Analysis

  • max time kernel
    149s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/07/2024, 15:57

General

  • Target

    63d38c77ff09d2b24b543d1aa3903e75_JaffaCakes118.exe

  • Size

    912KB

  • MD5

    63d38c77ff09d2b24b543d1aa3903e75

  • SHA1

    840b5f2a16edc348db679eca4980bd0d4864b09a

  • SHA256

    e6c7a2746e277a37dcbdb627dd38c51e02bb0e4ae401ba2cc5b76380bdacadf5

  • SHA512

    572819e10afb4bf39d2394d9018682627d919f1e3fb777dce231f590dbbaedacd1f7fbf959962f7bf7200c448434b882329f5ab1c5a02ac57d339d7824f5d9d2

  • SSDEEP

    12288:A8UaT9XY2siA0bMG09xD7I3Gg8ecgVvfBoCDBOQQYbVXpuy1f/g8e6+0mP:5UKoN0bUxgGa/pfBHDb+y1Hg8e6W

Score
10/10

Malware Config

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\63d38c77ff09d2b24b543d1aa3903e75_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\63d38c77ff09d2b24b543d1aa3903e75_JaffaCakes118.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3716
    • C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
      2⤵
        PID:3564
      • C:\Windows\explorer.exe
        "C:\Windows\explorer.exe"
        2⤵
          PID:4448

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/3716-0-0x0000000000400000-0x00000000004E4000-memory.dmp

        Filesize

        912KB

      • memory/3716-1-0x0000000000700000-0x0000000000701000-memory.dmp

        Filesize

        4KB

      • memory/3716-2-0x0000000000400000-0x00000000004E4000-memory.dmp

        Filesize

        912KB

      • memory/3716-3-0x0000000000400000-0x00000000004E4000-memory.dmp

        Filesize

        912KB

      • memory/3716-4-0x0000000000700000-0x0000000000701000-memory.dmp

        Filesize

        4KB

      • memory/3716-6-0x0000000000400000-0x00000000004E4000-memory.dmp

        Filesize

        912KB

      • memory/3716-7-0x0000000000400000-0x00000000004E4000-memory.dmp

        Filesize

        912KB

      • memory/3716-9-0x0000000000400000-0x00000000004E4000-memory.dmp

        Filesize

        912KB

      • memory/3716-11-0x0000000000400000-0x00000000004E4000-memory.dmp

        Filesize

        912KB

      • memory/3716-12-0x0000000000400000-0x00000000004E4000-memory.dmp

        Filesize

        912KB

      • memory/3716-13-0x0000000000400000-0x00000000004E4000-memory.dmp

        Filesize

        912KB

      • memory/3716-14-0x0000000000400000-0x00000000004E4000-memory.dmp

        Filesize

        912KB

      • memory/3716-15-0x0000000000400000-0x00000000004E4000-memory.dmp

        Filesize

        912KB