Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19-10-2024 15:24
General
-
Target
5d4b872dd6c54fc6bc8e32da382b806c_JaffaCakes118.exe
-
Size
365KB
-
MD5
5d4b872dd6c54fc6bc8e32da382b806c
-
SHA1
a1628a5cc9df301226dc398a3a9c80f765926287
-
SHA256
065a027d9dbbd96cdb740da9a315726c090fbea79d74b5d8266d865fb47168ff
-
SHA512
a608779a765e23c0750e4abd42fc935270b3f4af90e90ea82c95301aa28e49d409a5ea538bf9ef0692d1fe2784f95ac6e2181ebc694b94316e3f6b33907beaf6
-
SSDEEP
6144:mopNI2vQplSZkOiu9PZ/pJQkB3BzRP926aGSI9u2LlYv5TT7+rgWbh/zkCID+gKg:monvvNVRJ5lB7ymnbh/RICUl
Malware Config
Signatures
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 17 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d4b872dd6c54fc6bc8e32da382b806c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\5d4b872dd6c54fc6bc8e32da382b806c_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Crypted.exe"C:\Users\Admin\AppData\Local\Temp\Crypted.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
247KB
MD52ece80d67eff2b2d55bb5132ca93a86f
SHA1f7969929a6b6b2a1c7a90a8ef247adcef9485b4f
SHA2560cbfb3c1bfc0470dba5ccdcd9c854a523d7312d9f6d71d624faddc5d52bc9946
SHA512dbe40b98f12f6de0886e648a3ce81f58967ba32badcb66ca10c4c7dbc663dc266528854ebd1eafe157d07ebe2fe8de14316718cea507960840fe7d649cd75a54
-
Filesize
9.6MB
-
Filesize
664KB
-
Filesize
9.6MB
-
Filesize
4.8MB
-
Filesize
624KB
-
Filesize
9.6MB
-
Filesize
32KB
-
Filesize
304KB
-
Filesize
9.6MB
-
Filesize
4KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
4KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
4KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB