General
-
Target
90a2f5a7e2eea4f965a33d315e8c0c32_JaffaCakes118
-
Size
1005KB
-
Sample
240812-2wtdtszejd
-
MD5
90a2f5a7e2eea4f965a33d315e8c0c32
-
SHA1
23c8671ccb32c4338f1c1f02fe18a7f24df9d5f0
-
SHA256
ca5a7a74ec48c091be4a0163d054e61a1af9faa5cb0c4c4698f329bb3ab7c9d8
-
SHA512
5b8a32f3e00f1059e6452f54b57eed732fa83b47c436745b8d1536952d18a95e01e90177460bbc69466605989f6967d1d033c161c8aa191ed29157349c7970c1
-
SSDEEP
24576:X15+GrMnQ13hp8D0Iyum5geLxCb70ZzlK/cRgOnmq9g6RoSnby:Xb+Gz3h/u2r9IkzOcOU7m6tby
Static task
static1
Behavioral task
behavioral1
Sample
90a2f5a7e2eea4f965a33d315e8c0c32_JaffaCakes118.exe
Resource
win7-20240704-en
Malware Config
Extracted
darkcomet
Guest16
mohamedmmk.zapto.org:82
DC_MUTEX-L1KB0QQ
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
LN0J2LLsllhH
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
MicroUpdate
Targets
-
-
Target
90a2f5a7e2eea4f965a33d315e8c0c32_JaffaCakes118
-
Size
1005KB
-
MD5
90a2f5a7e2eea4f965a33d315e8c0c32
-
SHA1
23c8671ccb32c4338f1c1f02fe18a7f24df9d5f0
-
SHA256
ca5a7a74ec48c091be4a0163d054e61a1af9faa5cb0c4c4698f329bb3ab7c9d8
-
SHA512
5b8a32f3e00f1059e6452f54b57eed732fa83b47c436745b8d1536952d18a95e01e90177460bbc69466605989f6967d1d033c161c8aa191ed29157349c7970c1
-
SSDEEP
24576:X15+GrMnQ13hp8D0Iyum5geLxCb70ZzlK/cRgOnmq9g6RoSnby:Xb+Gz3h/u2r9IkzOcOU7m6tby
-
Modifies WinLogon for persistence
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1