Overview

overview

10

Static

static

3

JaffaCakes...b2.exe

windows7-x64

10

JaffaCakes...b2.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    93s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/03/2025, 10:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_389a769c402b70d8df882c6ef68f25b2.exe

  • Size

    825KB

  • MD5

    389a769c402b70d8df882c6ef68f25b2

  • SHA1

    eee96b686ab923043355353cfb99b7364ae45efb

  • SHA256

    3e82726be4298544db69160ced09199c81dad606c3bb5d098bcf510041eb2c42

  • SHA512

    2ee875367bfa3425c517af12d283c2ae7920f1fda44c3821279a99185c8b5df2ad3242b760c9a5cba85eeaa13074be55951a29ffbddb64ac583272e871cd5010

  • SSDEEP

    24576:y0ytO3rUVidlntbUnz6Wb9IhsO6XCQ68:YKVrlUnzD9IhPJQ6

Score
10/10
darkcometguest16defense_evasiondiscoverypersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16

C2

killergkhn.no-ip.biz:3460

Mutex

DC_MUTEX-9GX4KY8

Attributes
  • InstallPath

    Windowsupdate\winupdate.exe

  • gencode

    17r%FyvQ/-Ze

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    winupdater

rc4.plain

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet
  • Darkcomet family
    darkcomet
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • UAC bypass 3 TTPs 1 IoCs
    defense_evasiontrojan
  • Windows security bypass 2 TTPs 1 IoCs
    defense_evasiontrojan
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Windows security modification 2 TTPs 1 IoCs
    defense_evasiontrojan
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Drops file in System32 directory 5 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies registry class 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs
  • System policy modification 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_389a769c402b70d8df882c6ef68f25b2.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_389a769c402b70d8df882c6ef68f25b2.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4612
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_389a769c402b70d8df882c6ef68f25b2.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_389a769c402b70d8df882c6ef68f25b2.exe
      2⤵
      • UAC bypass
      • Windows security bypass
      • Windows security modification
      • Checks whether UAC is enabled
      • Drops file in System32 directory
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:3820
      • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_389a769c402b70d8df882c6ef68f25b2.exe
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_389a769c402b70d8df882c6ef68f25b2.exe
        3⤵
        • Modifies WinLogon for persistence
        • Checks BIOS information in registry
        • Checks computer location settings
        • Adds Run key to start application
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Enumerates system info in registry
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:3304
        • C:\Windows\SysWOW64\Windowsupdate\winupdate.exe
          "C:\Windows\system32\Windowsupdate\winupdate.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1624
          • C:\Windows\SysWOW64\Windowsupdate\winupdate.exe
            C:\Windows\SysWOW64\Windowsupdate\winupdate.exe
            5⤵
              PID:1804
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1624 -s 292
              5⤵
              • Program crash
              PID:1688
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat" "
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1904
            • C:\Windows\SysWOW64\PING.EXE
              ping 127.0.0.1 -n 2
              5⤵
              • System Location Discovery: System Language Discovery
              • System Network Configuration Discovery: Internet Connection Discovery
              • Runs ping.exe
              PID:2024
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1624 -ip 1624
      1⤵
        PID:4284

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      Persistence

      Boot or Logon Autostart Execution

      2
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Winlogon Helper DLL

      1
      T1547.004

      Privilege Escalation

      Abuse Elevation Control Mechanism

      1
      T1548

      Bypass User Account Control

      1
      T1548.002

      Boot or Logon Autostart Execution

      2
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Winlogon Helper DLL

      1
      T1547.004

      Defense Evasion

      Abuse Elevation Control Mechanism

      1
      T1548

      Bypass User Account Control

      1
      T1548.002

      Impair Defenses

      3
      T1562

      Disable or Modify Tools

      3
      T1562.001

      Modify Registry

      6
      T1112

      Credential Access

      Discovery

      Query Registry

      4
      T1012

      Remote System Discovery

      1
      T1018

      System Information Discovery

      6
      T1082

      System Location Discovery

      1
      T1614

      System Language Discovery

      1
      T1614.001

      System Network Configuration Discovery

      1
      T1016

      Internet Connection Discovery

      1
      T1016.001

      Lateral Movement

      Collection

      Command and Control

      Exfiltration

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\_dcsc_.bat
        Filesize

        119B

        MD5

        a9e53d60f9f68a24c764ffece4ee2a0f

        SHA1

        b15886ac4c8275a01ec91a6905028c8e59aa2d6d

        SHA256

        62310e3799344a0880525dffa619e097ea10f922f30a392df1f4147c8dba6dd6

        SHA512

        397ae9bf05ef49107236c015ba70fa37047152845ffc16735eba9c64d3e263821cabe6268b74e22b225ff3637ac45921370e569067f490df9e4cccf3ac7a1a3c

        Download Submit

      • C:\Windows\SysWOW64\Windowsupdate\winupdate.exe
        Filesize

        825KB

        MD5

        389a769c402b70d8df882c6ef68f25b2

        SHA1

        eee96b686ab923043355353cfb99b7364ae45efb

        SHA256

        3e82726be4298544db69160ced09199c81dad606c3bb5d098bcf510041eb2c42

        SHA512

        2ee875367bfa3425c517af12d283c2ae7920f1fda44c3821279a99185c8b5df2ad3242b760c9a5cba85eeaa13074be55951a29ffbddb64ac583272e871cd5010

        Download Submit

      • memory/1624-67-0x0000000000400000-0x00000000004D9000-memory.dmp

        Filesize

        868KB

        Download

      • memory/1624-66-0x0000000000400000-0x00000000004D9000-memory.dmp

        Filesize

        868KB

        Download

      • memory/1624-58-0x0000000000400000-0x00000000004D9000-memory.dmp

        Filesize

        868KB

        Download

      • memory/1624-59-0x0000000000400000-0x00000000004D9000-memory.dmp

        Filesize

        868KB

        Download

      • memory/3304-19-0x0000000000400000-0x00000000004C1000-memory.dmp

        Filesize

        772KB

        Download

      • memory/3304-61-0x0000000000400000-0x00000000004C1000-memory.dmp

        Filesize

        772KB

        Download

      • memory/3304-14-0x0000000000400000-0x00000000004C1000-memory.dmp

        Filesize

        772KB

        Download

      • memory/3304-18-0x0000000000400000-0x00000000004C1000-memory.dmp

        Filesize

        772KB

        Download

      • memory/3304-13-0x0000000000400000-0x00000000004C1000-memory.dmp

        Filesize

        772KB

        Download

      • memory/3304-20-0x0000000000400000-0x00000000004C1000-memory.dmp

        Filesize

        772KB

        Download

      • memory/3304-21-0x0000000000400000-0x00000000004C1000-memory.dmp

        Filesize

        772KB

        Download

      • memory/3820-2-0x0000000000400000-0x000000000042E000-memory.dmp

        Filesize

        184KB

        Download

      • memory/3820-17-0x0000000000400000-0x000000000042E000-memory.dmp

        Filesize

        184KB

        Download

      • memory/3820-7-0x0000000000400000-0x000000000042E000-memory.dmp

        Filesize

        184KB

        Download

      • memory/3820-4-0x0000000000400000-0x000000000042E000-memory.dmp

        Filesize

        184KB

        Download

      • memory/4612-0-0x0000000000400000-0x00000000004D9000-memory.dmp

        Filesize

        868KB

        Download

      • memory/4612-9-0x0000000000400000-0x00000000004D9000-memory.dmp

        Filesize

        868KB

        Download

      • memory/4612-1-0x0000000000C30000-0x0000000000C32000-memory.dmp

        Filesize

        8KB

        Download