Analysis
-
max time kernel
149s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
22-05-2024 20:35
General
-
Target
6889b1b6df32261a5c1e628a6ec2fe02_JaffaCakes118.exe
-
Size
689KB
-
MD5
6889b1b6df32261a5c1e628a6ec2fe02
-
SHA1
bb3fbafd179b527e56ced7df45b39584cfabc621
-
SHA256
9b4382d2ea8d9c5a5bbf6c3c05c9de59e1212f57a67bd40ca9668ab254ee81a8
-
SHA512
c46f658ce9d821ea879db9e59810383a46bf18c155e3ed20e4bcf40110eb0d6ce55cb2b1b12b399f7a24a59c495baf942e4e6546ea320c1bdd174731dba79552
-
SSDEEP
12288:S9HMeUmcufrvA3kb445UEJ2jsWiD4EvFuu4cNgZhCiZKD/XdyF8v:+iBIGkbxqEcjsWiDxguehC2S5
Score
10/10
Malware Config
Extracted
Family
darkcomet
Botnet
Guest16
C2
127.0.0.1:1604
Mutex
DC_MUTEX-X77M02X
Attributes
-
gencode
nN8vSHrhrc2i
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6889b1b6df32261a5c1e628a6ec2fe02_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6889b1b6df32261a5c1e628a6ec2fe02_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
4KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
740KB