General

  • Target

    JaffaCakes118_f4d450ae43c1f09be92d1ee9f68bd40d1ee542c8569cbe3b120d41baa36cfd3f

  • Size

    1.3MB

  • Sample

    241230-bnvzkssqes

  • MD5

    0d7fdb7bcf7355de970c82c9a95fdf88

  • SHA1

    99fae0f223a6606ea47f64dc79c86efed44cb3f6

  • SHA256

    f4d450ae43c1f09be92d1ee9f68bd40d1ee542c8569cbe3b120d41baa36cfd3f

  • SHA512

    8711821492e3a1688bda13682c9d8f5eb6d685b830d0d7fb2f82c669b367d85b3672479c0a787f2df0f93220dc92dc5229cf3e78b3d120981d1b62d985a987de

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Malware Config

Targets

    • Target

      JaffaCakes118_f4d450ae43c1f09be92d1ee9f68bd40d1ee542c8569cbe3b120d41baa36cfd3f

    • Size

      1.3MB

    • MD5

      0d7fdb7bcf7355de970c82c9a95fdf88

    • SHA1

      99fae0f223a6606ea47f64dc79c86efed44cb3f6

    • SHA256

      f4d450ae43c1f09be92d1ee9f68bd40d1ee542c8569cbe3b120d41baa36cfd3f

    • SHA512

      8711821492e3a1688bda13682c9d8f5eb6d685b830d0d7fb2f82c669b367d85b3672479c0a787f2df0f93220dc92dc5229cf3e78b3d120981d1b62d985a987de

    • SSDEEP

      24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Dcrat family

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks