General
-
Target
83e0ddac12acdb27da50f5dced06226f_JaffaCakes118
-
Size
350KB
-
Sample
240809-2v9z7axera
-
MD5
83e0ddac12acdb27da50f5dced06226f
-
SHA1
e3dd811dbc691b529b84fa9b6cc053f04373e217
-
SHA256
61e7b3bb8058709bee55672ac85b66b083baeae7235d5016fcddeed5c6917db9
-
SHA512
2bbbc70c1ad09b339cd060b0e33321f9d79c391cda58ba5e5d60078a66359c74de33cd1a6592122e4129102567c18ac9361ca046e4a914966cb1edf0ed1a15a9
-
SSDEEP
6144:xBJVqu5jxRl+t6Ge0qw0kw9+Ks9a8/7z6lntXnZa0:xtqwjxRl+t6GfL7zcdng
Behavioral task
behavioral1
Sample
83e0ddac12acdb27da50f5dced06226f_JaffaCakes118.exe
Resource
win7-20240708-en
Malware Config
Extracted
darkcomet
Guest16
abod12345.no-ip.info:999
DC_MUTEX-VJQ8V8D
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
3VJFaguAC0JG
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
MicroUpdate
Targets
-
-
Target
83e0ddac12acdb27da50f5dced06226f_JaffaCakes118
-
Size
350KB
-
MD5
83e0ddac12acdb27da50f5dced06226f
-
SHA1
e3dd811dbc691b529b84fa9b6cc053f04373e217
-
SHA256
61e7b3bb8058709bee55672ac85b66b083baeae7235d5016fcddeed5c6917db9
-
SHA512
2bbbc70c1ad09b339cd060b0e33321f9d79c391cda58ba5e5d60078a66359c74de33cd1a6592122e4129102567c18ac9361ca046e4a914966cb1edf0ed1a15a9
-
SSDEEP
6144:xBJVqu5jxRl+t6Ge0qw0kw9+Ks9a8/7z6lntXnZa0:xtqwjxRl+t6GfL7zcdng
-
Modifies WinLogon for persistence
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1