General
-
Target
d5c2976d0f15869cb63331808e820baf_JaffaCakes118
-
Size
838KB
-
Sample
241208-hk8jtswnhz
-
MD5
d5c2976d0f15869cb63331808e820baf
-
SHA1
2a6e216bfcca4c07f87e367e6e74970b173ce210
-
SHA256
3c6463a88d38ea359e45d7885751c33e0a2204c970ff7e34a1f92c172db2318a
-
SHA512
dd1c74e9b08813eef97e03c69029a751b169e1ee8765ea01a251d63881b4ede263f45497cd07f45212d3b2d01ff0c2dc3bd416da954ba3c158f6b63361a3ad9c
-
SSDEEP
24576:CAEb7r17zsY28z+3izY0u+mHZNBypZ4gP0ea:CAEXr17i3KzAZDavMea
Static task
static1
Behavioral task
behavioral1
Sample
d5c2976d0f15869cb63331808e820baf_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d5c2976d0f15869cb63331808e820baf_JaffaCakes118.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
d5c2976d0f15869cb63331808e820baf_JaffaCakes118
-
Size
838KB
-
MD5
d5c2976d0f15869cb63331808e820baf
-
SHA1
2a6e216bfcca4c07f87e367e6e74970b173ce210
-
SHA256
3c6463a88d38ea359e45d7885751c33e0a2204c970ff7e34a1f92c172db2318a
-
SHA512
dd1c74e9b08813eef97e03c69029a751b169e1ee8765ea01a251d63881b4ede263f45497cd07f45212d3b2d01ff0c2dc3bd416da954ba3c158f6b63361a3ad9c
-
SSDEEP
24576:CAEb7r17zsY28z+3izY0u+mHZNBypZ4gP0ea:CAEXr17i3KzAZDavMea
Score10/10-
Darkcomet family
-
Modifies WinLogon for persistence
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1