Analysis

  • max time kernel
    150s
  • max time network
    138s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    21-01-2025 21:50

General

  • Target

    JaffaCakes118_07c23df001df7e506492963e3da1f05d.exe

  • Size

    1.4MB

  • MD5

    07c23df001df7e506492963e3da1f05d

  • SHA1

    cfc0f3f9ae3573338eab8a6c21fc03d0e5ccf072

  • SHA256

    82521bc29ba647a7ce9b04dd2ddfd8e5a4e6aea8f1cea324d5061725e620e9a1

  • SHA512

    17e05336fc8f51713830f0012a9a008b94c2e4296ee9f31ac9d3e543fbbef1ae23097ffbe35f04c9414b2592352e3e61ebd7a3c316692d6ba1dddcd6aed6ffe2

  • SSDEEP

    24576:Ug25Nb0iuknMq8iDthEVaPqLnu+ws7GkyIpf1xlC1EKErHZH4NmXlRLuS63ZyKnT:dJjMXEVUcuMqOf17C1EPrHZXLQpGaN

Malware Config

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Darkcomet family
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 5 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • AutoIT Executable 4 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 1 IoCs
  • UPX packed file 20 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_07c23df001df7e506492963e3da1f05d.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_07c23df001df7e506492963e3da1f05d.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2380
    • C:\Users\Admin\AppData\Local\Temp\1.exe
      "C:\Users\Admin\AppData\Local\Temp\1.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: GetForegroundWindowSpam
      PID:2160
    • C:\Users\Admin\AppData\Local\Temp\2.exe
      "C:\Users\Admin\AppData\Local\Temp\2.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:936
      • C:\Users\Admin\AppData\Local\Temp\Stage2.exe
        "C:\Users\Admin\AppData\Local\Temp\Stage2.exe" x -y -oC:\Users\Admin\AppData\Local\Temp -pxnq8rPMxVI87ciGwWJHxRTy3iauHcIirteOOELv3B5vkS9kJoHBUAahY1dWxj8yA
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2196
      • C:\Users\Admin\AppData\Local\Temp\Stage1.exe
        "C:\Users\Admin\AppData\Local\Temp\Stage1.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2396
        • C:\Windows\SysWOW64\notepad.exe
          notepad
          4⤵
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          PID:1592
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\SysWOW64\explorer.exe"
          4⤵
          • Windows security bypass
          • Checks BIOS information in registry
          • System Location Discovery: System Language Discovery
          • Checks processor information in registry
          • Enumerates system info in registry
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2928
          • C:\Windows\SysWOW64\notepad.exe
            C:\Windows\SysWOW64\notepad.exe
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2652
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2808

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\BitBot FJ 2\BitBot FJ.exe

    Filesize

    561KB

    MD5

    80312477c330b77d4e9a4937e4e26f5c

    SHA1

    e0ec277f7f496f5726b1edc1a51b10c1d04ae982

    SHA256

    cf02bf81c50c2a77a44d01ed91ec85575fd79f6e23df79ea2487bd3b939ee3ba

    SHA512

    07ed5e7d8a41cfae0855db8d4a9ab4223dadbd73d98ee1cd4c4aa81b8e302e98b679d00c992b9b200a4cce5570e02aea81700336ae7f44b835a9b0310eaf2a40

  • C:\Users\Admin\AppData\Local\Temp\1.exe

    Filesize

    1.0MB

    MD5

    bc1afcaeb1b45f7ccd31e5bde24939d3

    SHA1

    cc980868659717038216c5978d8b40841e7a0ec3

    SHA256

    c66e002c3d8d9cbc35cdb6d535fe40399b7b9da1f1ea1ef5834ec76d2a948a7e

    SHA512

    57c9a2b5711f21c29163fc7e5ac282f4f10bfa7636976e4dce1f262ab9a3c437c03a050b6ccf90782f9602a852b79397d4c7dafedbaebf444d778b18d6271220

  • C:\Users\Admin\AppData\Local\Temp\2.exe

    Filesize

    401KB

    MD5

    f8c5926a9bf359b28192e55aa40ff18a

    SHA1

    8997a6da2c8b45dc64b0349c3681c0d97593c3b3

    SHA256

    b45e7fd9c942c759d38387e181123395f8a7bab0f2fd5a5d28c59b6e98f95775

    SHA512

    1bf56ea91ddb62501391b58bea6ad4113d49645493f0f54c298e662284093ba234c0c734167adc9f66b5bbcb75b670961b71fe2e9434bde23cd7e258512280e4

  • C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd

    Filesize

    174B

    MD5

    94d62832943fa8f282367ca15255a25b

    SHA1

    3ccbcde23a806b376cea982be7959f26c8c7785e

    SHA256

    1f638f58006bdb99d8c02d55f19d72a90bd35a50b6cfe55055ec9a0ea400ac2c

    SHA512

    c3d901d178051c87b74c7e75c74667f54b66290e76dc1b74cfb2b5646d6b65fa5edeea5569eb75aa1e246c56dd626b212fa9064c7fe538ca10b9100dc295df78

  • C:\Users\Admin\AppData\Local\Temp\Stage1.exe

    Filesize

    274KB

    MD5

    7ef9436de5200165b69e84ad33b0bc19

    SHA1

    513263ce9f3e59bc845b4de1fda64a74791d6bc6

    SHA256

    52c27b43586d97e005a9a361853909ca3f3783f991043225e166eead45a77d0a

    SHA512

    bf059c9f017f50c43905f8f310dba2948d07202d3366cdc908c62d94f63ff777813eec8c641241675ebe8bfefee17da9790f4203fcec7ce59a3df9c0f67b2704

  • \Users\Admin\AppData\Local\Temp\Stage2.exe

    Filesize

    354KB

    MD5

    f8f015c0b26b447e95e2e2560972d741

    SHA1

    9f7e22363a0629eeb6501f2634cf99dd56033552

    SHA256

    c35acae057c64277d9376c1138c61d255d367cbe288ec38817c6a3ede358c422

    SHA512

    e9890491a5eeac5bd3e31cd2105aa5f23b3a59ad0cf583f3c8c5538e1851d6296be049620b94133fd53c348a77d2e42a26dfadbc2abdc440e69c8ffd32e572e7

  • memory/936-285-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

  • memory/936-371-0x0000000000400000-0x0000000000424000-memory.dmp

    Filesize

    144KB

  • memory/936-293-0x0000000002530000-0x0000000002573000-memory.dmp

    Filesize

    268KB

  • memory/936-307-0x0000000013140000-0x000000001320B000-memory.dmp

    Filesize

    812KB

  • memory/936-308-0x0000000013140000-0x000000001320B000-memory.dmp

    Filesize

    812KB

  • memory/1592-312-0x0000000000080000-0x0000000000081000-memory.dmp

    Filesize

    4KB

  • memory/1592-352-0x0000000000280000-0x0000000000281000-memory.dmp

    Filesize

    4KB

  • memory/2160-138-0x0000000000400000-0x00000000004B6000-memory.dmp

    Filesize

    728KB

  • memory/2160-139-0x0000000000400000-0x00000000004B6000-memory.dmp

    Filesize

    728KB

  • memory/2160-279-0x0000000000920000-0x0000000000930000-memory.dmp

    Filesize

    64KB

  • memory/2160-280-0x0000000000400000-0x00000000004B6000-memory.dmp

    Filesize

    728KB

  • memory/2160-10-0x0000000000400000-0x00000000004B6000-memory.dmp

    Filesize

    728KB

  • memory/2196-299-0x0000000000400000-0x0000000000443000-memory.dmp

    Filesize

    268KB

  • memory/2196-303-0x0000000000400000-0x0000000000443000-memory.dmp

    Filesize

    268KB

  • memory/2380-9-0x000007FEF6370000-0x000007FEF6D0D000-memory.dmp

    Filesize

    9.6MB

  • memory/2380-0-0x000007FEF662E000-0x000007FEF662F000-memory.dmp

    Filesize

    4KB

  • memory/2380-286-0x000007FEF6370000-0x000007FEF6D0D000-memory.dmp

    Filesize

    9.6MB

  • memory/2380-47-0x000007FEF6370000-0x000007FEF6D0D000-memory.dmp

    Filesize

    9.6MB

  • memory/2380-5-0x000007FEF6370000-0x000007FEF6D0D000-memory.dmp

    Filesize

    9.6MB

  • memory/2396-359-0x0000000013140000-0x000000001320B000-memory.dmp

    Filesize

    812KB

  • memory/2396-310-0x0000000013140000-0x000000001320B000-memory.dmp

    Filesize

    812KB

  • memory/2928-357-0x0000000013140000-0x000000001320B000-memory.dmp

    Filesize

    812KB

  • memory/2928-361-0x0000000013140000-0x000000001320B000-memory.dmp

    Filesize

    812KB

  • memory/2928-372-0x0000000013140000-0x000000001320B000-memory.dmp

    Filesize

    812KB

  • memory/2928-360-0x0000000013140000-0x000000001320B000-memory.dmp

    Filesize

    812KB

  • memory/2928-356-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2928-354-0x0000000013140000-0x000000001320B000-memory.dmp

    Filesize

    812KB