Analysis
-
max time kernel
58s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
03-11-2024 18:40
General
-
Target
8cef8d70458de6b9435def470680d262_JaffaCakes118.exe
-
Size
432KB
-
MD5
8cef8d70458de6b9435def470680d262
-
SHA1
23d80bb815db7ceb6bce16875e845724d39112fa
-
SHA256
ac19c2544c4d3270c78bb284fd0dd4dd191bd12e4251f0ecc74ea2790bc42884
-
SHA512
b6bf3dcbb7afde6374c55b61ee23abaab1943b6e55e0b7a254bb7e9f22d166dc0e5a4dfeb17bbd6d11cdfcc6fd4a59ea0da041c0aec6881a53eefcb5af13835b
-
SSDEEP
12288:nRFj60qRr5jdVd9JyxtrpukNd4WQ8B/WMoylhC1YuX:K061dVx+3giWMJo1xX
Malware Config
Signatures
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
Darkcomet family
-
ASPack v2.12-2.42 1 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8cef8d70458de6b9435def470680d262_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\8cef8d70458de6b9435def470680d262_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SERVER NET.exe"C:\Users\Admin\AppData\Local\Temp\SERVER NET.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
242KB
MD58e45147b1da430e0e201932c22b08e90
SHA1785999880436fff844e2dddef9c8cad75e1f3c59
SHA25695fb1867eb75c36757844879e23e677a8a204647bca3820b7706c7cd5bdcc8b9
SHA5124624ecb95e1bf5bb64952ff971edf10ee58a6fa7252bd8a64c3d30b41aa979c0f69a0e4d1ffce890fac7e5132ca545b2747b01f8d7f910c4bcc4c2b387901f23
-
Filesize
244KB
-
Filesize
244KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
960KB
-
Filesize
64KB
-
Filesize
576KB
-
Filesize
4KB
-
Filesize
960KB
-
Filesize
576KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
960KB
-
Filesize
244KB
-
Filesize
4KB
-
Filesize
728KB
-
Filesize
960KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
960KB
-
Filesize
728KB