General

  • Target

    f724bf54d8a134608ea974d325c29684_JaffaCakes118

  • Size

    712KB

  • Sample

    241216-ea7yrssnat

  • MD5

    f724bf54d8a134608ea974d325c29684

  • SHA1

    a8525920fc6704e0dc77fd4f3072f77d3825aef3

  • SHA256

    ca3d5ed5e649e04c111100615ca969a8e9e88f0bb2afce3056ba69db7fb07b4f

  • SHA512

    a8cb62cfce1e3b9cfd77d7dda94ed92dd17336cbee0d4615221aa5aa84a07a9241809f672183cbf1d54d7bec4764bffed27aecddce4bec2b25b56852bdf87685

  • SSDEEP

    12288:4zHS+RxBUkcbxBwfKNClLBpvM7SYUCJgB8F8JBS9y3YW6YraEZcu:MRxBUk4wfKNCLpXYNg88J4BW3a9u

Malware Config

Targets

    • Target

      f724bf54d8a134608ea974d325c29684_JaffaCakes118

    • Size

      712KB

    • MD5

      f724bf54d8a134608ea974d325c29684

    • SHA1

      a8525920fc6704e0dc77fd4f3072f77d3825aef3

    • SHA256

      ca3d5ed5e649e04c111100615ca969a8e9e88f0bb2afce3056ba69db7fb07b4f

    • SHA512

      a8cb62cfce1e3b9cfd77d7dda94ed92dd17336cbee0d4615221aa5aa84a07a9241809f672183cbf1d54d7bec4764bffed27aecddce4bec2b25b56852bdf87685

    • SSDEEP

      12288:4zHS+RxBUkcbxBwfKNClLBpvM7SYUCJgB8F8JBS9y3YW6YraEZcu:MRxBUk4wfKNCLpXYNg88J4BW3a9u

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Darkcomet family

    • Modifies WinLogon for persistence

    • Modifies firewall policy service

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks