Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-11-2024 06:38

General

  • Target

    99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe

  • Size

    5.0MB

  • MD5

    99d2656e3599ba235242dc9763b3940b

  • SHA1

    2ac901d260222eed2c8d7f1cdc92ae8d11b50c7b

  • SHA256

    bb14ef332f01f1db8ce7a225adc9fe5f6ee5c4a6ffd2038478065e270080abad

  • SHA512

    af8c8fd9e842ad21feb9da2c06637dc484927714a7c562f2916e1fe4f349bf2a12fd513e750440a02280ee773a8bcaf9df0f97dba5b8cbc7d81c521adee78ce3

  • SSDEEP

    98304:Bp0K5DI69NeNw/V/dMBJ5Yr0M1oDBoMqnE6oNv7rW:BDB/tN/YJOozDBiE667rW

Malware Config

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Darkcomet family
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies security service 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 2 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • NSIS installer 2 IoCs
  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 50 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1928
    • C:\Users\Admin\AppData\Local\Temp\99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\99d2656e3599ba235242dc9763b3940b_JaffaCakes118.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Checks BIOS information in registry
      • Checks computer location settings
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Enumerates system info in registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2084
      • C:\Users\Admin\AppData\Local\Temp\CCSETUP305.EXE
        "C:\Users\Admin\AppData\Local\Temp\CCSETUP305.EXE"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3048
        • C:\Windows\system32\pcaui.exe
          "C:\Windows\system32\pcaui.exe" -g {11111111-1111-1111-1111-111111111111} -x {d5ceeb93-9830-4406-a772-e167287b96c4} -a "CCleaner" -v "Piriform Ltd" -s "This app can't run because it causes security or performance issues on Windows. A new version may be available. Check with your software provider for an updated version that runs on this version of Windows." -n 2 -f 2021048 -k 0 -e "C:\Users\Admin\AppData\Local\Temp\CCSETUP305.EXE"
          4⤵
            PID:4648
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\SysWOW64\explorer.exe"
          3⤵
            PID:764
          • C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe
            "C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2304
            • C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe
              "C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe"
              4⤵
              • Modifies security service
              • Windows security bypass
              • Disables RegEdit via registry modification
              • Checks BIOS information in registry
              • Checks computer location settings
              • Executes dropped EXE
              • Windows security modification
              • System Location Discovery: System Language Discovery
              • Checks processor information in registry
              • Enumerates system info in registry
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:5060
              • C:\Windows\SysWOW64\explorer.exe
                "C:\Windows\SysWOW64\explorer.exe"
                5⤵
                  PID:4792
                • C:\Users\Admin\AppData\Local\Temp\CCSETUP305.EXE
                  "C:\Users\Admin\AppData\Local\Temp\CCSETUP305.EXE"
                  5⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:4268
                  • C:\Windows\system32\pcaui.exe
                    "C:\Windows\system32\pcaui.exe" -g {11111111-1111-1111-1111-111111111111} -x {d5ceeb93-9830-4406-a772-e167287b96c4} -a "CCleaner" -v "Piriform Ltd" -s "This app can't run because it causes security or performance issues on Windows. A new version may be available. Check with your software provider for an updated version that runs on this version of Windows." -n 2 -f 2021048 -k 0 -e "C:\Users\Admin\AppData\Local\Temp\CCSETUP305.EXE"
                    6⤵
                      PID:4852

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\CCSETUP305.EXE

            Filesize

            2.9MB

            MD5

            a0c156da60803807cf6b46ec340c9739

            SHA1

            24aeaf6ff4d2ad611f2e6f61a0e38c46602cae97

            SHA256

            fc35a0c9f5604f78e2c4673d815e493638819d534acc73b834bd4f9fd9d49d48

            SHA512

            5bec9c0cf64cde95267d44b1dba299b7299a827467132400656eaf8b2225b2710a0e986d6a1e9db00f6f94b922ae6592372519a91b03230e92de26052aa5b3ca

          • C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe

            Filesize

            5.0MB

            MD5

            99d2656e3599ba235242dc9763b3940b

            SHA1

            2ac901d260222eed2c8d7f1cdc92ae8d11b50c7b

            SHA256

            bb14ef332f01f1db8ce7a225adc9fe5f6ee5c4a6ffd2038478065e270080abad

            SHA512

            af8c8fd9e842ad21feb9da2c06637dc484927714a7c562f2916e1fe4f349bf2a12fd513e750440a02280ee773a8bcaf9df0f97dba5b8cbc7d81c521adee78ce3

          • memory/1928-36-0x00000000001C0000-0x00000000001E0000-memory.dmp

            Filesize

            128KB

          • memory/1928-26-0x00000000001C0000-0x00000000001E0000-memory.dmp

            Filesize

            128KB

          • memory/1928-12-0x0000000077540000-0x0000000077630000-memory.dmp

            Filesize

            960KB

          • memory/1928-13-0x0000000077540000-0x0000000077630000-memory.dmp

            Filesize

            960KB

          • memory/1928-14-0x0000000077540000-0x0000000077630000-memory.dmp

            Filesize

            960KB

          • memory/1928-15-0x0000000077540000-0x0000000077630000-memory.dmp

            Filesize

            960KB

          • memory/1928-16-0x0000000077540000-0x0000000077630000-memory.dmp

            Filesize

            960KB

          • memory/1928-48-0x00000000001C0000-0x00000000001E0000-memory.dmp

            Filesize

            128KB

          • memory/1928-47-0x00000000001C0000-0x00000000001E0000-memory.dmp

            Filesize

            128KB

          • memory/1928-46-0x00000000001C0000-0x00000000001E0000-memory.dmp

            Filesize

            128KB

          • memory/1928-45-0x00000000001C0000-0x00000000001E0000-memory.dmp

            Filesize

            128KB

          • memory/1928-44-0x00000000001C0000-0x00000000001E0000-memory.dmp

            Filesize

            128KB

          • memory/1928-43-0x00000000001C0000-0x00000000001E0000-memory.dmp

            Filesize

            128KB

          • memory/1928-42-0x00000000001C0000-0x00000000001E0000-memory.dmp

            Filesize

            128KB

          • memory/1928-41-0x00000000001C0000-0x00000000001E0000-memory.dmp

            Filesize

            128KB

          • memory/1928-40-0x00000000001C0000-0x00000000001E0000-memory.dmp

            Filesize

            128KB

          • memory/1928-39-0x00000000001C0000-0x00000000001E0000-memory.dmp

            Filesize

            128KB

          • memory/1928-38-0x00000000001C0000-0x00000000001E0000-memory.dmp

            Filesize

            128KB

          • memory/1928-37-0x00000000001C0000-0x00000000001E0000-memory.dmp

            Filesize

            128KB

          • memory/1928-35-0x00000000001C0000-0x00000000001E0000-memory.dmp

            Filesize

            128KB

          • memory/1928-33-0x00000000001C0000-0x00000000001E0000-memory.dmp

            Filesize

            128KB

          • memory/1928-32-0x00000000001C0000-0x00000000001E0000-memory.dmp

            Filesize

            128KB

          • memory/1928-31-0x00000000001C0000-0x00000000001E0000-memory.dmp

            Filesize

            128KB

          • memory/1928-30-0x00000000001C0000-0x00000000001E0000-memory.dmp

            Filesize

            128KB

          • memory/1928-29-0x00000000001C0000-0x00000000001E0000-memory.dmp

            Filesize

            128KB

          • memory/1928-63-0x0000000077540000-0x0000000077630000-memory.dmp

            Filesize

            960KB

          • memory/1928-28-0x0000000077540000-0x0000000077630000-memory.dmp

            Filesize

            960KB

          • memory/1928-59-0x0000000077540000-0x0000000077630000-memory.dmp

            Filesize

            960KB

          • memory/1928-25-0x00000000001C0000-0x00000000001E0000-memory.dmp

            Filesize

            128KB

          • memory/1928-24-0x00000000001C0000-0x00000000001E0000-memory.dmp

            Filesize

            128KB

          • memory/1928-23-0x00000000001C0000-0x00000000001E0000-memory.dmp

            Filesize

            128KB

          • memory/1928-22-0x00000000001C0000-0x00000000001E0000-memory.dmp

            Filesize

            128KB

          • memory/1928-20-0x00000000001C0000-0x00000000001E0000-memory.dmp

            Filesize

            128KB

          • memory/1928-19-0x00000000001C0000-0x00000000001E0000-memory.dmp

            Filesize

            128KB

          • memory/1928-18-0x00000000001C0000-0x00000000001E0000-memory.dmp

            Filesize

            128KB

          • memory/1928-17-0x0000000077540000-0x0000000077630000-memory.dmp

            Filesize

            960KB

          • memory/1928-0-0x00000000001C0000-0x00000000001E0000-memory.dmp

            Filesize

            128KB

          • memory/1928-34-0x00000000001C0000-0x00000000001E0000-memory.dmp

            Filesize

            128KB

          • memory/1928-11-0x0000000077540000-0x0000000077630000-memory.dmp

            Filesize

            960KB

          • memory/1928-21-0x00000000001C0000-0x00000000001E0000-memory.dmp

            Filesize

            128KB

          • memory/1928-27-0x00000000001C0000-0x00000000001E0000-memory.dmp

            Filesize

            128KB

          • memory/1928-67-0x0000000077540000-0x0000000077630000-memory.dmp

            Filesize

            960KB

          • memory/1928-66-0x0000000077540000-0x0000000077630000-memory.dmp

            Filesize

            960KB

          • memory/1928-62-0x0000000077540000-0x0000000077630000-memory.dmp

            Filesize

            960KB

          • memory/1928-10-0x0000000077540000-0x0000000077630000-memory.dmp

            Filesize

            960KB

          • memory/1928-9-0x0000000077560000-0x0000000077561000-memory.dmp

            Filesize

            4KB

          • memory/1928-72-0x0000000077540000-0x0000000077630000-memory.dmp

            Filesize

            960KB

          • memory/2084-71-0x0000000000400000-0x00000000007A1000-memory.dmp

            Filesize

            3.6MB

          • memory/2084-73-0x0000000077540000-0x0000000077630000-memory.dmp

            Filesize

            960KB

          • memory/2084-74-0x0000000000400000-0x00000000007A1000-memory.dmp

            Filesize

            3.6MB

          • memory/2084-75-0x0000000077540000-0x0000000077630000-memory.dmp

            Filesize

            960KB

          • memory/2084-69-0x0000000000400000-0x00000000007A1000-memory.dmp

            Filesize

            3.6MB

          • memory/2084-68-0x0000000000400000-0x00000000007A1000-memory.dmp

            Filesize

            3.6MB

          • memory/2084-159-0x0000000077540000-0x0000000077630000-memory.dmp

            Filesize

            960KB

          • memory/2084-146-0x0000000000400000-0x00000000007A1000-memory.dmp

            Filesize

            3.6MB

          • memory/2304-171-0x00000000001C0000-0x00000000001E0000-memory.dmp

            Filesize

            128KB

          • memory/2304-173-0x00000000001C0000-0x00000000001E0000-memory.dmp

            Filesize

            128KB

          • memory/2304-180-0x00000000001C0000-0x00000000001E0000-memory.dmp

            Filesize

            128KB

          • memory/2304-179-0x00000000001C0000-0x00000000001E0000-memory.dmp

            Filesize

            128KB

          • memory/2304-178-0x00000000001C0000-0x00000000001E0000-memory.dmp

            Filesize

            128KB

          • memory/2304-177-0x00000000001C0000-0x00000000001E0000-memory.dmp

            Filesize

            128KB

          • memory/2304-176-0x00000000001C0000-0x00000000001E0000-memory.dmp

            Filesize

            128KB

          • memory/2304-175-0x00000000001C0000-0x00000000001E0000-memory.dmp

            Filesize

            128KB

          • memory/2304-174-0x00000000001C0000-0x00000000001E0000-memory.dmp

            Filesize

            128KB

          • memory/2304-167-0x00000000001C0000-0x00000000001E0000-memory.dmp

            Filesize

            128KB

          • memory/2304-149-0x00000000001C0000-0x00000000001E0000-memory.dmp

            Filesize

            128KB

          • memory/2304-165-0x00000000001C0000-0x00000000001E0000-memory.dmp

            Filesize

            128KB

          • memory/2304-164-0x00000000001C0000-0x00000000001E0000-memory.dmp

            Filesize

            128KB

          • memory/2304-163-0x00000000001C0000-0x00000000001E0000-memory.dmp

            Filesize

            128KB

          • memory/2304-162-0x00000000001C0000-0x00000000001E0000-memory.dmp

            Filesize

            128KB

          • memory/2304-161-0x00000000001C0000-0x00000000001E0000-memory.dmp

            Filesize

            128KB

          • memory/2304-160-0x00000000001C0000-0x00000000001E0000-memory.dmp

            Filesize

            128KB

          • memory/2304-172-0x00000000001C0000-0x00000000001E0000-memory.dmp

            Filesize

            128KB

          • memory/2304-166-0x00000000001C0000-0x00000000001E0000-memory.dmp

            Filesize

            128KB

          • memory/2304-170-0x00000000001C0000-0x00000000001E0000-memory.dmp

            Filesize

            128KB

          • memory/2304-169-0x00000000001C0000-0x00000000001E0000-memory.dmp

            Filesize

            128KB

          • memory/2304-168-0x00000000001C0000-0x00000000001E0000-memory.dmp

            Filesize

            128KB