General
-
Target
4d254669a3288a023310caae738470c8_JaffaCakes118
-
Size
252KB
-
Sample
240516-1j833shg8s
-
MD5
4d254669a3288a023310caae738470c8
-
SHA1
5ed0204f0ee83c1129119de8538c28131cb11d4c
-
SHA256
2e7e6e2f4dfb425726c2c3a9712e3b4a37ff986181abc29c22d638bbd7b2a6fb
-
SHA512
c285948dd5148de045e695903f36fc4ca894ca4dfedb1d49ee322c8acc90729238b69fb5b4f08124bda7bf709dd4f1fc4d2390aff7ddab6193ec4ec87cfcfaf6
-
SSDEEP
6144:HcNYk1yuwEDBum3qYWnl0pd0EX3Zq2b6wfIDYm0PHQ:HcWkbgTYWnYnt/IDYhP
Behavioral task
behavioral1
Sample
4d254669a3288a023310caae738470c8_JaffaCakes118.exe
Resource
win7-20240508-en
Malware Config
Extracted
darkcomet
ALL
188.0.213.201:1604
DC_MUTEX-Z7ZKSB2
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
bEF6Ca2SpQqE
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
MicroUpdate
Targets
-
-
Target
4d254669a3288a023310caae738470c8_JaffaCakes118
-
Size
252KB
-
MD5
4d254669a3288a023310caae738470c8
-
SHA1
5ed0204f0ee83c1129119de8538c28131cb11d4c
-
SHA256
2e7e6e2f4dfb425726c2c3a9712e3b4a37ff986181abc29c22d638bbd7b2a6fb
-
SHA512
c285948dd5148de045e695903f36fc4ca894ca4dfedb1d49ee322c8acc90729238b69fb5b4f08124bda7bf709dd4f1fc4d2390aff7ddab6193ec4ec87cfcfaf6
-
SSDEEP
6144:HcNYk1yuwEDBum3qYWnl0pd0EX3Zq2b6wfIDYm0PHQ:HcWkbgTYWnYnt/IDYhP
-
Modifies WinLogon for persistence
-
Modifies security service
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1