Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    07-12-2024 05:24

General

  • Target

    d0d8f7a2369d3a4feaaedda235c3f065_JaffaCakes118.exe

  • Size

    270KB

  • MD5

    d0d8f7a2369d3a4feaaedda235c3f065

  • SHA1

    d401c14ba10b442ed79ef6bfff232622fc43fee2

  • SHA256

    4696e768d1f62301de94f8af69ccd28f70feb361951f2c8d1654a4b4ffceee42

  • SHA512

    3f5c6193a7ce09bd8f435319ddff36a5f1fc69627dcc1a4a9ec2b38c90c0ea32fc5f39478c926a21eff18a4f483a07519a54c61770a8baf002cabd889f718a87

  • SSDEEP

    6144:p9RzTEQzbOU1KePhG0bXe/RzXY1iqG2PsRLEj:Z/9zbThhG0relIREEj

Malware Config

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Darkcomet family
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 3 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 6 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 12 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d0d8f7a2369d3a4feaaedda235c3f065_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d0d8f7a2369d3a4feaaedda235c3f065_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2340
    • C:\Users\Admin\AppData\Local\Temp\Exporer32.exe
      "C:\Users\Admin\AppData\Local\Temp\Exporer32.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1956
      • C:\Windows\SysWOW64\explorer.exe
        "C:\Windows\SysWOW64\explorer.exe"
        3⤵
        • Checks BIOS information in registry
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:3068
      • C:\Windupdt\winupdate.exe
        "C:\Windupdt\winupdate.exe"
        3⤵
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2760

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\Exporer32.exe

    Filesize

    250KB

    MD5

    b79442dafc69a6ac050d185c28131c12

    SHA1

    ab98fd623d80708e16460086ab163cf5bfa8df91

    SHA256

    c50cc9a938230e13f96e7015cdbdfbbe15aadbf1e8142d8face86042cef7ee6d

    SHA512

    8d486407c38083970d1685826f0e882b62a4bfbeb0c38865f8879ffd13d48fac6dc634ebb1ec05d7a9a8b34c9e4152d2e5cd250f8083baf3ed8e424f9d8f0b31

  • memory/1956-32-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/1956-13-0x0000000000280000-0x0000000000281000-memory.dmp

    Filesize

    4KB

  • memory/2340-10-0x0000000003160000-0x0000000003223000-memory.dmp

    Filesize

    780KB

  • memory/2340-12-0x0000000003160000-0x0000000003223000-memory.dmp

    Filesize

    780KB

  • memory/2760-46-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/2760-49-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/2760-37-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/2760-54-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/2760-53-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/2760-52-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/2760-51-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/2760-40-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/2760-41-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/2760-42-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/2760-43-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/2760-44-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/2760-45-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/2760-50-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/2760-47-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/2760-48-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/3068-30-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/3068-19-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/3068-24-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/3068-33-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/3068-38-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/3068-39-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB