Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
27-11-2024 13:24
General
-
Target
a80d9f57d44c84cd334d5ee47e8e4c99_JaffaCakes118.exe
-
Size
293KB
-
MD5
a80d9f57d44c84cd334d5ee47e8e4c99
-
SHA1
7cd82e1a5b713c0500b19660ed7f5f172f0b2e1c
-
SHA256
61ab7b39c2dbfbd774a8f248bb82e01b7bf561cc33f1b9650f24d9c87661545f
-
SHA512
213436f307ccabbca79796d44c43ef7c01e6eb177089d7f0ca98bbf60a8db9e1d0e9af42021a234d67ce97f7dac6371cd60e82236f76d4f011320d9b88ae0c03
-
SSDEEP
6144:yz+ZIja7JiVzDfdUITRilQ37imhVltGNPl4/fRq4vTBxvVjk5CKO/:yz+4KMVzDfrTRYQ3+WltCiHE4vTB3cw
Malware Config
Signatures
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
Darkcomet family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Modifies firewall policy service 3 TTPs 3 IoCs
-
Modifies security service 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 2 IoCs
-
Disables Task Manager via registry modification
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 4 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
UPX packed file 18 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 46 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
-
System policy modification 1 TTPs 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a80d9f57d44c84cd334d5ee47e8e4c99_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a80d9f57d44c84cd334d5ee47e8e4c99_JaffaCakes118.exe"1⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windupdt\winupdate.exe"C:\Windupdt\winupdate.exe"2⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Defense Evasion
Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Modify Registry
7Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD54cc2bbffd350fdc08f4ec4a6a3e1db62
SHA10a4b6f7b67fec89c20e1e1aebdd104d4835e9403
SHA25662d89b4ebc3d2a2e7d8257fa77112b19fc13e6e2921cb9da556fd4699e0c2412
SHA512e8325d671f78206ec8293bebc6c10ffe36a760889f9725d3005d8952342d066220e7e523c814ed433277c59d685b3a9ac8f51c7863265b61fa7c9a77738ca452
-
Filesize
293KB
MD5a80d9f57d44c84cd334d5ee47e8e4c99
SHA17cd82e1a5b713c0500b19660ed7f5f172f0b2e1c
SHA25661ab7b39c2dbfbd774a8f248bb82e01b7bf561cc33f1b9650f24d9c87661545f
SHA512213436f307ccabbca79796d44c43ef7c01e6eb177089d7f0ca98bbf60a8db9e1d0e9af42021a234d67ce97f7dac6371cd60e82236f76d4f011320d9b88ae0c03
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
820KB
-
Filesize
820KB
