General

  • Target

    JaffaCakes118_3afdc1049eae3e0b40d944915e52d52d293b450e150b66b095fde82271501428

  • Size

    1.3MB

  • Sample

    241230-v9v19atpfx

  • MD5

    71307fc13b2659f3cdc5e19f3823d738

  • SHA1

    3d63ad7172e5fe0f607d1ca5575c3cf772bbaac6

  • SHA256

    3afdc1049eae3e0b40d944915e52d52d293b450e150b66b095fde82271501428

  • SHA512

    07192db7b6c744868c70712bd8629b64d067ff150a2029394cf5fff2319e7171088c709204f45367329bf775f898608e7dea2008d3a448d471da394524259c10

  • SSDEEP

    24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

Malware Config

Targets

    • Target

      JaffaCakes118_3afdc1049eae3e0b40d944915e52d52d293b450e150b66b095fde82271501428

    • Size

      1.3MB

    • MD5

      71307fc13b2659f3cdc5e19f3823d738

    • SHA1

      3d63ad7172e5fe0f607d1ca5575c3cf772bbaac6

    • SHA256

      3afdc1049eae3e0b40d944915e52d52d293b450e150b66b095fde82271501428

    • SHA512

      07192db7b6c744868c70712bd8629b64d067ff150a2029394cf5fff2319e7171088c709204f45367329bf775f898608e7dea2008d3a448d471da394524259c10

    • SSDEEP

      24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    • Dcrat family

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks