darkcomet | e87d887bc9e1a645cb827b7c73980fad1f0fc8c55e2887c0237f412f1ef2fe9e

Analysis

max time kernel
140s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 13:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe
Size

746KB
MD5

1a5b56095e969cf84e0861808f6bbe80
SHA1

075191c1c4106dbf5a33c27a13342883e7b02677
SHA256

e87d887bc9e1a645cb827b7c73980fad1f0fc8c55e2887c0237f412f1ef2fe9e
SHA512

0dbfca01433f0688671dafbfec9b2d19ba995b85f5ec6c7bca14d7116ce790af9b741e8b46b11128d613e3c9bef210921f7b03f08832020f775758fbec9e02ad
SSDEEP

12288:O6A84PaHhfD/tV9sj5NKR0pau9XGyu2qBVGLQyTPfha:zAmBpVKHu0Mu9Xo20VGLVP5a

Score

10^/10

darkcomet evasion rat trojan

Malware Config

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet

Modifies firewall policy service 3 TTPs 3 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0"	1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Windows Service
T1543.003

Processes:

1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" 1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe

Windows security bypass 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe

Disables Task Manager via registry modification
evasion
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

4952 attrib.exe
368 attrib.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe

pid	process
4952	attrib.exe
368	attrib.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe

pid process

3540 1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe

pid	process
3540	1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes:

1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	3540	1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe
Token: SeSecurityPrivilege	3540	1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	3540	1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	3540	1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	3540	1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe
Token: SeSystemtimePrivilege	3540	1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	3540	1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	3540	1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	3540	1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe
Token: SeBackupPrivilege	3540	1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe
Token: SeRestorePrivilege	3540	1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe
Token: SeShutdownPrivilege	3540	1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe
Token: SeDebugPrivilege	3540	1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	3540	1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	3540	1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	3540	1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe
Token: SeUndockPrivilege	3540	1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe
Token: SeManageVolumePrivilege	3540	1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe
Token: SeImpersonatePrivilege	3540	1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	3540	1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe
Token: 33	3540	1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe
Token: 34	3540	1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe
Token: 35	3540	1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe
Token: 36	3540	1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.execmd.execmd.exe

description	pid	process	target process
PID 3540 wrote to memory of 4608	3540	1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe	cmd.exe
PID 3540 wrote to memory of 4608	3540	1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe	cmd.exe
PID 3540 wrote to memory of 4608	3540	1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe	cmd.exe
PID 3540 wrote to memory of 5104	3540	1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe	cmd.exe
PID 3540 wrote to memory of 5104	3540	1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe	cmd.exe
PID 3540 wrote to memory of 5104	3540	1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe	cmd.exe
PID 4608 wrote to memory of 4952	4608	cmd.exe	attrib.exe
PID 4608 wrote to memory of 4952	4608	cmd.exe	attrib.exe
PID 4608 wrote to memory of 4952	4608	cmd.exe	attrib.exe
PID 5104 wrote to memory of 368	5104	cmd.exe	attrib.exe
PID 5104 wrote to memory of 368	5104	cmd.exe	attrib.exe
PID 5104 wrote to memory of 368	5104	cmd.exe	attrib.exe

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

Processes:

1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion	1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern	1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1"	1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe

Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

4952 attrib.exe
368 attrib.exe

pid	process
4952	attrib.exe
368	attrib.exe

C:\Users\Admin\AppData\Local\Temp\1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe"
1⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Checks computer location settings
- Windows security modification
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3540

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe" +s +h
2⤵
- Suspicious use of WriteProcessMemory
PID:4608

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp\1a5b56095e969cf84e0861808f6bbe80_JaffaCakes118.exe" +s +h
3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:4952

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
2⤵
- Suspicious use of WriteProcessMemory
PID:5104

C:\Windows\SysWOW64\attrib.exe
attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:368

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3540-0-0x00000000006F0000-0x00000000006F1000-memory.dmp

Filesize
4KB

Download
memory/3540-1-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/3540-3-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download