Analysis
-
max time kernel
63s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
28-10-2024 11:34
General
-
Target
796d1e3fc712afd8a808f308f9c6aae3_JaffaCakes118.exe
-
Size
2.4MB
-
MD5
796d1e3fc712afd8a808f308f9c6aae3
-
SHA1
4a38845e5bfc6433aaf4642515da60f10fb7f27b
-
SHA256
1c10341bd486324dd1cb054e3da226321f1a7532c383aa5f45a46e8b59e028d4
-
SHA512
0349302076dbccebc58ea20a0aa5b009504ca27d5a32bcb59af1c5e25ccf1e6daba6035d609aabb163704d418beac3a39d39b669c61f6e9f86cf7af0a03bbda3
-
SSDEEP
24576:p3nbWmJVJFwSddIXvfhqbiaxvRxq99vHjN0Mn3NXSfQF10gOUl:FamdZdcBY0vjQYb0U
Malware Config
Signatures
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
Darkcomet family
-
Modifies security service 2 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 2 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Windows security modification 2 TTPs 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\796d1e3fc712afd8a808f308f9c6aae3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\796d1e3fc712afd8a808f308f9c6aae3_JaffaCakes118.exe"1⤵
- Modifies security service
- Windows security bypass
- Checks computer location settings
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\EMAILLISTA.EXE"C:\Users\Admin\AppData\Local\Temp\EMAILLISTA.EXE"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\EMAILLISTA.EXE"C:\Users\Admin\AppData\Local\Temp\EMAILLISTA.EXE"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD58abf9065c1a83daab75cf5af686616c8
SHA19ec1b929bff1008da098eb9700b6bcc40ed1aac5
SHA256f11d4987b5a1b83017b38f2838c880e39f7d722d47f7e119592dbf2dc9bd5dd3
SHA51251f25e5d1c873bc0e4cac162f3b7a5fcfe92b7f7d43847123df5c81002f8915aa8be875c46c2301f1ad4c8e6d5c16304579d8808c490ad902b48d3135933ffdc
-
Filesize
610B
MD5efd96da06b2313afae3317f13004e8dc
SHA19bcb1330357d462f6b5106392582ce834c065fe7
SHA256813b6d3e6326dcb5614293c3971ee85c87db2a650a5a692d510bd3c32e25dab4
SHA51226d12018d97197e3b9494d9e1a7f0b7d652034702b47ad756ad1d57df36be9f6ff116abd4f7e6c0f091b41f1755056d9478ce4789947c715324cfc2040b0e224
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
4KB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
4KB
-
Filesize
2.4MB
-
Filesize
1.6MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.6MB
-
Filesize
4KB
-
Filesize
4KB