Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
25-11-2024 02:23
General
-
Target
98a2d83b6a20bebed8243b175c4cbdc9_JaffaCakes118.exe
-
Size
657KB
-
MD5
98a2d83b6a20bebed8243b175c4cbdc9
-
SHA1
ea1e209163875cd729c0124d5d958c17f8977bbb
-
SHA256
e1f04ebf7c14609652343114d33d658a8a2ecbe42049b5929f56e5c543e378b4
-
SHA512
3ebabc2d624eb2df574da6688c8ef875e4f3215cafbc36b30c186fe60e7f43d0b2e2b6bd66b16a6a7a31fc5586bc1bb73ab23612d8153d51c14be2329eb1aba2
-
SSDEEP
12288:iOANXryu1S69QwWBIlVi4o858nFBKgmvtOwUATgDQ855:DANOCS6qwWB0V5o8mnqvtrdgDQ8D
Score
10/10
Malware Config
Signatures
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
Darkcomet family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\98a2d83b6a20bebed8243b175c4cbdc9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\98a2d83b6a20bebed8243b175c4cbdc9_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
728KB
-
Filesize
4KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB