General
-
Target
44ce7f3d52cfa9fb15673e316cc85973_JaffaCakes118
-
Size
659KB
-
Sample
240515-gredwscb71
-
MD5
44ce7f3d52cfa9fb15673e316cc85973
-
SHA1
f6a96fad3cbf3582724a3e7672c87fab00e8e6b8
-
SHA256
d48deb109ed352cf5ffad2ae0665f061fcfd7f4278ac58e014bf9cc1b6ca8c7a
-
SHA512
2e1a25643ed8639b669566e8d4984b245ec75563a784280c63d807a6bfa4db3b8b5586d75cad7807831600c5a63f957539ccd238a8fc721c556e132542a3a4bf
-
SSDEEP
12288:y9HMeUmcufrvA3kb445UEJ2jsWiD4EvFuu4cNgZhCiZKD/XdyFu:eiBIGkbxqEcjsWiDxguehC2Sd
Behavioral task
behavioral1
Sample
44ce7f3d52cfa9fb15673e316cc85973_JaffaCakes118.exe
Resource
win7-20240221-en
Malware Config
Extracted
darkcomet
Guest16
freeqn.hopto.org:1604
DC_MUTEX-LGE9MDS
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
tNHM6sn21B8n
-
install
true
-
offline_keylogger
true
-
password
0123456789
-
persistence
false
-
reg_key
MicroUpdate
Targets
-
-
Target
44ce7f3d52cfa9fb15673e316cc85973_JaffaCakes118
-
Size
659KB
-
MD5
44ce7f3d52cfa9fb15673e316cc85973
-
SHA1
f6a96fad3cbf3582724a3e7672c87fab00e8e6b8
-
SHA256
d48deb109ed352cf5ffad2ae0665f061fcfd7f4278ac58e014bf9cc1b6ca8c7a
-
SHA512
2e1a25643ed8639b669566e8d4984b245ec75563a784280c63d807a6bfa4db3b8b5586d75cad7807831600c5a63f957539ccd238a8fc721c556e132542a3a4bf
-
SSDEEP
12288:y9HMeUmcufrvA3kb445UEJ2jsWiD4EvFuu4cNgZhCiZKD/XdyFu:eiBIGkbxqEcjsWiDxguehC2Sd
-
Modifies WinLogon for persistence
-
Modifies firewall policy service
-
Modifies security service
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2