Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
04-01-2025 06:18
General
-
Target
JaffaCakes118_78225687890365d41e4baff16c038fe0.exe
-
Size
724KB
-
MD5
78225687890365d41e4baff16c038fe0
-
SHA1
aea8ec54d64c77902c031105bef2122db96d48ca
-
SHA256
de01b88c14e2a26b8a8e738762b6767d95e843051dad8c5afe9749cf22e50947
-
SHA512
a5d98dc90fe7a0ba5ed40e3ffbeb7fe7adb896ee3a067e7575850bdd72e29c2654f9c291cc3d83318b0e43eeea6aef983023d84674928bff44e0482e6d2ac37c
-
SSDEEP
6144:eLE4csDIMVMiNwRiyBoZoXJwb1E6mh4isR2/oM7EIihhtFwuEtzy8KiMedl/K0XR:exNuiySkk5DR2/4htgzxnXVF/Td
Score
10/10
Malware Config
Signatures
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
Darkcomet family
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_78225687890365d41e4baff16c038fe0.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_78225687890365d41e4baff16c038fe0.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
724KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
724KB
-
Filesize
724KB