Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22/01/2025, 12:32
General
-
Target
JaffaCakes118_0da6a5a744a20f2307bea6ac4b2ae6db.exe
-
Size
1.7MB
-
MD5
0da6a5a744a20f2307bea6ac4b2ae6db
-
SHA1
03287ae1adcc2b751d6f70f2e129b131924bd4bf
-
SHA256
ba48e7607c54f5a5c943c46bbe060a2ee24c51ac98c9f35ab8442d7fc3cf1eb1
-
SHA512
c846375071041b1dc6701de64f8ea6250b68052236f15af0946f11291e47b4be3068ece459f349723c5adc887f7edbda25c2d89adcd06d59d37e40e5f948bb1e
-
SSDEEP
49152:+hKLFggNIOFQGbFpDsGX9zCVtVZy/Tyw0Dy:+ddoo8wRUTyw0O
Malware Config
Signatures
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
Darkcomet family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Modifies security service 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 2 IoCs
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 13 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Suspicious use of SetThreadContext 4 IoCs
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 46 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0da6a5a744a20f2307bea6ac4b2ae6db.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0da6a5a744a20f2307bea6ac4b2ae6db.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0da6a5a744a20f2307bea6ac4b2ae6db.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0da6a5a744a20f2307bea6ac4b2ae6db.exe"2⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\C7C2.tmp\Start.cmd" "4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\C7C2.tmp\cscript.execscript HS_MESSAGE.vbs "Did you run the program as Administrator? " "Activation Tool" Q YESNO5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\C7C2.tmp\autorun.exeautorun.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"3⤵
-
-
C:\Windupdt\winupdate.exe"C:\Windupdt\winupdate.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Windupdt\winupdate.exe"C:\Windupdt\winupdate.exe"4⤵
- Modifies security service
- Windows security bypass
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\notepad.exeC:\Windows\SysWOW64\notepad.exe5⤵
- System Location Discovery: System Language Discovery
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
796B
MD5af0559e0301b2f75fa7ce812c5296de8
SHA1205ddd069a599d20f0e91e17bbf3250eb339cc9e
SHA25656a32a3cd84010b6517ed492ae6eadac54e5a903f4a0d21b4db32431416d82a2
SHA512b80b0a1e9f142b16fcd54b24b23b637115454bf637d1abbaf8f9076a33148331e26668dadaa16202fbdbfcdcb152db519a26cee52a01af82149fdf2af2e70db0
-
Filesize
206B
MD59332c7fdfab97128479841682258efa0
SHA169ea243244b83b477fb85343292a80eb4854e249
SHA256f8090faf33db6e6b91db4a812c383f74846f4c828e862f236bdc1f8f786d2dee
SHA512e1fc80bf73640a3d9978130852e972fe9e5e6c53c499b91c6ac1f040a4fc7d1cc8e7244b3fa050a35d5888042b01212b4d02c18ed1050a15b8ef2f5c95ecaee7
-
Filesize
261KB
MD5c952e775521a38dd8e5ddc4c424341bf
SHA1c1967b3edeb7c6e8bf913999058f03bebcdd19e9
SHA2568ce5862a5a1da8298ca2294b33d827083e8276e2bc7974186c2a1b9057b66905
SHA51211cc8ba744aa17a99eeafc62972c3d181be52f6dbdab2bb2623f5c3f4c956c1896df02ecc2ec7ac925178af91fb24949448ae38bf9f30701ca1c4887b8b41fd3
-
Filesize
149KB
MD534098403f9d8f71ce2ec749122168e89
SHA10aed0994e4b43bc3ecc2106dc1c1d3210c82b7d7
SHA25612df0b06a9b56dce3efdb85984f84b387b1a5b61c9ebbf5a3bd61a5fbb996f60
SHA512e5b27d305b2a1c411bffbbf6c6534a92ce17af807c69344ed31a2fee42639ac5fef97ef4a654c4d6b2b8d42ba808856b857e9b4d8c008a7ba98adbab6c6b9372
-
Filesize
1.7MB
MD50da6a5a744a20f2307bea6ac4b2ae6db
SHA103287ae1adcc2b751d6f70f2e129b131924bd4bf
SHA256ba48e7607c54f5a5c943c46bbe060a2ee24c51ac98c9f35ab8442d7fc3cf1eb1
SHA512c846375071041b1dc6701de64f8ea6250b68052236f15af0946f11291e47b4be3068ece459f349723c5adc887f7edbda25c2d89adcd06d59d37e40e5f948bb1e
-
Filesize
1.4MB
MD59f5db165601843001dd313c6c2840db9
SHA13289567355012833e9c47357abc9e65108906ed1
SHA25617fe65695d275a85977b697fa98ce77a07c006e7744240eb7bbf365ce0bf9074
SHA512e87908bfcd8d35399d4604d9ce03823d79a6a63510ca8a1fbfdc001c095bd79fc715b438435faa0081f0a445aaf68171ebe0ece09e1998ac46704f3a2cdf6add
-
Filesize
146KB
MD53d4839228c7ee77e28832879eeb17340
SHA1ebe4a6388c8c6831837e232b48b8f4266b7f711e
SHA2565d6ff8a11cda6d5b1e6d8a5562594379a082cee18f402a8a0a26b8cabe428954
SHA512f3c534524eaa4b51ee44a6c1d05a142c0d10d9c1c48db79b60903dd948d5712b367479b82cd85fa8ee094dcd2569c0fd85a36c10c97deab59e49e1f1f4da6c56
-
Filesize
52KB
-
Filesize
52KB
-
Filesize
4KB
-
Filesize
52KB
-
Filesize
504KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
4KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
4KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
2.6MB
-
Filesize
4KB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
4KB
-
Filesize
4KB