General
-
Target
9a83fe2e8b650db2d5e35fe4c994725c_JaffaCakes118
-
Size
747KB
-
Sample
240815-sh6mkasfmj
-
MD5
9a83fe2e8b650db2d5e35fe4c994725c
-
SHA1
a4b60d1d52f217ea569f7a6b595f20282ef20c04
-
SHA256
90a9d2d0e0e257d2bc360e731ea9282ed6d0740c41f8ccc0a1efbe4b78c85fd1
-
SHA512
bc47628c290209f89e8d80c5d8ed3ff67e9df8cce5db9454b9f3eef4528763ffaa1f6b8e46c24bfae8a2ade707f5c77b859c2617e3c3d5f99a47b1121345eb3f
-
SSDEEP
12288:dk0QVlhmPojAPTMEsUTg0oChO/Q2JbsbjPbN5qhRTtYe3f+Iw86k/l/+Igxm:u0QRWoJEfg0oChGdJQbjPbNW5tYeP+Gn
Behavioral task
behavioral1
Sample
9a83fe2e8b650db2d5e35fe4c994725c_JaffaCakes118.exe
Resource
win7-20240704-en
Malware Config
Extracted
darkcomet
Guest16
127.0.0.1:1604
DC_MUTEX-TMAP0ED
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
6aWKV04jf6ds
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
MicroUpdate
Targets
-
-
Target
9a83fe2e8b650db2d5e35fe4c994725c_JaffaCakes118
-
Size
747KB
-
MD5
9a83fe2e8b650db2d5e35fe4c994725c
-
SHA1
a4b60d1d52f217ea569f7a6b595f20282ef20c04
-
SHA256
90a9d2d0e0e257d2bc360e731ea9282ed6d0740c41f8ccc0a1efbe4b78c85fd1
-
SHA512
bc47628c290209f89e8d80c5d8ed3ff67e9df8cce5db9454b9f3eef4528763ffaa1f6b8e46c24bfae8a2ade707f5c77b859c2617e3c3d5f99a47b1121345eb3f
-
SSDEEP
12288:dk0QVlhmPojAPTMEsUTg0oChO/Q2JbsbjPbN5qhRTtYe3f+Iw86k/l/+Igxm:u0QRWoJEfg0oChGdJQbjPbNW5tYeP+Gn
-
Modifies WinLogon for persistence
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1