Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
-
submitted
24-06-2024 10:41
General
-
Target
08087d038d8ca3cb86880939d28e208a_JaffaCakes118.exe
-
Size
658KB
-
MD5
08087d038d8ca3cb86880939d28e208a
-
SHA1
029ce32c2e15bb9fa0a3ecce5ee2b986bffb2ae0
-
SHA256
2fe3c81aef01566ad7dbab01b58837dc9fcd835247cb3d982d64caec61e026a2
-
SHA512
579bbe0285b8d6110dc4583f8fb7d8be9cc60ee67bb754e5284fde9315326aae8816194ffa179dc18dca316cd45bcb5cfd59fc484e8b15e99609062b51bebb0c
-
SSDEEP
12288:J9AFlAd0Z+89cxTGzO4AucTD8QP2lmFSrVs9LqnKjE:vAQ6Zx9cxTmOrucTIEFSpOGGE
Malware Config
Extracted
latentbot
2345676543212345.zapto.org
Signatures
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\08087d038d8ca3cb86880939d28e208a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\08087d038d8ca3cb86880939d28e208a_JaffaCakes118.exe"1⤵
- Checks BIOS information in registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB