Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
17-10-2024 18:43
General
-
Target
532354d2b4cbb389ec253e5291aa6534_JaffaCakes118.exe
-
Size
2.9MB
-
MD5
532354d2b4cbb389ec253e5291aa6534
-
SHA1
783512689f2e64965c48d215bebf24be9880cff1
-
SHA256
9976729594d039688a44ca338b3e2ce85a49b6730b2435e53c35e8318ea51f61
-
SHA512
0d0a3f3914289d8e4eb7f76e30eb6ea5b5ae57ac9b50b7fdc7fac74093c82fe379d4cc12a90c1ab426bc109a5575bcde05eb2cfd143964c6feb8210bd65da112
-
SSDEEP
49152:DsCO+CQ1xKRzgJGvCZOO5RoyeZA+MFjUksU2RbvpBnKvVq6fBpzM60VJupSQ3q:DsCO3oo3CZOkRdfjU7XbRBoVq6j0V4p0
Malware Config
Signatures
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 17 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
-
Suspicious use of FindShellTrayWindow 5 IoCs
-
Suspicious use of SendNotifyMessage 4 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\532354d2b4cbb389ec253e5291aa6534_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\532354d2b4cbb389ec253e5291aa6534_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Client.exe"C:\Users\Admin\AppData\Roaming\Client.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.0MB
MD57fd34db83f76f79177d2c6df0b87645a
SHA135621ee4133cd081fd67d3d18af41c827f5ddc7d
SHA2561432cc3dc1c2f5de7eff82d833ab1948b9e660fe9f3f5134d5b692a61f42850a
SHA5125c18502cf0110dfc2e379b25775b75bfc0ef1e639e2aaff4847344b1e3483a0eedbfd316d8662843a000a3611929f68b131374e3052bff1a7eab2d16343eef04
-
Filesize
20B
MD58bb400d926ed7f40be31fada430f45ea
SHA127826dc07859a23a11bcbd1317912de9593bb074
SHA25668a10a393c2fe6e8e1f47bd3b42564456cf55a7fc881550b1d7dcc765462c405
SHA512f84f346c73a5ddc1ab0c3484e20402b236f3bff186c0d45c38cb770acecb4d3a26a318d772007c298082f4111125cba9b2473a0bee38e0dfcb91e7d8b4c1e8a4
-
Filesize
20B
MD58b95c8c3b5a785465f8e2f868e20cc30
SHA12787db459289b44cde9107db26cbadc589883ce3
SHA256976c786397ad5cd5f0d2ac8e96dc67bc904f3eeffa10d08bc2c975a213ebd041
SHA512e51500409551a44b22582a1b8c3d5d25f5b708a0a443a714373da402b25f6a8044d0d2d39198ccc4b4729cb5c3cc68b201fbf164aded78054378291df09f7ac0
-
Filesize
6.5MB
-
Filesize
6.5MB
-
Filesize
6.5MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.5MB
-
Filesize
4KB
-
Filesize
6.5MB
-
Filesize
6.5MB
-
Filesize
4KB
-
Filesize
6.5MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.5MB
-
Filesize
6.5MB
-
Filesize
6.5MB
-
Filesize
6.5MB
-
Filesize
6.5MB
-
Filesize
6.5MB
-
Filesize
6.5MB
-
Filesize
6.5MB
-
Filesize
6.5MB