Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
20/10/2024, 12:47
General
-
Target
6250f70627980d469b2b76f6e0bccf36_JaffaCakes118.exe
-
Size
658KB
-
MD5
6250f70627980d469b2b76f6e0bccf36
-
SHA1
7d66296894ea752f9fe529bb9fe6ac5b1df4ce1c
-
SHA256
ec69a281b147c21862d92706d78266fa98c4dedb0e39ced3d3cd9a86a3bea590
-
SHA512
8897a33b6cb1da0092043d31a76ae6e41569ded1bc8709f6df090d06d674f9e009726a1b59a9a134ae92ea7308ddb492c4e8319fdb5741224cc25ed680d8ede5
-
SSDEEP
12288:B9AFlAd0Z+89cxTGzO4AucTD8QP2lmFSrVs9LqnKS5L:3AQ6Zx9cxTmOrucTIEFSpOG/p
Malware Config
Signatures
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6250f70627980d469b2b76f6e0bccf36_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\6250f70627980d469b2b76f6e0bccf36_JaffaCakes118.exe"1⤵
- Checks BIOS information in registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB