Analysis

  • max time kernel
    149s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    22/07/2024, 15:57

General

  • Target

    63d38c77ff09d2b24b543d1aa3903e75_JaffaCakes118.exe

  • Size

    912KB

  • MD5

    63d38c77ff09d2b24b543d1aa3903e75

  • SHA1

    840b5f2a16edc348db679eca4980bd0d4864b09a

  • SHA256

    e6c7a2746e277a37dcbdb627dd38c51e02bb0e4ae401ba2cc5b76380bdacadf5

  • SHA512

    572819e10afb4bf39d2394d9018682627d919f1e3fb777dce231f590dbbaedacd1f7fbf959962f7bf7200c448434b882329f5ab1c5a02ac57d339d7824f5d9d2

  • SSDEEP

    12288:A8UaT9XY2siA0bMG09xD7I3Gg8ecgVvfBoCDBOQQYbVXpuy1f/g8e6+0mP:5UKoN0bUxgGa/pfBHDb+y1Hg8e6W

Score
10/10

Malware Config

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\63d38c77ff09d2b24b543d1aa3903e75_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\63d38c77ff09d2b24b543d1aa3903e75_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3020
    • C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2280

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2280-2-0x0000000000400000-0x00000000004E4000-memory.dmp

    Filesize

    912KB

  • memory/3020-1-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

  • memory/3020-0-0x0000000000400000-0x00000000004E4000-memory.dmp

    Filesize

    912KB

  • memory/3020-4-0x0000000000400000-0x00000000004E4000-memory.dmp

    Filesize

    912KB