darkcomet | 656e11809a26f8d79cb4224037b8ef39237055fff2a6f71e7e859c3562bc5e0e

Analysis

max time kernel
149s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03-01-2025 20:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_6f7419f95dd64522af24a32c480eef4e.exe
Size

1.1MB
MD5

6f7419f95dd64522af24a32c480eef4e
SHA1

54ce15566292b1494ce59ce769cd8f9d7184c4ce
SHA256

656e11809a26f8d79cb4224037b8ef39237055fff2a6f71e7e859c3562bc5e0e
SHA512

ce71d48e49b4c956505454df41eda68f517ff2aee196462dfb226d19ca56d5eee173ac7e89ccf9aae72a6e0739c317802d66a23d84abaa334ad6dd0c4b5929ef
SSDEEP

24576:DpqpyFE//Tct4bOs7pSBsvrOR7ywR7i0fBDkw/t:D8WSV70z71O0pn

Score

10^/10

darkcomet discovery rat trojan upx

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Darkcomet family
darkcomet

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	new2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	explorer.exe

Executes dropped EXE 2 IoCs

pid	Process
2768	Virus mdx v2.0.exe
860	new2.exe

Loads dropped DLL 2 IoCs

pid	Process
860	new2.exe
2056	explorer.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/2768-31-0x0000000000400000-0x00000000004C1000-memory.dmp	autoit_exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Anti v1.ocx	new2.exe
File created	C:\Windows\SysWOW64\Anti v1.ocx	new2.exe
File opened for modification	C:\Windows\SysWOW64\Anti v1.ocx	explorer.exe
File created	C:\Windows\SysWOW64\Anti v1.ocx	explorer.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 860 set thread context of 2056	860	new2.exe	32

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000a000000012250-11.dat	upx
behavioral1/memory/2768-17-0x0000000000400000-0x00000000004C1000-memory.dmp	upx
behavioral1/memory/2768-31-0x0000000000400000-0x00000000004C1000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\new2.exe	JaffaCakes118_6f7419f95dd64522af24a32c480eef4e.exe
File opened for modification	C:\Windows\Virus mdx v2.0.exe	JaffaCakes118_6f7419f95dd64522af24a32c480eef4e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6f7419f95dd64522af24a32c480eef4e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Virus mdx v2.0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	new2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	new2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	new2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	new2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	new2.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	new2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	explorer.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{E3B53AB7-68FF-4DF8-A66A-ABFB71BA5037}	new2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}\InprocServer32\ = "C:\\Windows\\SysWow64\\Anti v1.ocx"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E70092BC-DA5C-43E3-ABE6-1D703F78EA12}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	new2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}\InprocServer32\ThreadingModel = "Apartment"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{752059E9-5070-4A92-8AD9-7AA03D4F088D}\ = "UserControl1"	new2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}\Control\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{752059E9-5070-4A92-8AD9-7AA03D4F088D}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}\ProgID\ = "DmarAnti.UserControl1"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{752059E9-5070-4A92-8AD9-7AA03D4F088D}\ = "UserControl1"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}\VERSION\ = "1.0"	new2.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\DmarAnti.UserControl1	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{E3B53AB7-68FF-4DF8-A66A-ABFB71BA5037}\1.0	new2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E70092BC-DA5C-43E3-ABE6-1D703F78EA12}\ = "_UserControl1"	new2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E70092BC-DA5C-43E3-ABE6-1D703F78EA12}\TypeLib\Version = "1.0"	new2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}\MiscStatus	new2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E70092BC-DA5C-43E3-ABE6-1D703F78EA12}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	new2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{752059E9-5070-4A92-8AD9-7AA03D4F088D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	new2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}\ = "DmarAnti.UserControl1"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}\MiscStatus\1\ = "131473"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{E3B53AB7-68FF-4DF8-A66A-ABFB71BA5037}\1.0\HELPDIR	new2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E70092BC-DA5C-43E3-ABE6-1D703F78EA12}\ProxyStubClsid32	new2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E70092BC-DA5C-43E3-ABE6-1D703F78EA12}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{E3B53AB7-68FF-4DF8-A66A-ABFB71BA5037}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\Anti v1.ocx"	new2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{752059E9-5070-4A92-8AD9-7AA03D4F088D}\ = "__UserControl1"	new2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}\ProgID	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E70092BC-DA5C-43E3-ABE6-1D703F78EA12}\TypeLib\ = "{E3B53AB7-68FF-4DF8-A66A-ABFB71BA5037}"	new2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E70092BC-DA5C-43E3-ABE6-1D703F78EA12}\ProxyStubClsid	new2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E70092BC-DA5C-43E3-ABE6-1D703F78EA12}\ProxyStubClsid32	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{752059E9-5070-4A92-8AD9-7AA03D4F088D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	new2.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\DmarAnti.UserControl1\Clsid	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{752059E9-5070-4A92-8AD9-7AA03D4F088D}\ProxyStubClsid32	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{E3B53AB7-68FF-4DF8-A66A-ABFB71BA5037}\1.0\HELPDIR\ = "C:\\Windows\\system32"	new2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{752059E9-5070-4A92-8AD9-7AA03D4F088D}\TypeLib	new2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}\ToolboxBitmap32	new2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E70092BC-DA5C-43E3-ABE6-1D703F78EA12}\ = "UserControl1"	new2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E70092BC-DA5C-43E3-ABE6-1D703F78EA12}\ = "UserControl1"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{752059E9-5070-4A92-8AD9-7AA03D4F088D}\TypeLib\Version = "1.0"	new2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DmarAnti.UserControl1\Clsid\ = "{CF070144-EB7B-4D63-BBFC-DABB33AE234C}"	new2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{E3B53AB7-68FF-4DF8-A66A-ABFB71BA5037}\1.0\FLAGS\ = "2"	new2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}\ToolboxBitmap32	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}\VERSION\ = "1.0"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}\MiscStatus\ = "0"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E70092BC-DA5C-43E3-ABE6-1D703F78EA12}	new2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DmarAnti.UserControl1	new2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{752059E9-5070-4A92-8AD9-7AA03D4F088D}	new2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{752059E9-5070-4A92-8AD9-7AA03D4F088D}\TypeLib	new2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DmarAnti.UserControl1\ = "DmarAnti.UserControl1"	new2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}\TypeLib	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{752059E9-5070-4A92-8AD9-7AA03D4F088D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{E3B53AB7-68FF-4DF8-A66A-ABFB71BA5037}\1.0\0\win32	new2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}\TypeLib	new2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}\VERSION	new2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}\VERSION	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TYPELIB\{E3B53AB7-68FF-4DF8-A66A-ABFB71BA5037}\1.0\0	new2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}\Control\	new2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}\Control	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}\InprocServer32	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{752059E9-5070-4A92-8AD9-7AA03D4F088D}	new2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}\ = "DmarAnti.UserControl1"	new2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}\Control	new2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{752059E9-5070-4A92-8AD9-7AA03D4F088D}\TypeLib\Version = "1.0"	new2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}\InprocServer32	new2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CF070144-EB7B-4D63-BBFC-DABB33AE234C}\ToolboxBitmap32\ = "C:\\Windows\\SysWow64\\Anti v1.ocx, 30000"	new2.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2768	Virus mdx v2.0.exe
2768	Virus mdx v2.0.exe
2768	Virus mdx v2.0.exe
2768	Virus mdx v2.0.exe
2768	Virus mdx v2.0.exe
2768	Virus mdx v2.0.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	860	new2.exe
Token: SeSecurityPrivilege	860	new2.exe
Token: SeTakeOwnershipPrivilege	860	new2.exe
Token: SeLoadDriverPrivilege	860	new2.exe
Token: SeSystemProfilePrivilege	860	new2.exe
Token: SeSystemtimePrivilege	860	new2.exe
Token: SeProfSingleProcessPrivilege	860	new2.exe
Token: SeIncBasePriorityPrivilege	860	new2.exe
Token: SeCreatePagefilePrivilege	860	new2.exe
Token: SeBackupPrivilege	860	new2.exe
Token: SeRestorePrivilege	860	new2.exe
Token: SeShutdownPrivilege	860	new2.exe
Token: SeDebugPrivilege	860	new2.exe
Token: SeSystemEnvironmentPrivilege	860	new2.exe
Token: SeChangeNotifyPrivilege	860	new2.exe
Token: SeRemoteShutdownPrivilege	860	new2.exe
Token: SeUndockPrivilege	860	new2.exe
Token: SeManageVolumePrivilege	860	new2.exe
Token: SeImpersonatePrivilege	860	new2.exe
Token: SeCreateGlobalPrivilege	860	new2.exe
Token: 33	860	new2.exe
Token: 34	860	new2.exe
Token: 35	860	new2.exe
Token: SeIncreaseQuotaPrivilege	2056	explorer.exe
Token: SeSecurityPrivilege	2056	explorer.exe
Token: SeTakeOwnershipPrivilege	2056	explorer.exe
Token: SeLoadDriverPrivilege	2056	explorer.exe
Token: SeSystemProfilePrivilege	2056	explorer.exe
Token: SeSystemtimePrivilege	2056	explorer.exe
Token: SeProfSingleProcessPrivilege	2056	explorer.exe
Token: SeIncBasePriorityPrivilege	2056	explorer.exe
Token: SeCreatePagefilePrivilege	2056	explorer.exe
Token: SeBackupPrivilege	2056	explorer.exe
Token: SeRestorePrivilege	2056	explorer.exe
Token: SeShutdownPrivilege	2056	explorer.exe
Token: SeDebugPrivilege	2056	explorer.exe
Token: SeSystemEnvironmentPrivilege	2056	explorer.exe
Token: SeChangeNotifyPrivilege	2056	explorer.exe
Token: SeRemoteShutdownPrivilege	2056	explorer.exe
Token: SeUndockPrivilege	2056	explorer.exe
Token: SeManageVolumePrivilege	2056	explorer.exe
Token: SeImpersonatePrivilege	2056	explorer.exe
Token: SeCreateGlobalPrivilege	2056	explorer.exe
Token: 33	2056	explorer.exe
Token: 34	2056	explorer.exe
Token: 35	2056	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2776	JaffaCakes118_6f7419f95dd64522af24a32c480eef4e.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 2768	2776	JaffaCakes118_6f7419f95dd64522af24a32c480eef4e.exe	30
PID 2776 wrote to memory of 2768	2776	JaffaCakes118_6f7419f95dd64522af24a32c480eef4e.exe	30
PID 2776 wrote to memory of 2768	2776	JaffaCakes118_6f7419f95dd64522af24a32c480eef4e.exe	30
PID 2776 wrote to memory of 2768	2776	JaffaCakes118_6f7419f95dd64522af24a32c480eef4e.exe	30
PID 2776 wrote to memory of 860	2776	JaffaCakes118_6f7419f95dd64522af24a32c480eef4e.exe	31
PID 2776 wrote to memory of 860	2776	JaffaCakes118_6f7419f95dd64522af24a32c480eef4e.exe	31
PID 2776 wrote to memory of 860	2776	JaffaCakes118_6f7419f95dd64522af24a32c480eef4e.exe	31
PID 2776 wrote to memory of 860	2776	JaffaCakes118_6f7419f95dd64522af24a32c480eef4e.exe	31
PID 860 wrote to memory of 2056	860	new2.exe	32
PID 860 wrote to memory of 2056	860	new2.exe	32
PID 860 wrote to memory of 2056	860	new2.exe	32
PID 860 wrote to memory of 2056	860	new2.exe	32
PID 860 wrote to memory of 2056	860	new2.exe	32
PID 860 wrote to memory of 2056	860	new2.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6f7419f95dd64522af24a32c480eef4e.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6f7419f95dd64522af24a32c480eef4e.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Windows\Virus mdx v2.0.exe
  "C:\Windows\Virus mdx v2.0.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2768
- C:\Windows\new2.exe
  "C:\Windows\new2.exe"
  2⤵
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:860
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\SysWOW64\explorer.exe"
    3⤵
    - Checks BIOS information in registry
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:2056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Virus mdx v2.0.exe

Filesize
295KB

MD5
7461681832167d8e2d09bbf28f7b4755

SHA1
2fe11d4eafa5f225ce7193e6f38f6134ecb1d2e9

SHA256
5e59a012e8fe6f490bab5f349b676bb7b481abfc89509dd23ca7a24ad854fb7d

SHA512
1400c77e7d784ceac0ce9da68a582463cf7ec06d55b084d573e049a048ecc55ca4ff65467b54b965fe026304c7e62833522fa57cadc49996dae23ff3eaac1ba6

Download Submit
C:\Windows\new2.exe

Filesize
575KB

MD5
72bc8d73c76ba1734fbee9320491d8ad

SHA1
b8fd436cbc1d5dce99a3793ebcb005445487c1a8

SHA256
8297f48a55c63f3106938fafde85fd704dde30144b4e8140f2ab22134e164842

SHA512
0dd1ef327aba4ead7e640c6c005e137370f51b33966b3dbe7b3c8ffd6683d3f94c3bf98d9430602260338af34dbddff800cbd85b266839503bb0ec01ce88dc0b

Download Submit
\Windows\SysWOW64\Anti v1.ocx

Filesize
32KB

MD5
e4aa837c58969cfcbe0b830a2f5f51b9

SHA1
8170f323075c3171bae60e078be4a854242372db

SHA256
bce81f610a13e8a49a7de03981a42be9778094ceda06d39317163de3c4113a7e

SHA512
accc7011665a5344277c2ac230e83e7802be1a28bbe5429d3c73455e1265728bdb3dc768f111d97d43a28d7f112224f4f53ecc910885024ef761d0a64d042b55

Download Submit
memory/860-43-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/860-39-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/860-49-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/860-25-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/860-55-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/860-29-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/860-41-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/860-38-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/860-40-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/860-37-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/860-36-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/860-35-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/860-34-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/860-33-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/860-32-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/860-28-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2056-78-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2056-48-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2056-92-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2056-74-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2056-77-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2056-63-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2056-88-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2056-85-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2056-83-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2056-81-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2056-80-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2056-79-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2056-76-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2056-75-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2056-73-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2056-72-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2056-70-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2056-69-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2056-68-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2056-91-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2056-90-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2056-89-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2056-67-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2056-66-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2056-61-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2056-58-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2056-57-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2056-56-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2056-51-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2056-50-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2056-82-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2056-84-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2056-46-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2056-86-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2768-31-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/2768-17-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/2776-1-0x0000000000407000-0x0000000000409000-memory.dmp

Filesize
8KB

Download
memory/2776-0-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2776-2-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2776-12-0x0000000003EC0000-0x0000000003F81000-memory.dmp

Filesize
772KB

Download
memory/2776-22-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2776-18-0x0000000003EC0000-0x0000000003FDD000-memory.dmp

Filesize
1.1MB

Download