General

  • Target

    61d141a0c87a1c5409420b7032afcca8_JaffaCakes118

  • Size

    347KB

  • Sample

    240721-29g8qazcpe

  • MD5

    61d141a0c87a1c5409420b7032afcca8

  • SHA1

    8a2a4f624e2d76df8b1674c6ce3b1d9b0cdaadfc

  • SHA256

    588d0c24a46380f1b9a651a2dec693aec4d93af75eb4f97f026411edd47e42bf

  • SHA512

    53f269f99bda48ac8d312612a356e34f3c153549fa16c2b27826d641eff480a171f031cdf22c2ff75916e7b19b5707aec16823a9a471780b09b19169d05c2a87

  • SSDEEP

    6144:yFRaI2EqBP/WsZL1PgLl4w0AidVym0EnarUBYVsYQZHHewhE:2R72EqluswR45JTnaEY2Y8HewhE

Malware Config

Targets

    • Target

      61d141a0c87a1c5409420b7032afcca8_JaffaCakes118

    • Size

      347KB

    • MD5

      61d141a0c87a1c5409420b7032afcca8

    • SHA1

      8a2a4f624e2d76df8b1674c6ce3b1d9b0cdaadfc

    • SHA256

      588d0c24a46380f1b9a651a2dec693aec4d93af75eb4f97f026411edd47e42bf

    • SHA512

      53f269f99bda48ac8d312612a356e34f3c153549fa16c2b27826d641eff480a171f031cdf22c2ff75916e7b19b5707aec16823a9a471780b09b19169d05c2a87

    • SSDEEP

      6144:yFRaI2EqBP/WsZL1PgLl4w0AidVym0EnarUBYVsYQZHHewhE:2R72EqluswR45JTnaEY2Y8HewhE

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Modifies WinLogon for persistence

    • Modifies firewall policy service

    • Modifies security service

    • Windows security bypass

    • Disables RegEdit via registry modification

    • Disables Task Manager via registry modification

    • Drops file in Drivers directory

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Windows security modification

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks