Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    13-12-2024 08:01

General

  • Target

    eaa3e99c14f2a6c77f1991ba4132b1f1_JaffaCakes118.exe

  • Size

    374KB

  • MD5

    eaa3e99c14f2a6c77f1991ba4132b1f1

  • SHA1

    1bb5481c627e599609c1b34e97ba68355de2ba0e

  • SHA256

    0299f0c9537c0a9c3415221f2939b9d3f964090d9f02e80c1bb3916cfeb346c3

  • SHA512

    b2cf4c16d8d11c3760c0b9c09bf8cc14c475011e91dbac469fb659591182a1f584020e27eb690d215cea6ecfce17774644c819f39d4083564eda2a492dd7b8a4

  • SSDEEP

    6144:kzNxMMVANb6ES5Kg3PIuYkk94yNcO43SiIDxfB7GTndEgVpRlrsI4:2xkOHPVg4ydeRI1V8R5sI4

Malware Config

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Darkcomet family
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Sets file to hidden 1 TTPs 2 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eaa3e99c14f2a6c77f1991ba4132b1f1_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\eaa3e99c14f2a6c77f1991ba4132b1f1_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2688
    • C:\Users\Admin\AppData\Local\Temp\566.EXE
      "C:\Users\Admin\AppData\Local\Temp\566.EXE"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2800
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2620
        • C:\Windows\SysWOW64\attrib.exe
          attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
          4⤵
          • Sets file to hidden
          • System Location Discovery: System Language Discovery
          • Views/modifies file attributes
          PID:1964
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2336
        • C:\Windows\SysWOW64\attrib.exe
          attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
          4⤵
          • Sets file to hidden
          • System Location Discovery: System Language Discovery
          • Views/modifies file attributes
          PID:1876
      • C:\Users\Admin\Desktop\MSDCSC\msdcsc.exe
        "C:\Users\Admin\Desktop\MSDCSC\msdcsc.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2860
        • C:\Program Files (x86)\Internet Explorer\iexplore.exe
          "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
          4⤵
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:2988

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\566.EXE

    Filesize

    755KB

    MD5

    b64c98cc781514eccebb0b1b5c930cbb

    SHA1

    dc1099f9d3071e510ffae2b5ca7878bc42bb38e4

    SHA256

    ef785a958c1af0a5c6ad3fe62a2d676fe8b4a723b8d4bb3d1778a0c2cdac7f57

    SHA512

    2deea429a91b44131553256bc3e88a0e21b3927ee67c038c333da2cd0220143fe6bcb104d6c83f3d7eb9271e298bd74bbbe8a2a3e6c1c227e37ec15ee788110a

  • C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat

    Filesize

    58B

    MD5

    a35360e6b3f42bd626f57b4146feedc3

    SHA1

    10ccc72a4b88b2432792998680fbf5742ccc9ea5

    SHA256

    da2f1eac9ea56a664f280e06859ee2b48cdb0d0e31aa6209f7b7eb9f28eb3eea

    SHA512

    e7dcde0166a6d8df3b141145613fa40ba451534effb3976e4a4e7e95e5d792d2c20ee14b7555c5bdb8f70abc726d7f7ab802704d5305f2d1b379748bd91cc910

  • C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat

    Filesize

    50B

    MD5

    b774ae3fb1da087e1f83b4f7b2060e5a

    SHA1

    97eb9be49ac3af9c851c9e1e84e32bfd53e325a8

    SHA256

    adaf4a84b41e410b02e261cfd0fe7739d98647eab73c3badd32ac6e39f26351b

    SHA512

    f75d0f95f7306d26a12b414bfe37b97fbd37546cb3c6e403def7077329ddffb4b45d5c5f0ba0e7bb6d72851d2d691b0a85267beead42f7cbf2e8c3d45a3b4701

  • memory/2688-0-0x00000000009F0000-0x0000000000AC1000-memory.dmp

    Filesize

    836KB

  • memory/2688-10-0x00000000009F0000-0x0000000000AC1000-memory.dmp

    Filesize

    836KB

  • memory/2800-12-0x0000000000660000-0x0000000000661000-memory.dmp

    Filesize

    4KB

  • memory/2800-43-0x0000000000400000-0x00000000004CB000-memory.dmp

    Filesize

    812KB

  • memory/2860-46-0x0000000000400000-0x00000000004CB000-memory.dmp

    Filesize

    812KB

  • memory/2988-45-0x0000000000400000-0x00000000004CB000-memory.dmp

    Filesize

    812KB