darkcomet | b35e0f5a1b842a947ffd577ee4521e22612785bacf6dad81c803e7019156797e

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
18-12-2024 12:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Size

631KB
MD5

fb7f296bec3cdc8ec079f808a7011fe4
SHA1

30aa9f4978ddf727e86e5c4b381cc61f568f34b9
SHA256

b35e0f5a1b842a947ffd577ee4521e22612785bacf6dad81c803e7019156797e
SHA512

cc08dd452f57957cbf00cf1f2975fdb39edd7edf84e080876ad192170a53ca4d1d6d7f7bc05e19c7629bb689830dda889ba84140e216f2586b8890043b505b59
SSDEEP

12288:UK/xyYT2o0k3vSycsL4YAfY9vNiQNe+91BgHT9/o30i8fKtbc:+puv8QLeEfeh/o3n8Stb

Score

10^/10

darkcomet defense_evasion discovery persistence rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	rundll.exe

Executes dropped EXE 3 IoCs

pid	Process
2888	wmpnetvk.exe
2780	rundll.exe
2736	rundll.exe

Loads dropped DLL 6 IoCs

pid	Process
2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
2888	wmpnetvk.exe
2888	wmpnetvk.exe
2780	rundll.exe
2780	rundll.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft® Windows® Operating System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft\\Protect\\Credentials\\rundll.exe"	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\wmpnetvk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft\\Protect\\Credentials\\\\wmpnetvk.exe"	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2600 set thread context of 2480	2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	31
PID 2780 set thread context of 2736	2780	rundll.exe	44

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Microsoft\Protect\Credentials\rundll.exe:ZONE.identifier	cmd.exe
File created	C:\Users\Admin\AppData\Local\Temp\Microsoft\Protect\Credentials\wmpnetvk.exe:ZONE.identifier	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmpnetvk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	rundll.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rundll.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rundll.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	rundll.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	rundll.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Microsoft\Protect\Credentials\rundll.exe:ZONE.identifier	cmd.exe
File created	C:\Users\Admin\AppData\Local\Temp\Microsoft\Protect\Credentials\wmpnetvk.exe:ZONE.identifier	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
2888	wmpnetvk.exe
2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
2888	wmpnetvk.exe
2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
2780	rundll.exe
2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
2888	wmpnetvk.exe
2888	wmpnetvk.exe
2780	rundll.exe
2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
2888	wmpnetvk.exe
2888	wmpnetvk.exe
2780	rundll.exe
2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
2888	wmpnetvk.exe
2780	rundll.exe
2888	wmpnetvk.exe
2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
2888	wmpnetvk.exe
2780	rundll.exe
2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
2888	wmpnetvk.exe
2780	rundll.exe
2888	wmpnetvk.exe
2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
2888	wmpnetvk.exe
2780	rundll.exe
2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
2888	wmpnetvk.exe
2780	rundll.exe
2888	wmpnetvk.exe
2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
2888	wmpnetvk.exe
2780	rundll.exe
2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
2888	wmpnetvk.exe
2780	rundll.exe
2888	wmpnetvk.exe
2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
2888	wmpnetvk.exe
2780	rundll.exe
2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
2888	wmpnetvk.exe
2888	wmpnetvk.exe
2780	rundll.exe
2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
2888	wmpnetvk.exe
2780	rundll.exe
2888	wmpnetvk.exe
2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
2888	wmpnetvk.exe
2780	rundll.exe
2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
2888	wmpnetvk.exe
2780	rundll.exe
2888	wmpnetvk.exe
2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
2888	wmpnetvk.exe
2780	rundll.exe
2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
2888	wmpnetvk.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeDebugPrivilege	2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	2480	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Token: SeSecurityPrivilege	2480	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2480	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	2480	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	2480	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Token: SeSystemtimePrivilege	2480	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	2480	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2480	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	2480	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Token: SeBackupPrivilege	2480	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Token: SeRestorePrivilege	2480	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Token: SeShutdownPrivilege	2480	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Token: SeDebugPrivilege	2480	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	2480	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	2480	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	2480	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Token: SeUndockPrivilege	2480	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Token: SeManageVolumePrivilege	2480	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Token: SeImpersonatePrivilege	2480	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	2480	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Token: 33	2480	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Token: 34	2480	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Token: 35	2480	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
Token: SeDebugPrivilege	2888	wmpnetvk.exe
Token: SeDebugPrivilege	2780	rundll.exe
Token: SeIncreaseQuotaPrivilege	2736	rundll.exe
Token: SeSecurityPrivilege	2736	rundll.exe
Token: SeTakeOwnershipPrivilege	2736	rundll.exe
Token: SeLoadDriverPrivilege	2736	rundll.exe
Token: SeSystemProfilePrivilege	2736	rundll.exe
Token: SeSystemtimePrivilege	2736	rundll.exe
Token: SeProfSingleProcessPrivilege	2736	rundll.exe
Token: SeIncBasePriorityPrivilege	2736	rundll.exe
Token: SeCreatePagefilePrivilege	2736	rundll.exe
Token: SeBackupPrivilege	2736	rundll.exe
Token: SeRestorePrivilege	2736	rundll.exe
Token: SeShutdownPrivilege	2736	rundll.exe
Token: SeDebugPrivilege	2736	rundll.exe
Token: SeSystemEnvironmentPrivilege	2736	rundll.exe
Token: SeChangeNotifyPrivilege	2736	rundll.exe
Token: SeRemoteShutdownPrivilege	2736	rundll.exe
Token: SeUndockPrivilege	2736	rundll.exe
Token: SeManageVolumePrivilege	2736	rundll.exe
Token: SeImpersonatePrivilege	2736	rundll.exe
Token: SeCreateGlobalPrivilege	2736	rundll.exe
Token: 33	2736	rundll.exe
Token: 34	2736	rundll.exe
Token: 35	2736	rundll.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2480	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 2456	2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	30
PID 2600 wrote to memory of 2456	2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	30
PID 2600 wrote to memory of 2456	2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	30
PID 2600 wrote to memory of 2456	2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	30
PID 2600 wrote to memory of 2480	2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	31
PID 2600 wrote to memory of 2480	2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	31
PID 2600 wrote to memory of 2480	2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	31
PID 2600 wrote to memory of 2480	2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	31
PID 2600 wrote to memory of 2480	2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	31
PID 2600 wrote to memory of 2480	2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	31
PID 2600 wrote to memory of 2480	2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	31
PID 2600 wrote to memory of 2480	2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	31
PID 2600 wrote to memory of 2480	2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	31
PID 2600 wrote to memory of 2480	2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	31
PID 2600 wrote to memory of 2480	2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	31
PID 2600 wrote to memory of 2480	2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	31
PID 2600 wrote to memory of 2480	2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	31
PID 2600 wrote to memory of 2764	2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	32
PID 2600 wrote to memory of 2764	2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	32
PID 2600 wrote to memory of 2764	2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	32
PID 2600 wrote to memory of 2764	2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	32
PID 2764 wrote to memory of 2360	2764	vbc.exe	34
PID 2764 wrote to memory of 2360	2764	vbc.exe	34
PID 2764 wrote to memory of 2360	2764	vbc.exe	34
PID 2764 wrote to memory of 2360	2764	vbc.exe	34
PID 2600 wrote to memory of 2916	2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	35
PID 2600 wrote to memory of 2916	2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	35
PID 2600 wrote to memory of 2916	2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	35
PID 2600 wrote to memory of 2916	2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	35
PID 2600 wrote to memory of 3016	2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	37
PID 2600 wrote to memory of 3016	2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	37
PID 2600 wrote to memory of 3016	2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	37
PID 2600 wrote to memory of 3016	2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	37
PID 2600 wrote to memory of 2264	2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	39
PID 2600 wrote to memory of 2264	2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	39
PID 2600 wrote to memory of 2264	2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	39
PID 2600 wrote to memory of 2264	2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	39
PID 2600 wrote to memory of 2888	2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	41
PID 2600 wrote to memory of 2888	2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	41
PID 2600 wrote to memory of 2888	2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	41
PID 2600 wrote to memory of 2888	2600	fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe	41
PID 2888 wrote to memory of 2780	2888	wmpnetvk.exe	42
PID 2888 wrote to memory of 2780	2888	wmpnetvk.exe	42
PID 2888 wrote to memory of 2780	2888	wmpnetvk.exe	42
PID 2888 wrote to memory of 2780	2888	wmpnetvk.exe	42
PID 2780 wrote to memory of 2728	2780	rundll.exe	43
PID 2780 wrote to memory of 2728	2780	rundll.exe	43
PID 2780 wrote to memory of 2728	2780	rundll.exe	43
PID 2780 wrote to memory of 2728	2780	rundll.exe	43
PID 2780 wrote to memory of 2736	2780	rundll.exe	44
PID 2780 wrote to memory of 2736	2780	rundll.exe	44
PID 2780 wrote to memory of 2736	2780	rundll.exe	44
PID 2780 wrote to memory of 2736	2780	rundll.exe	44
PID 2780 wrote to memory of 2736	2780	rundll.exe	44
PID 2780 wrote to memory of 2736	2780	rundll.exe	44
PID 2780 wrote to memory of 2736	2780	rundll.exe	44
PID 2780 wrote to memory of 2736	2780	rundll.exe	44
PID 2780 wrote to memory of 2736	2780	rundll.exe	44
PID 2780 wrote to memory of 2736	2780	rundll.exe	44
PID 2780 wrote to memory of 2736	2780	rundll.exe	44
PID 2780 wrote to memory of 2736	2780	rundll.exe	44
PID 2780 wrote to memory of 2736	2780	rundll.exe	44

C:\Users\Admin\AppData\Local\Temp\fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Users\Admin\AppData\Local\Temp\fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
  fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
  2⤵
  PID:2456
- C:\Users\Admin\AppData\Local\Temp\fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
  fb7f296bec3cdc8ec079f808a7011fe4_JaffaCakes118.exe
  2⤵
  - Checks BIOS information in registry
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2480
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zlpefrew.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB710.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB70F.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2360
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2916
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  PID:3016
- C:\Windows\SysWOW64\cmd.exe
  "cmd"
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  PID:2264
- C:\Users\Admin\AppData\Local\Temp\Microsoft\Protect\Credentials\wmpnetvk.exe
  "C:\Users\Admin\AppData\Local\Temp\Microsoft\Protect\Credentials\wmpnetvk.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2888
- - C:\Users\Admin\AppData\Local\Temp\Microsoft\Protect\Credentials\rundll.exe
    "C:\Users\Admin\AppData\Local\Temp\Microsoft\Protect\Credentials\rundll.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2780
  - - C:\Users\Admin\AppData\Local\Temp\Microsoft\Protect\Credentials\rundll.exe
      rundll.exe
      4⤵
      PID:2728
  - - C:\Users\Admin\AppData\Local\Temp\Microsoft\Protect\Credentials\rundll.exe
      rundll.exe
      4⤵
      Checks BIOS information in registry
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious use of AdjustPrivilegeToken
      PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Microsoft\Protect\Credentials\wmpnetvk.exe

Filesize
7KB

MD5
18e4d1c9d5882e72bede73b632e29fe9

SHA1
f5dc4ddec336218dd424ec414415db4f160f4792

SHA256
38434dd87dbb3db3df1ea9e7801bd726a8a178e0b2ac5141ba52cdbcaf1f1f36

SHA512
43b705917a4ca03381776130e770bb4913a366ac79384d5d3f9c4bf60005938f91634723ff8b3d907797184cbf1dd8920cf36ddf391ee3154f1015694a8b8e1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft\Protect\Credentials\wmpnetvk.exe:ZONE.identifier

Filesize
27B

MD5
130a75a932a2fe57bfea6a65b88da8f6

SHA1
b66d7530d150d45c0a390bb3c2cd4ca4fc404d1c

SHA256
f2b79cae559d6772afc1c2ed9468988178f8b6833d5028a15dea73ce47d0196e

SHA512
6cd147c6f3af95803b7b0898e97ec2ed374c1f56a487b50e3d22003a67cec26a6fa12a3920b1b5624bde156f9601469ae3c7b7354fa8cf37be76c84121767eed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft\Protect\Credentials\xCocaine.txt

Filesize
631KB

MD5
fb7f296bec3cdc8ec079f808a7011fe4

SHA1
30aa9f4978ddf727e86e5c4b381cc61f568f34b9

SHA256
b35e0f5a1b842a947ffd577ee4521e22612785bacf6dad81c803e7019156797e

SHA512
cc08dd452f57957cbf00cf1f2975fdb39edd7edf84e080876ad192170a53ca4d1d6d7f7bc05e19c7629bb689830dda889ba84140e216f2586b8890043b505b59

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESB710.tmp

Filesize
1KB

MD5
59da22cec5e72334437752744875ca83

SHA1
36da0518fabb3599b9f6e89ba2225eccea5a6caf

SHA256
248e9df634f3089b00c1383d71caae296e075319c2ffd1884381db33b8d56c05

SHA512
3686dc24865a5d6f6606bf8b71156e69324e1aae007d09bcba44478fcd6f4678ca0b1eb75661ad0bb8824a7f78dc6431a2f936dfe8a0b3606034d2e8ed2c135b

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbcB70F.tmp

Filesize
652B

MD5
4b2d458e7dd9a506cc9fc9e6db3c1051

SHA1
b149eabc7625d5aa1fa71a542901618558e4ea5e

SHA256
82bb2e03bfb28c5918a6f62e107aeca29ba6a1f7347eb2c114aac34dd0dc4ca7

SHA512
3c6cd9fcdbc895ab579925a0fa5bac64d742d496bc07fcb3eae4d4375a5b2b9ae8ce5c24ea8d74a8fc02a05c959df77f58cd41f4a34bdf7d09e501394cc0baac

Download Submit
C:\Users\Admin\AppData\Local\Temp\zlpefrew.0.vb

Filesize
1KB

MD5
29622516e4c9be1feb693b51ddfaa6d0

SHA1
7fd2f564a95f14101b4047d2728beedde60abb6f

SHA256
92db35abc01755d4e309ae6d956fe58d93fb3614cc9b10036ff4e473e872de15

SHA512
cf487e2d84996a48931244f5616cd24a8544baeb543b1775ebd2824acc8e40458608d20bbc6bcd58afed4150bea183b08e23ea5e631ee66914a8ef5bb5cad29d

Download Submit
C:\Users\Admin\AppData\Local\Temp\zlpefrew.cmdline

Filesize
314B

MD5
a97a6f8aad75db00d3a441672fc01b11

SHA1
6d2a38d2ab252d3d3cc0f72ebad59ae298c7ecbe

SHA256
6d62a7122b2a2a34b4f16d0db487dfc0c52fd8e2be86e47538348277b703aca3

SHA512
3002dd7b45d94a750fd855169fcdf79e3e0f84b6131f54f796effcd570c1e907c3fc3d0025414f51aaa527b933eb6e28e956bf6a1c12cbf513c0d7a3e91379f4

Download Submit
memory/2480-9-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/2480-20-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/2480-7-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/2480-6-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/2480-5-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/2480-4-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/2480-3-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/2480-15-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/2480-17-0x0000000000210000-0x0000000000211000-memory.dmp

Filesize
4KB

Download
memory/2480-22-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/2480-21-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/2480-8-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/2480-13-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/2480-14-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/2480-10-0x0000000013140000-0x00000000131F6000-memory.dmp

Filesize
728KB

Download
memory/2480-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2600-0-0x0000000074C71000-0x0000000074C72000-memory.dmp

Filesize
4KB

Download
memory/2600-2-0x0000000074C70000-0x000000007521B000-memory.dmp

Filesize
5.7MB

Download
memory/2600-1-0x0000000074C70000-0x000000007521B000-memory.dmp

Filesize
5.7MB

Download
memory/2600-62-0x0000000074C70000-0x000000007521B000-memory.dmp

Filesize
5.7MB

Download
memory/2736-57-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2764-25-0x00000000002E0000-0x0000000000320000-memory.dmp

Filesize
256KB

Download