Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    07-12-2024 06:32

General

  • Target

    d116404d2acdba34a47f95053618a865_JaffaCakes118.exe

  • Size

    437KB

  • MD5

    d116404d2acdba34a47f95053618a865

  • SHA1

    934aa5036f407ccf0db3d54683953042cee7e959

  • SHA256

    3a66d58200aa6a6f29a06e64ba7283e3614cdfa496cfd3ad73e146a75af6ee06

  • SHA512

    c83155a9ceb5f327e14812bc575ab6729ebee8256aeb01e9b5ad5114391f06e10db2ff826dc0478de7f394272ec62764c7aa1fbbec2964589de8dfc144b7119c

  • SSDEEP

    12288:+O/HJ+p+6RsIuQ/pyWPc+oBUbKVzYKj86sa3R:J/p+PvPaBUbKpYObR

Malware Config

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Darkcomet family
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies firewall policy service 3 TTPs 3 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies registry class 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d116404d2acdba34a47f95053618a865_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d116404d2acdba34a47f95053618a865_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Checks BIOS information in registry
    • Loads dropped DLL
    • Adds Run key to start application
    • Writes to the Master Boot Record (MBR)
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2088
    • C:\winupdate\winupdate.exe
      "C:\winupdate\winupdate.exe"
      2⤵
      • Modifies firewall policy service
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Writes to the Master Boot Record (MBR)
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Enumerates system info in registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2516

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \winupdate\winupdate.exe

    Filesize

    437KB

    MD5

    d116404d2acdba34a47f95053618a865

    SHA1

    934aa5036f407ccf0db3d54683953042cee7e959

    SHA256

    3a66d58200aa6a6f29a06e64ba7283e3614cdfa496cfd3ad73e146a75af6ee06

    SHA512

    c83155a9ceb5f327e14812bc575ab6729ebee8256aeb01e9b5ad5114391f06e10db2ff826dc0478de7f394272ec62764c7aa1fbbec2964589de8dfc144b7119c

  • memory/2088-19-0x0000000000400000-0x0000000000521000-memory.dmp

    Filesize

    1.1MB

  • memory/2088-7-0x00000000002A0000-0x00000000002A1000-memory.dmp

    Filesize

    4KB

  • memory/2088-15-0x0000000005BE0000-0x0000000005D01000-memory.dmp

    Filesize

    1.1MB

  • memory/2088-5-0x0000000001DA0000-0x0000000001DA1000-memory.dmp

    Filesize

    4KB

  • memory/2088-4-0x0000000001D40000-0x0000000001D41000-memory.dmp

    Filesize

    4KB

  • memory/2088-3-0x0000000001DF0000-0x0000000001DF1000-memory.dmp

    Filesize

    4KB

  • memory/2088-2-0x0000000001DE0000-0x0000000001DE1000-memory.dmp

    Filesize

    4KB

  • memory/2088-1-0x0000000001D50000-0x0000000001D53000-memory.dmp

    Filesize

    12KB

  • memory/2088-8-0x0000000001DB0000-0x0000000001DB1000-memory.dmp

    Filesize

    4KB

  • memory/2088-0-0x0000000000400000-0x0000000000521000-memory.dmp

    Filesize

    1.1MB

  • memory/2088-6-0x0000000000280000-0x0000000000281000-memory.dmp

    Filesize

    4KB

  • memory/2516-42-0x0000000000400000-0x0000000000521000-memory.dmp

    Filesize

    1.1MB

  • memory/2516-20-0x0000000000400000-0x0000000000521000-memory.dmp

    Filesize

    1.1MB

  • memory/2516-25-0x0000000000B00000-0x0000000000C21000-memory.dmp

    Filesize

    1.1MB

  • memory/2516-26-0x0000000000400000-0x0000000000521000-memory.dmp

    Filesize

    1.1MB

  • memory/2516-27-0x0000000000B00000-0x0000000000C21000-memory.dmp

    Filesize

    1.1MB

  • memory/2516-28-0x0000000000B00000-0x0000000000C21000-memory.dmp

    Filesize

    1.1MB

  • memory/2516-31-0x0000000000400000-0x0000000000521000-memory.dmp

    Filesize

    1.1MB

  • memory/2516-33-0x0000000000400000-0x0000000000521000-memory.dmp

    Filesize

    1.1MB

  • memory/2516-35-0x0000000000400000-0x0000000000521000-memory.dmp

    Filesize

    1.1MB

  • memory/2516-38-0x0000000000400000-0x0000000000521000-memory.dmp

    Filesize

    1.1MB

  • memory/2516-40-0x0000000000400000-0x0000000000521000-memory.dmp

    Filesize

    1.1MB

  • memory/2516-24-0x0000000000B00000-0x0000000000C21000-memory.dmp

    Filesize

    1.1MB