118.exe

  • Size

    301KB

  • MD5

    8d8c928d447e8a694c79328d7e122ff9

  • SHA1

    82bb323b94c72ddf249082c97b53a6ec8c13591b

  • SHA256

    355005818618c65083bbbe8a72c6d4d47ce880b3ca01cc7aae00b714d83c45e3

  • SHA512

    46e841230ed48b45858bd333022f6fae5b9e3cd3812769af70f07f2dd532c18dc71291a77bc0b9328581ef384ac2d3569cc016e3c6be3f89cd218d3197a6aefb

  • SSDEEP

    6144:rQXLW+rwbYR/czh+VfURknPQcg/tDOSnCUcEQ:r6J8YRI+VfUanP7HSnCCQ

Score
10/10
darkcometdefense_evasiondiscoverypersistencerattrojanupx

Malware Config

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet
  • Darkcomet family
    darkcomet
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

    defense_evasion
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 51 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8d8c928d447e8a694c79328d7e122ff9_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\8d8c928d447e8a694c79328d7e122ff9_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2664
    • C:\Windows\SysWOW64\cmd.exe
      "cmd"
      2⤵
      • Subvert Trust Controls: Mark-of-the-Web Bypass
      • System Location Discovery: System Language Discovery
      • NTFS ADS
      PID:4028
    • C:\Users\Admin\AppData\Local\Temp\8d8c928d447e8a694c79328d7e122ff9_JaffaCakes118.exe
      8d8c928d447e8a694c79328d7e122ff9_JaffaCakes118.exe
      2⤵
      • Checks BIOS information in registry
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3960
      • C:\Windows\SysWOW64\notepad.exe
        C:\Windows\SysWOW64\notepad.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4692
    • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4492
      • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4344
        • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe
          wmpmetwk.exe
          4⤵
          • Checks BIOS information in registry
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Checks processor information in registry
          • Enumerates system info in registry
          • Suspicious use of AdjustPrivilegeToken
          PID:2400

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\audiodgi.exe
    Filesize

    9KB

    MD5

    ee0f561c8a6410b492f0cc3a79547c1e

    SHA1

    14995bc4eb36ba5169053fb1dba755cbba2bc386

    SHA256

    9f99ed2c4a40cf80d40682cbc75553396be44fad5ad9c9c4013170d24cb279ba

    SHA512

    ab8a2cf54d63c1553c532b299ab9dbae630660115e8dd51c28e1a50544bd42904e224fcee18026fe467f87c2ef8f58ecd50f31cf3cab3e0b9050a61552d9c335

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\Credentials\wmpmetwk.exe
    Filesize

    301KB

    MD5

    8d8c928d447e8a694c79328d7e122ff9

    SHA1

    82bb323b94c72ddf249082c97b53a6ec8c13591b

    SHA256

    355005818618c65083bbbe8a72c6d4d47ce880b3ca01cc7aae00b714d83c45e3

    SHA512

    46e841230ed48b45858bd333022f6fae5b9e3cd3812769af70f07f2dd532c18dc71291a77bc0b9328581ef384ac2d3569cc016e3c6be3f89cd218d3197a6aefb

    Download Submit

  • memory/2664-0-0x0000000074F32000-0x0000000074F33000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2664-1-0x0000000074F30000-0x00000000754E1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2664-2-0x0000000074F30000-0x00000000754E1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2664-39-0x0000000074F30000-0x00000000754E1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2664-38-0x0000000074F30000-0x00000000754E1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2664-37-0x0000000074F32000-0x0000000074F33000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3960-14-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3960-18-0x0000000013140000-0x00000000131FB000-memory.dmp

    Filesize

    748KB

    Download

  • memory/3960-16-0x0000000013140000-0x00000000131FB000-memory.dmp

    Filesize

    748KB

    Download

  • memory/3960-17-0x0000000013140000-0x00000000131FB000-memory.dmp

    Filesize

    748KB

    Download

  • memory/3960-13-0x0000000013140000-0x00000000131FB000-memory.dmp

    Filesize

    748KB

    Download

  • memory/3960-12-0x0000000013140000-0x00000000131FB000-memory.dmp

    Filesize

    748KB

    Download

  • memory/3960-11-0x0000000013140000-0x00000000131FB000-memory.dmp

    Filesize

    748KB

    Download

  • memory/3960-10-0x0000000013140000-0x00000000131FB000-memory.dmp

    Filesize

    748KB

    Download

  • memory/3960-9-0x0000000013140000-0x00000000131FB000-memory.dmp

    Filesize

    748KB

    Download

  • memory/4692-15-0x0000000000C90000-0x0000000000C91000-memory.dmp

    Filesize

    4KB

    Download