General
-
Target
06a15ab711359ca5c66335039793daaf_JaffaCakes118
-
Size
770KB
-
Sample
240429-c1hepaff38
-
MD5
06a15ab711359ca5c66335039793daaf
-
SHA1
95bd3194b060bc8e775e5bc0a76bc6dc0094a70b
-
SHA256
f51a0aa16b0a033eaeb45e5bbea6b492b499a0af1404309882f333f18f4e890a
-
SHA512
925fe2815b0ff212a26b1d1e63de27c44f83069c9a8b3643f114c28b9b6764ca867e5039324ca92174730f777dcd75e5f4f43b13583ff8ad599fbe810a58f998
-
SSDEEP
12288:P9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9EkNC/B:5Z1xuVVjfFoynPaVBUR8f+kN10EdB
Behavioral task
behavioral1
Sample
06a15ab711359ca5c66335039793daaf_JaffaCakes118.exe
Resource
win7-20240215-en
Malware Config
Extracted
darkcomet
Guest16
tihe17.zapto.org:8030
DC_MUTEX-X1RN242
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
umehiZR0cf0n
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Targets
-
-
Target
06a15ab711359ca5c66335039793daaf_JaffaCakes118
-
Size
770KB
-
MD5
06a15ab711359ca5c66335039793daaf
-
SHA1
95bd3194b060bc8e775e5bc0a76bc6dc0094a70b
-
SHA256
f51a0aa16b0a033eaeb45e5bbea6b492b499a0af1404309882f333f18f4e890a
-
SHA512
925fe2815b0ff212a26b1d1e63de27c44f83069c9a8b3643f114c28b9b6764ca867e5039324ca92174730f777dcd75e5f4f43b13583ff8ad599fbe810a58f998
-
SSDEEP
12288:P9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9EkNC/B:5Z1xuVVjfFoynPaVBUR8f+kN10EdB
-
Modifies WinLogon for persistence
-
Modifies firewall policy service
-
Modifies security service
-
Adds policy Run key to start application
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Defense Evasion
Modify Registry
8Impair Defenses
2Disable or Modify Tools
2Hide Artifacts
2Hidden Files and Directories
2