Analysis
-
max time kernel
94s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
06/10/2024, 11:16
General
-
Target
17db6b63abdf05059a5da75ad3827a15_JaffaCakes118.exe
-
Size
482KB
-
MD5
17db6b63abdf05059a5da75ad3827a15
-
SHA1
3804d4f14faf27a69e0cdc2ff16a9d632d683d6b
-
SHA256
d6c04968ad6d636d10292cee6a79d9cef40249dcf85748540bdbc035e0f7272f
-
SHA512
07130d273579cec897a210e327015871b013b258925dc93e43190f57f61e094aae46859a36b1dca7367833515423c050aa912495fa118708fea286fc904f368d
-
SSDEEP
12288:keulMGw/qn159UyLOBIXDS/zujIKDsiqHHlR8bQOo5hmrbSd:znGwyDKyLPGLpKDs1l6QO4si
Malware Config
Signatures
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\17db6b63abdf05059a5da75ad3827a15_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\17db6b63abdf05059a5da75ad3827a15_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
752KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
312KB
-
Filesize
4KB
-
Filesize
960KB
-
Filesize
312KB
-
Filesize
752KB