General
-
Target
2422027d015bd9c5cda6a35992f52ddd_JaffaCakes118
-
Size
236KB
-
Sample
240704-bng3qayanb
-
MD5
2422027d015bd9c5cda6a35992f52ddd
-
SHA1
aa5bd9ca20608294d9836f9f33544f05e9ac15f5
-
SHA256
c350768d6ed95189be1c8e9eba5df411683cf4dc851b2b35f45cad42b7766025
-
SHA512
dc70a6bc635a40888deee15ebac0e02a07787baeeb6f3c8dc90d003243d4c28147043bc8d94594d3d3b6c9133d0a1295ad6228be9d04fe46f0d24ea5d50eed3f
-
SSDEEP
6144:rmDUj24gqU85IzrFA9NfmDuLpNr5NhWudrWDh:rqUj2LkizrzDujVNhWucD
Static task
static1
Behavioral task
behavioral1
Sample
2422027d015bd9c5cda6a35992f52ddd_JaffaCakes118.exe
Resource
win7-20240419-en
Malware Config
Extracted
darkcomet
Guest16
116.37.6.196:1604
DC_MUTEX-GV6M3AV
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
S39AghKlJUTK
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
MicroUpdate
Targets
-
-
Target
2422027d015bd9c5cda6a35992f52ddd_JaffaCakes118
-
Size
236KB
-
MD5
2422027d015bd9c5cda6a35992f52ddd
-
SHA1
aa5bd9ca20608294d9836f9f33544f05e9ac15f5
-
SHA256
c350768d6ed95189be1c8e9eba5df411683cf4dc851b2b35f45cad42b7766025
-
SHA512
dc70a6bc635a40888deee15ebac0e02a07787baeeb6f3c8dc90d003243d4c28147043bc8d94594d3d3b6c9133d0a1295ad6228be9d04fe46f0d24ea5d50eed3f
-
SSDEEP
6144:rmDUj24gqU85IzrFA9NfmDuLpNr5NhWudrWDh:rqUj2LkizrzDujVNhWucD
-
Modifies WinLogon for persistence
-
Modifies security service
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1