Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
03-01-2025 09:14
General
-
Target
JaffaCakes118_6b99e76534783155bd01acac14023aea.exe
-
Size
646KB
-
MD5
6b99e76534783155bd01acac14023aea
-
SHA1
b6cdefb2b6d3449b5904a27d3992d0b61e48378f
-
SHA256
acbe19fd05fcd3431c9cd26a96f5f0bad6cda5b0a9b81a7f69cc6c4469828394
-
SHA512
6b79ef4990f022b29074d6f24b3be51c5ed36551d776f6d973ddd206cc1c18f1d0cd7244b11c10e425f2fa027ee87186d5cac187c831b22a1079449891630c54
-
SSDEEP
12288:Q8UaT9XY2siA0bMG09xD7I3Gg8ecgVvfBoCDBOQQYbVXpuy1f/gORixm:JUKoN0bUxgGa/pfBHDb+y1HgZk
Score
10/10
Malware Config
Signatures
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
Darkcomet family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6b99e76534783155bd01acac14023aea.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6b99e76534783155bd01acac14023aea.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
700KB
-
Filesize
4KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
700KB