Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27/02/2025, 07:30
Behavioral task
behavioral1
Sample
JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe
Resource
win10v2004-20250217-en
General
-
Target
JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe
-
Size
690KB
-
MD5
2ba680c520ca8588fb75db254cc0d470
-
SHA1
15ac9301840cd06aa0f33257126eecf23f6c1471
-
SHA256
43ec58e9b111f2361351bb49da4ca369eda71594d491e0299665f871e79e71bd
-
SHA512
7b1f79749cc4ec22f119eacb197842ff596071698cb18aadee8f131ca33888665298c8080b236fc472c567507c614322270906f6a01ae4b788249df6874ae16a
-
SSDEEP
12288:N9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hnE:nZ1xuVVjfFoynPaVBUR8f+kN10EBG
Malware Config
Extracted
darkcomet
Guest16
craxxhack.zapto.org:81
craxxhack.zapto.org:82
craxxhack.zapto.org:83
DC_MUTEX-38HGCW5
-
InstallPath
IBo0S\euYdH.exe
-
gencode
7j55icHSclql
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
Ux2rc
Signatures
-
Darkcomet family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IBo0S\\euYdH.exe" JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe -
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile euYdH.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" euYdH.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" euYdH.exe -
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" euYdH.exe -
Windows security bypass 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" euYdH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" euYdH.exe -
Disables Task Manager via registry modification
-
Executes dropped EXE 1 IoCs
pid Process 2812 euYdH.exe -
Loads dropped DLL 2 IoCs
pid Process 2736 JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe 2736 JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe -
Windows security modification 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" euYdH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" euYdH.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ux2rc = "C:\\Windows\\system32\\IBo0S\\euYdH.exe" JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe Set value (str) \REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ux2rc = "C:\\Windows\\system32\\IBo0S\\euYdH.exe" euYdH.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\IBo0S\euYdH.exe JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe File opened for modification C:\Windows\SysWOW64\IBo0S\euYdH.exe JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe File opened for modification C:\Windows\SysWOW64\IBo0S\ JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language euYdH.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2812 euYdH.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2736 JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe Token: SeSecurityPrivilege 2736 JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe Token: SeTakeOwnershipPrivilege 2736 JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe Token: SeLoadDriverPrivilege 2736 JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe Token: SeSystemProfilePrivilege 2736 JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe Token: SeSystemtimePrivilege 2736 JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe Token: SeProfSingleProcessPrivilege 2736 JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe Token: SeIncBasePriorityPrivilege 2736 JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe Token: SeCreatePagefilePrivilege 2736 JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe Token: SeBackupPrivilege 2736 JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe Token: SeRestorePrivilege 2736 JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe Token: SeShutdownPrivilege 2736 JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe Token: SeDebugPrivilege 2736 JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe Token: SeSystemEnvironmentPrivilege 2736 JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe Token: SeChangeNotifyPrivilege 2736 JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe Token: SeRemoteShutdownPrivilege 2736 JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe Token: SeUndockPrivilege 2736 JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe Token: SeManageVolumePrivilege 2736 JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe Token: SeImpersonatePrivilege 2736 JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe Token: SeCreateGlobalPrivilege 2736 JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe Token: 33 2736 JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe Token: 34 2736 JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe Token: 35 2736 JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe Token: SeIncreaseQuotaPrivilege 2812 euYdH.exe Token: SeSecurityPrivilege 2812 euYdH.exe Token: SeTakeOwnershipPrivilege 2812 euYdH.exe Token: SeLoadDriverPrivilege 2812 euYdH.exe Token: SeSystemProfilePrivilege 2812 euYdH.exe Token: SeSystemtimePrivilege 2812 euYdH.exe Token: SeProfSingleProcessPrivilege 2812 euYdH.exe Token: SeIncBasePriorityPrivilege 2812 euYdH.exe Token: SeCreatePagefilePrivilege 2812 euYdH.exe Token: SeBackupPrivilege 2812 euYdH.exe Token: SeRestorePrivilege 2812 euYdH.exe Token: SeShutdownPrivilege 2812 euYdH.exe Token: SeDebugPrivilege 2812 euYdH.exe Token: SeSystemEnvironmentPrivilege 2812 euYdH.exe Token: SeChangeNotifyPrivilege 2812 euYdH.exe Token: SeRemoteShutdownPrivilege 2812 euYdH.exe Token: SeUndockPrivilege 2812 euYdH.exe Token: SeManageVolumePrivilege 2812 euYdH.exe Token: SeImpersonatePrivilege 2812 euYdH.exe Token: SeCreateGlobalPrivilege 2812 euYdH.exe Token: 33 2812 euYdH.exe Token: 34 2812 euYdH.exe Token: 35 2812 euYdH.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2812 euYdH.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 2736 wrote to memory of 2812 2736 JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe 30 PID 2736 wrote to memory of 2812 2736 JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe 30 PID 2736 wrote to memory of 2812 2736 JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe 30 PID 2736 wrote to memory of 2812 2736 JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe 30 PID 2812 wrote to memory of 2184 2812 euYdH.exe 31 PID 2812 wrote to memory of 2184 2812 euYdH.exe 31 PID 2812 wrote to memory of 2184 2812 euYdH.exe 31 PID 2812 wrote to memory of 2184 2812 euYdH.exe 31 PID 2812 wrote to memory of 2184 2812 euYdH.exe 31 PID 2812 wrote to memory of 2184 2812 euYdH.exe 31 PID 2812 wrote to memory of 2184 2812 euYdH.exe 31 PID 2812 wrote to memory of 2184 2812 euYdH.exe 31 PID 2812 wrote to memory of 2184 2812 euYdH.exe 31 PID 2812 wrote to memory of 2184 2812 euYdH.exe 31 PID 2812 wrote to memory of 2184 2812 euYdH.exe 31 PID 2812 wrote to memory of 2184 2812 euYdH.exe 31 PID 2812 wrote to memory of 2184 2812 euYdH.exe 31 PID 2812 wrote to memory of 2184 2812 euYdH.exe 31 PID 2812 wrote to memory of 2184 2812 euYdH.exe 31 PID 2812 wrote to memory of 2184 2812 euYdH.exe 31 PID 2812 wrote to memory of 2184 2812 euYdH.exe 31 PID 2812 wrote to memory of 2184 2812 euYdH.exe 31 PID 2812 wrote to memory of 2184 2812 euYdH.exe 31 PID 2812 wrote to memory of 2184 2812 euYdH.exe 31 PID 2812 wrote to memory of 2184 2812 euYdH.exe 31 PID 2812 wrote to memory of 2184 2812 euYdH.exe 31 PID 2812 wrote to memory of 2184 2812 euYdH.exe 31 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion euYdH.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern euYdH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" euYdH.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\IBo0S\euYdH.exe"C:\Windows\system32\IBo0S\euYdH.exe"2⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2812 -
C:\Windows\SysWOW64\notepad.exenotepad3⤵
- System Location Discovery: System Language Discovery
PID:2184
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Defense Evasion
Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Modify Registry
7Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
690KB
MD52ba680c520ca8588fb75db254cc0d470
SHA115ac9301840cd06aa0f33257126eecf23f6c1471
SHA25643ec58e9b111f2361351bb49da4ca369eda71594d491e0299665f871e79e71bd
SHA5127b1f79749cc4ec22f119eacb197842ff596071698cb18aadee8f131ca33888665298c8080b236fc472c567507c614322270906f6a01ae4b788249df6874ae16a