Overview

overview

10

Static

static

10

JaffaCakes...32.exe

windows7-x64

10

JaffaCakes...32.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    0s
  • max time network
    0s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    29/03/2025, 17:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_8f98f16ccc8f9c9c7a7553c44c8a0832.exe

  • Size

    746KB

  • MD5

    8f98f16ccc8f9c9c7a7553c44c8a0832

  • SHA1

    70a32814dd58fd8ed0ad1eeb725757d2e0444c6b

  • SHA256

    d861afcb864c0f7366976c6eb1894c5dbb4be8001c1239de56aa8d3d30444451

  • SHA512

    54e9f62ede10cb1532942615fb12194bcc02743345595e93acfccc04c6177d52f490b2fadb2580df137ef23bbd3cae9cf275a06772014189723ba8dd50496b18

  • SSDEEP

    12288:C6A84PaHhfD/tV9sj5NKR0pau9XGyu2qBVGLQyTPfh:nAmBpVKHu0Mu9Xo20VGLVP5

Score
10/10
darkcometynnahdefense_evasiondiscoverypersistencerattrojan

Malware Config

Extracted

Family

darkcomet

Botnet

Ynnah

C2

Ynnah.no-ip.info:3085

Mutex

DC_MUTEX-M6EK9E8

Attributes
  • InstallPath

    Windupdt\winupdate.exe

  • gencode

    .V*$TgrzBQ3N

  • install

    true

  • offline_keylogger

    true

  • password

    8101993

  • persistence

    true

  • reg_key

    Windows_KB7

rc4.plain

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet
  • Darkcomet family
    darkcomet
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Sets file to hidden 1 TTPs 2 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

    defense_evasion
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in System32 directory 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8f98f16ccc8f9c9c7a7553c44c8a0832.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8f98f16ccc8f9c9c7a7553c44c8a0832.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Adds Run key to start application
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:2516
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8f98f16ccc8f9c9c7a7553c44c8a0832.exe" +s +h
      2⤵
        PID:1568
        • C:\Windows\SysWOW64\attrib.exe
          attrib "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8f98f16ccc8f9c9c7a7553c44c8a0832.exe" +s +h
          3⤵
          • Sets file to hidden
          • Views/modifies file attributes
          PID:1888
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
        2⤵
          PID:1660
          • C:\Windows\SysWOW64\attrib.exe
            attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
            3⤵
            • Sets file to hidden
            • Views/modifies file attributes
            PID:1664
        • C:\Windows\SysWOW64\Windupdt\winupdate.exe
          "C:\Windows\system32\Windupdt\winupdate.exe"
          2⤵
            PID:1704
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 5 > NUL&del "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8f98f16ccc8f9c9c7a7553c44c8a0832.exe"
            2⤵
            • System Network Configuration Discovery: Internet Connection Discovery
            PID:2168

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Windows\SysWOW64\Windupdt\winupdate.exe
          Filesize

          746KB

          MD5

          8f98f16ccc8f9c9c7a7553c44c8a0832

          SHA1

          70a32814dd58fd8ed0ad1eeb725757d2e0444c6b

          SHA256

          d861afcb864c0f7366976c6eb1894c5dbb4be8001c1239de56aa8d3d30444451

          SHA512

          54e9f62ede10cb1532942615fb12194bcc02743345595e93acfccc04c6177d52f490b2fadb2580df137ef23bbd3cae9cf275a06772014189723ba8dd50496b18

          Download Submit

        • memory/2516-0-0x00000000002B0000-0x00000000002B1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2516-8-0x0000000000400000-0x00000000004CC000-memory.dmp

          Filesize

          816KB

          Download