Malware Analysis Report

2025-04-13 22:44

Sample ID 250301-hk2raavkw5
Target JaffaCakes118_3763edd1e6ad1bf573bc2d2190649a2c
SHA256 0684e126c70d34320ccae8547ebf1b4bb1aaf230f94c92d6c56e4877ffcec136
Tags
darkcomet guest16 defense_evasion discovery persistence rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0684e126c70d34320ccae8547ebf1b4bb1aaf230f94c92d6c56e4877ffcec136

Threat Level: Known bad

The file JaffaCakes118_3763edd1e6ad1bf573bc2d2190649a2c was found to be: Known bad.

Malicious Activity Summary

darkcomet guest16 defense_evasion discovery persistence rat trojan

Darkcomet

Modifies security service

Darkcomet family

Windows security bypass

Windows security modification

Checks computer location settings

Loads dropped DLL

Checks BIOS information in registry

Executes dropped EXE

Adds Run key to start application

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of FindShellTrayWindow

Modifies registry class

Checks processor information in registry

Enumerates system info in registry

Suspicious behavior: AddClipboardFormatListener

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of SendNotifyMessage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2025-03-01 06:48

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2025-03-01 06:48

Reported

2025-03-01 06:51

Platform

win7-20241010-en

Max time kernel

144s

Max time network

129s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3763edd1e6ad1bf573bc2d2190649a2c.exe"

Signatures

Darkcomet

trojan rat darkcomet

Darkcomet family

darkcomet

Modifies security service

defense_evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A

Windows security bypass

defense_evasion trojan
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A

Windows security modification

defense_evasion trojan
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3763edd1e6ad1bf573bc2d2190649a2c.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3763edd1e6ad1bf573bc2d2190649a2c.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A
Token: 33 N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2904 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3763edd1e6ad1bf573bc2d2190649a2c.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE
PID 2904 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3763edd1e6ad1bf573bc2d2190649a2c.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE
PID 2904 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3763edd1e6ad1bf573bc2d2190649a2c.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE
PID 2904 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3763edd1e6ad1bf573bc2d2190649a2c.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE
PID 2904 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3763edd1e6ad1bf573bc2d2190649a2c.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE
PID 2904 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3763edd1e6ad1bf573bc2d2190649a2c.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE
PID 2904 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3763edd1e6ad1bf573bc2d2190649a2c.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE
PID 2792 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE C:\Program Files\VideoLAN\VLC\vlc.exe
PID 2792 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE C:\Program Files\VideoLAN\VLC\vlc.exe
PID 2792 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE C:\Program Files\VideoLAN\VLC\vlc.exe
PID 2792 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE C:\Program Files\VideoLAN\VLC\vlc.exe
PID 2792 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE C:\Program Files\VideoLAN\VLC\vlc.exe
PID 2792 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE C:\Program Files\VideoLAN\VLC\vlc.exe
PID 2792 wrote to memory of 1984 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE C:\Program Files\VideoLAN\VLC\vlc.exe
PID 2792 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE C:\Program Files\VideoLAN\VLC\vlc.exe
PID 2792 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE C:\Program Files\VideoLAN\VLC\vlc.exe
PID 2792 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE C:\Program Files\VideoLAN\VLC\vlc.exe
PID 2792 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE C:\Program Files\VideoLAN\VLC\vlc.exe
PID 2792 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE C:\Program Files\VideoLAN\VLC\vlc.exe
PID 2792 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE C:\Program Files\VideoLAN\VLC\vlc.exe
PID 2792 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE C:\Program Files\VideoLAN\VLC\vlc.exe

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3763edd1e6ad1bf573bc2d2190649a2c.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3763edd1e6ad1bf573bc2d2190649a2c.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE

C:\Program Files\VideoLAN\VLC\vlc.exe

"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\BEETHOVEN'S SYMPHONY NO. 9 (SCHERZO).WMA"

C:\Program Files\VideoLAN\VLC\vlc.exe

"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\BEETHOVEN'S SYMPHONY NO. 9 (SCHERZO).WMA"

Network

Country Destination Domain Proto
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp

Files

\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE

MD5 7e6451294f60b01af6b01716d961ff3d
SHA1 fd077d9fdee7976d9f4b3f1fc34e0d8b26113382
SHA256 385d12c46e7efe1715a7a24c2091f38c6a87f6b2abaa13371b5c0307a0c1eb46
SHA512 2995724a78d0cd69d21dbf616c589ae80171a905a36ece9da3990b3b33c1619d7d7bfa905137c8221ede7a3ac2d545879ae607786e2cc0cf1ba460f071d138b0

C:\Users\Admin\AppData\Local\Temp\BEETHOVEN'S SYMPHONY NO. 9 (SCHERZO).WMA

MD5 f2271fe569c058dc724d9b9e53811e31
SHA1 ea276fc14127875413ac387f017bd2291a987f4b
SHA256 bf0074851e2435a255b512e502b831ed2c456774971f8fc57004d597769364a6
SHA512 c324428534f64879aa17b190206e538066308486d95e9fa1b8b7238bc79067042717c232034ef8926376b72d3123be169852b05bfe58c7f69887245d91e5b53d

memory/2868-13-0x000000013F8F0000-0x000000013F9E8000-memory.dmp

memory/2868-15-0x000007FEFAD50000-0x000007FEFAD84000-memory.dmp

memory/2868-17-0x000007FEFB660000-0x000007FEFB678000-memory.dmp

memory/2868-18-0x000007FEFACD0000-0x000007FEFACE7000-memory.dmp

memory/2868-16-0x000007FEF73A0000-0x000007FEF7656000-memory.dmp

memory/2868-19-0x000007FEFACB0000-0x000007FEFACC1000-memory.dmp

memory/2792-25-0x0000000000400000-0x000000000055E000-memory.dmp

memory/1984-29-0x000007FEFB660000-0x000007FEFB678000-memory.dmp

memory/1984-31-0x000007FEFACB0000-0x000007FEFACC1000-memory.dmp

memory/1984-28-0x000007FEF73A0000-0x000007FEF7656000-memory.dmp

memory/1984-33-0x000007FEFABD0000-0x000007FEFABE1000-memory.dmp

memory/1984-34-0x000007FEFABB0000-0x000007FEFABCD000-memory.dmp

memory/1984-32-0x000007FEFABF0000-0x000007FEFAC07000-memory.dmp

memory/1984-30-0x000007FEFACD0000-0x000007FEFACE7000-memory.dmp

memory/1984-27-0x000007FEFAD50000-0x000007FEFAD84000-memory.dmp

memory/1984-26-0x000000013F8F0000-0x000000013F9E8000-memory.dmp

memory/1984-40-0x000007FEF7380000-0x000007FEF7398000-memory.dmp

memory/1984-35-0x000007FEF5EB0000-0x000007FEF60BB000-memory.dmp

memory/1984-43-0x000007FEF65E0000-0x000007FEF65F1000-memory.dmp

memory/1984-44-0x000007FEF65C0000-0x000007FEF65DB000-memory.dmp

memory/1984-47-0x000007FEF6550000-0x000007FEF6580000-memory.dmp

memory/1984-46-0x000007FEF6580000-0x000007FEF6598000-memory.dmp

memory/1984-45-0x000007FEF65A0000-0x000007FEF65B1000-memory.dmp

memory/1984-42-0x000007FEF6600000-0x000007FEF6611000-memory.dmp

memory/1984-41-0x000007FEF6620000-0x000007FEF6631000-memory.dmp

memory/1984-39-0x000007FEFAA10000-0x000007FEFAA31000-memory.dmp

memory/1984-38-0x000007FEF6640000-0x000007FEF6681000-memory.dmp

memory/1984-37-0x000007FEFAB90000-0x000007FEFABA1000-memory.dmp

memory/1984-36-0x000007FEF6690000-0x000007FEF66F7000-memory.dmp

memory/1984-49-0x000007FEF4DE0000-0x000007FEF4DF7000-memory.dmp

memory/1984-50-0x000007FEF4D60000-0x000007FEF4DDC000-memory.dmp

memory/1984-52-0x000007FEF4D10000-0x000007FEF4D34000-memory.dmp

memory/1984-51-0x000007FEF4D40000-0x000007FEF4D51000-memory.dmp

memory/1984-56-0x000007FEF2ED0000-0x000007FEF2EE2000-memory.dmp

memory/1984-55-0x000007FEF2EF0000-0x000007FEF2F01000-memory.dmp

memory/1984-54-0x000007FEFADB0000-0x000007FEFADC0000-memory.dmp

memory/1984-53-0x000007FEF4B90000-0x000007FEF4D10000-memory.dmp

memory/1984-57-0x000007FEF2D50000-0x000007FEF2ECA000-memory.dmp

memory/1984-48-0x000007FEF4E00000-0x000007FEF5EB0000-memory.dmp

memory/2792-58-0x0000000000400000-0x000000000055E000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2025-03-01 06:48

Reported

2025-03-01 06:51

Platform

win10v2004-20250217-en

Max time kernel

148s

Max time network

145s

Command Line

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3763edd1e6ad1bf573bc2d2190649a2c.exe"

Signatures

Darkcomet

trojan rat darkcomet

Darkcomet family

darkcomet

Modifies security service

defense_evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A

Windows security bypass

defense_evasion trojan
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A

Windows security modification

defense_evasion trojan
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3763edd1e6ad1bf573bc2d2190649a2c.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3763edd1e6ad1bf573bc2d2190649a2c.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2278412438-3475196406-3686434223-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A
Token: SeLoadDriverPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A
Token: SeSystemProfilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A
Token: SeSystemtimePrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A
Token: SeProfSingleProcessPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A
Token: SeCreatePagefilePrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A
Token: SeChangeNotifyPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A
Token: SeRemoteShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A
Token: SeUndockPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A
Token: SeCreateGlobalPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A
Token: 34 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A
Token: 35 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A
Token: 36 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE N/A
Token: 33 N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\AUDIODG.EXE N/A
Token: 33 N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\VideoLAN\VLC\vlc.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3763edd1e6ad1bf573bc2d2190649a2c.exe

"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3763edd1e6ad1bf573bc2d2190649a2c.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE

C:\Program Files\VideoLAN\VLC\vlc.exe

"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\BEETHOVEN'S SYMPHONY NO. 9 (SCHERZO).WMA"

C:\Program Files\VideoLAN\VLC\vlc.exe

"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\BEETHOVEN'S SYMPHONY NO. 9 (SCHERZO).WMA"

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\AUDIODG.EXE 0x248 0x44c

Network

Country Destination Domain Proto
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp
N/A 127.0.0.1:1604 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SELING~1.EXE

MD5 7e6451294f60b01af6b01716d961ff3d
SHA1 fd077d9fdee7976d9f4b3f1fc34e0d8b26113382
SHA256 385d12c46e7efe1715a7a24c2091f38c6a87f6b2abaa13371b5c0307a0c1eb46
SHA512 2995724a78d0cd69d21dbf616c589ae80171a905a36ece9da3990b3b33c1619d7d7bfa905137c8221ede7a3ac2d545879ae607786e2cc0cf1ba460f071d138b0

C:\Users\Admin\AppData\Local\Temp\BEETHOVEN'S SYMPHONY NO. 9 (SCHERZO).WMA

MD5 f2271fe569c058dc724d9b9e53811e31
SHA1 ea276fc14127875413ac387f017bd2291a987f4b
SHA256 bf0074851e2435a255b512e502b831ed2c456774971f8fc57004d597769364a6
SHA512 c324428534f64879aa17b190206e538066308486d95e9fa1b8b7238bc79067042717c232034ef8926376b72d3123be169852b05bfe58c7f69887245d91e5b53d

memory/2928-17-0x00007FF77CFA0000-0x00007FF77D098000-memory.dmp

memory/2928-18-0x00007FFCC4300000-0x00007FFCC4334000-memory.dmp

memory/2928-19-0x00007FFCB4B90000-0x00007FFCB4E46000-memory.dmp

memory/2928-22-0x00007FFCC39B0000-0x00007FFCC39C1000-memory.dmp

memory/2928-21-0x00007FFCC39D0000-0x00007FFCC39E7000-memory.dmp

memory/2928-20-0x00007FFCC3C60000-0x00007FFCC3C78000-memory.dmp

memory/764-28-0x0000000000400000-0x000000000055E000-memory.dmp

memory/232-38-0x00007FFCC0820000-0x00007FFCC0831000-memory.dmp

memory/232-37-0x00007FFCC0840000-0x00007FFCC085D000-memory.dmp

memory/232-31-0x00007FFCB4B90000-0x00007FFCB4E46000-memory.dmp

memory/232-39-0x00007FFCB3560000-0x00007FFCB376B000-memory.dmp

memory/232-40-0x00007FFCB4AF0000-0x00007FFCB4B31000-memory.dmp

memory/232-36-0x00007FFCC38B0000-0x00007FFCC38C1000-memory.dmp

memory/232-35-0x00007FFCC3990000-0x00007FFCC39A7000-memory.dmp

memory/232-34-0x00007FFCC39B0000-0x00007FFCC39C1000-memory.dmp

memory/232-33-0x00007FFCC39D0000-0x00007FFCC39E7000-memory.dmp

memory/232-32-0x00007FFCC3C60000-0x00007FFCC3C78000-memory.dmp

memory/232-30-0x00007FFCC4300000-0x00007FFCC4334000-memory.dmp

memory/232-29-0x00007FF77CFA0000-0x00007FF77D098000-memory.dmp

memory/232-42-0x00007FFCBFD40000-0x00007FFCBFD61000-memory.dmp

memory/232-41-0x00007FFCB24B0000-0x00007FFCB3560000-memory.dmp

memory/764-43-0x0000000000400000-0x000000000055E000-memory.dmp

memory/764-58-0x0000000000400000-0x000000000055E000-memory.dmp

memory/232-71-0x00007FFCB24B0000-0x00007FFCB3560000-memory.dmp

memory/764-73-0x0000000000400000-0x000000000055E000-memory.dmp