darkcomet | 2fa1ab454114dc94dd69ae6e2f2a31270bd7f00e8ea454317791374a767a3cdf

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 09:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Size

649KB
MD5

19ae0c3eba9091ca7daea2db9b5f3f09
SHA1

1e9cf220cccc2155aa0d41ae401d584ebb98863a
SHA256

2fa1ab454114dc94dd69ae6e2f2a31270bd7f00e8ea454317791374a767a3cdf
SHA512

dd471891a6e439f9babe91dcd10ce60e9d1a9b2857544224fcd94c96d02c72c5c1a1909497c6f7c060f7021405e66b0ecc1395134f604127d9c1d4692db187d5
SSDEEP

12288:bk0QVlhmPojAPTMEsUTg0oChO/Q2JbsbjPbN5qhRTtYe3f+Iw86k/9/+A:Q0QRWoJEfg0oChGdJQbjPbNW5tYeP+G9

Score

10^/10

darkcomet habbo gen evasion rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

Habbo Gen

82.41.38.18:1995

Mutex

DC_MUTEX-5WTNQ5D

Attributes

gencode
Qn34A2Y5nQa0
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies firewall policy service 3 TTPs 3 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Windows Service
T1543.003

Processes:

19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" 19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe

Windows security bypass 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe

Disables Task Manager via registry modification
evasion
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

4112 attrib.exe
872 attrib.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation 19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe

pid	process
4112	attrib.exe
872	attrib.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe

pid process

2444 19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe

pid	process
2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Token: SeSecurityPrivilege	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Token: SeSystemtimePrivilege	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Token: SeBackupPrivilege	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Token: SeRestorePrivilege	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Token: SeShutdownPrivilege	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Token: SeDebugPrivilege	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Token: SeUndockPrivilege	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Token: SeManageVolumePrivilege	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Token: SeImpersonatePrivilege	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Token: 33	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Token: 34	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Token: 35	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Token: 36	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe

pid process

2444 19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe

pid	process
2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.execmd.execmd.exe

description	pid	process	target process
PID 2444 wrote to memory of 4604	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe	cmd.exe
PID 2444 wrote to memory of 4604	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe	cmd.exe
PID 2444 wrote to memory of 4604	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe	cmd.exe
PID 2444 wrote to memory of 1984	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe	cmd.exe
PID 2444 wrote to memory of 1984	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe	cmd.exe
PID 2444 wrote to memory of 1984	2444	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe	cmd.exe
PID 4604 wrote to memory of 4112	4604	cmd.exe	attrib.exe
PID 4604 wrote to memory of 4112	4604	cmd.exe	attrib.exe
PID 4604 wrote to memory of 4112	4604	cmd.exe	attrib.exe
PID 1984 wrote to memory of 872	1984	cmd.exe	attrib.exe
PID 1984 wrote to memory of 872	1984	cmd.exe	attrib.exe
PID 1984 wrote to memory of 872	1984	cmd.exe	attrib.exe

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

Processes:

19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1"	19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe

Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

4112 attrib.exe
872 attrib.exe

pid	process
4112	attrib.exe
872	attrib.exe

C:\Users\Admin\AppData\Local\Temp\19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe"
1⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Checks computer location settings
- Windows security modification
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2444

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe" +s +h
2⤵
- Suspicious use of WriteProcessMemory
PID:4604

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp\19ae0c3eba9091ca7daea2db9b5f3f09_JaffaCakes118.exe" +s +h
3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:4112

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
2⤵
- Suspicious use of WriteProcessMemory
PID:1984

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:872

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2444-0-0x0000000002280000-0x0000000002281000-memory.dmp

Filesize
4KB

Download
memory/2444-1-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2444-3-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2444-5-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2444-7-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2444-9-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2444-13-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download