General
-
Target
5f416b178d8d810f5d4278290a2bd00c_JaffaCakes118
-
Size
251KB
-
Sample
240520-qft5mscf3t
-
MD5
5f416b178d8d810f5d4278290a2bd00c
-
SHA1
ff151d7e84772e85f0c8f94680bc09aea1e8eb21
-
SHA256
8ff1ef963f68b60dfc4a3116e308b57449400791280dd2b21a4b8727aaa9c33a
-
SHA512
0a4cba14d009833f2e8c5d27f67de960c77937a6c8a1a865f29ff579595dea0af9970c0daaad0031074d7530ee456a47029addeea5a33063cf044673c36217c5
-
SSDEEP
6144:lcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37:lcW7KEZlPzCy37
Behavioral task
behavioral1
Sample
5f416b178d8d810f5d4278290a2bd00c_JaffaCakes118.exe
Resource
win7-20240221-en
Malware Config
Extracted
darkcomet
unkown
78.29.9.28:12345
DC_MUTEX-YK73YNE
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
7oqLDrdDz3He
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
MicroUpdate
Targets
-
-
Target
5f416b178d8d810f5d4278290a2bd00c_JaffaCakes118
-
Size
251KB
-
MD5
5f416b178d8d810f5d4278290a2bd00c
-
SHA1
ff151d7e84772e85f0c8f94680bc09aea1e8eb21
-
SHA256
8ff1ef963f68b60dfc4a3116e308b57449400791280dd2b21a4b8727aaa9c33a
-
SHA512
0a4cba14d009833f2e8c5d27f67de960c77937a6c8a1a865f29ff579595dea0af9970c0daaad0031074d7530ee456a47029addeea5a33063cf044673c36217c5
-
SSDEEP
6144:lcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37:lcW7KEZlPzCy37
-
Modifies WinLogon for persistence
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1