Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
27/02/2025, 07:30
Behavioral task
behavioral1
Sample
JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe
Resource
win10v2004-20250217-en
General
-
Target
JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe
-
Size
690KB
-
MD5
2ba680c520ca8588fb75db254cc0d470
-
SHA1
15ac9301840cd06aa0f33257126eecf23f6c1471
-
SHA256
43ec58e9b111f2361351bb49da4ca369eda71594d491e0299665f871e79e71bd
-
SHA512
7b1f79749cc4ec22f119eacb197842ff596071698cb18aadee8f131ca33888665298c8080b236fc472c567507c614322270906f6a01ae4b788249df6874ae16a
-
SSDEEP
12288:N9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hnE:nZ1xuVVjfFoynPaVBUR8f+kN10EBG
Malware Config
Extracted
darkcomet
Guest16
craxxhack.zapto.org:81
craxxhack.zapto.org:82
craxxhack.zapto.org:83
DC_MUTEX-38HGCW5
-
InstallPath
IBo0S\euYdH.exe
-
gencode
7j55icHSclql
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
Ux2rc
Signatures
-
Darkcomet family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IBo0S\\euYdH.exe" JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe -
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile euYdH.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" euYdH.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" euYdH.exe -
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" euYdH.exe -
Windows security bypass 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" euYdH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" euYdH.exe -
Disables Task Manager via registry modification
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\Control Panel\International\Geo\Nation JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe -
Executes dropped EXE 1 IoCs
pid Process 2444 euYdH.exe -
Windows security modification 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" euYdH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" euYdH.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ux2rc = "C:\\Windows\\system32\\IBo0S\\euYdH.exe" JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe Set value (str) \REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ux2rc = "C:\\Windows\\system32\\IBo0S\\euYdH.exe" euYdH.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\IBo0S\euYdH.exe JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe File opened for modification C:\Windows\SysWOW64\IBo0S\euYdH.exe JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe File opened for modification C:\Windows\SysWOW64\IBo0S\ JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language euYdH.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2444 euYdH.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4816 JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe Token: SeSecurityPrivilege 4816 JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe Token: SeTakeOwnershipPrivilege 4816 JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe Token: SeLoadDriverPrivilege 4816 JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe Token: SeSystemProfilePrivilege 4816 JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe Token: SeSystemtimePrivilege 4816 JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe Token: SeProfSingleProcessPrivilege 4816 JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe Token: SeIncBasePriorityPrivilege 4816 JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe Token: SeCreatePagefilePrivilege 4816 JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe Token: SeBackupPrivilege 4816 JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe Token: SeRestorePrivilege 4816 JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe Token: SeShutdownPrivilege 4816 JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe Token: SeDebugPrivilege 4816 JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe Token: SeSystemEnvironmentPrivilege 4816 JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe Token: SeChangeNotifyPrivilege 4816 JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe Token: SeRemoteShutdownPrivilege 4816 JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe Token: SeUndockPrivilege 4816 JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe Token: SeManageVolumePrivilege 4816 JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe Token: SeImpersonatePrivilege 4816 JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe Token: SeCreateGlobalPrivilege 4816 JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe Token: 33 4816 JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe Token: 34 4816 JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe Token: 35 4816 JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe Token: 36 4816 JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe Token: SeIncreaseQuotaPrivilege 2444 euYdH.exe Token: SeSecurityPrivilege 2444 euYdH.exe Token: SeTakeOwnershipPrivilege 2444 euYdH.exe Token: SeLoadDriverPrivilege 2444 euYdH.exe Token: SeSystemProfilePrivilege 2444 euYdH.exe Token: SeSystemtimePrivilege 2444 euYdH.exe Token: SeProfSingleProcessPrivilege 2444 euYdH.exe Token: SeIncBasePriorityPrivilege 2444 euYdH.exe Token: SeCreatePagefilePrivilege 2444 euYdH.exe Token: SeBackupPrivilege 2444 euYdH.exe Token: SeRestorePrivilege 2444 euYdH.exe Token: SeShutdownPrivilege 2444 euYdH.exe Token: SeDebugPrivilege 2444 euYdH.exe Token: SeSystemEnvironmentPrivilege 2444 euYdH.exe Token: SeChangeNotifyPrivilege 2444 euYdH.exe Token: SeRemoteShutdownPrivilege 2444 euYdH.exe Token: SeUndockPrivilege 2444 euYdH.exe Token: SeManageVolumePrivilege 2444 euYdH.exe Token: SeImpersonatePrivilege 2444 euYdH.exe Token: SeCreateGlobalPrivilege 2444 euYdH.exe Token: 33 2444 euYdH.exe Token: 34 2444 euYdH.exe Token: 35 2444 euYdH.exe Token: 36 2444 euYdH.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2444 euYdH.exe -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 4816 wrote to memory of 2444 4816 JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe 88 PID 4816 wrote to memory of 2444 4816 JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe 88 PID 4816 wrote to memory of 2444 4816 JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe 88 PID 2444 wrote to memory of 1792 2444 euYdH.exe 90 PID 2444 wrote to memory of 1792 2444 euYdH.exe 90 PID 2444 wrote to memory of 1792 2444 euYdH.exe 90 PID 2444 wrote to memory of 1792 2444 euYdH.exe 90 PID 2444 wrote to memory of 1792 2444 euYdH.exe 90 PID 2444 wrote to memory of 1792 2444 euYdH.exe 90 PID 2444 wrote to memory of 1792 2444 euYdH.exe 90 PID 2444 wrote to memory of 1792 2444 euYdH.exe 90 PID 2444 wrote to memory of 1792 2444 euYdH.exe 90 PID 2444 wrote to memory of 1792 2444 euYdH.exe 90 PID 2444 wrote to memory of 1792 2444 euYdH.exe 90 PID 2444 wrote to memory of 1792 2444 euYdH.exe 90 PID 2444 wrote to memory of 1792 2444 euYdH.exe 90 PID 2444 wrote to memory of 1792 2444 euYdH.exe 90 PID 2444 wrote to memory of 1792 2444 euYdH.exe 90 PID 2444 wrote to memory of 1792 2444 euYdH.exe 90 PID 2444 wrote to memory of 1792 2444 euYdH.exe 90 PID 2444 wrote to memory of 1792 2444 euYdH.exe 90 PID 2444 wrote to memory of 1792 2444 euYdH.exe 90 PID 2444 wrote to memory of 1792 2444 euYdH.exe 90 PID 2444 wrote to memory of 1792 2444 euYdH.exe 90 PID 2444 wrote to memory of 1792 2444 euYdH.exe 90 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion euYdH.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern euYdH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" euYdH.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2ba680c520ca8588fb75db254cc0d470.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Windows\SysWOW64\IBo0S\euYdH.exe"C:\Windows\system32\IBo0S\euYdH.exe"2⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2444 -
C:\Windows\SysWOW64\notepad.exenotepad3⤵
- System Location Discovery: System Language Discovery
PID:1792
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Defense Evasion
Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Modify Registry
7Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
690KB
MD52ba680c520ca8588fb75db254cc0d470
SHA115ac9301840cd06aa0f33257126eecf23f6c1471
SHA25643ec58e9b111f2361351bb49da4ca369eda71594d491e0299665f871e79e71bd
SHA5127b1f79749cc4ec22f119eacb197842ff596071698cb18aadee8f131ca33888665298c8080b236fc472c567507c614322270906f6a01ae4b788249df6874ae16a