General

  • Target

    JaffaCakes118_ef68545981106cad8a3672372e707e4e8d508666c9daa9039bee329f077ef7ae

  • Size

    1.3MB

  • Sample

    241222-afe3qavmfv

  • MD5

    9ef1cfe015dc82aceff0c8692e7c4a2b

  • SHA1

    8c8bf82f29261f45d7daef840e7bf3813924dc17

  • SHA256

    ef68545981106cad8a3672372e707e4e8d508666c9daa9039bee329f077ef7ae

  • SHA512

    c69765804d634b0663d414271e39d3720e53561e381dcb2e495217f813f9e2e3ce52baa128d0d279ed4fce9278ce0dc2ab188a9d769f2fd35c8090bca83229ea

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Malware Config

Targets

    • Target

      JaffaCakes118_ef68545981106cad8a3672372e707e4e8d508666c9daa9039bee329f077ef7ae

    • Size

      1.3MB

    • MD5

      9ef1cfe015dc82aceff0c8692e7c4a2b

    • SHA1

      8c8bf82f29261f45d7daef840e7bf3813924dc17

    • SHA256

      ef68545981106cad8a3672372e707e4e8d508666c9daa9039bee329f077ef7ae

    • SHA512

      c69765804d634b0663d414271e39d3720e53561e381dcb2e495217f813f9e2e3ce52baa128d0d279ed4fce9278ce0dc2ab188a9d769f2fd35c8090bca83229ea

    • SSDEEP

      24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Dcrat family

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks