Analysis
-
max time kernel
148s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
28/02/2025, 20:53
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe
Resource
win10v2004-20250217-en
General
-
Target
JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe
-
Size
253KB
-
MD5
347b333924f23ed13f9da9eb7b97a130
-
SHA1
360ca7cf588fa21d701076ecb829de1ebd9315d3
-
SHA256
4e001ae37dd5550b531927aeb7afbc030322d32ae9917387caf862ea51c1da5d
-
SHA512
d5da1a4c7512b7ef78d19d33f30a0fba4d6887e8d841763c7073edeadb31708e15a36b0fdf5fb8fcc4105829557378c78d0a61f002f9ecff2a0f4d549659ab92
-
SSDEEP
6144:Rl4jPPrpF1s3SV0rK3Ab5lmlaFtL9FuJW:gjHrpF1M40uQHmlqLzu4
Malware Config
Extracted
darkcomet
Guest16
italy.no-ip.biz:1604
AbduLrhmaN-Hacker
-
InstallPath
System\kplu.exe
-
gencode
PgrSd3GMuDAJ
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
winupdater
Signatures
-
Darkcomet family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\System\\kplu.exe" JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe -
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "1" kplu.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" kplu.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile kplu.exe -
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" kplu.exe -
Windows security bypass 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" kplu.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate kplu.exe -
Executes dropped EXE 1 IoCs
pid Process 2148 kplu.exe -
Loads dropped DLL 2 IoCs
pid Process 2608 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe 2608 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe -
Windows security modification 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" kplu.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\System\\kplu.exe" JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kplu.exe -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 kplu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString kplu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier kplu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier kplu.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier kplu.exe -
Suspicious use of AdjustPrivilegeToken 50 IoCs
description pid Process Token: 33 2608 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Token: SeIncBasePriorityPrivilege 2608 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Token: SeIncreaseQuotaPrivilege 2608 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Token: SeSecurityPrivilege 2608 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Token: SeTakeOwnershipPrivilege 2608 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Token: SeLoadDriverPrivilege 2608 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Token: SeSystemProfilePrivilege 2608 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Token: SeSystemtimePrivilege 2608 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Token: SeProfSingleProcessPrivilege 2608 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Token: SeIncBasePriorityPrivilege 2608 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Token: SeCreatePagefilePrivilege 2608 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Token: SeBackupPrivilege 2608 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Token: SeRestorePrivilege 2608 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Token: SeShutdownPrivilege 2608 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Token: SeDebugPrivilege 2608 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Token: SeSystemEnvironmentPrivilege 2608 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Token: SeChangeNotifyPrivilege 2608 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Token: SeRemoteShutdownPrivilege 2608 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Token: SeUndockPrivilege 2608 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Token: SeManageVolumePrivilege 2608 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Token: SeImpersonatePrivilege 2608 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Token: SeCreateGlobalPrivilege 2608 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Token: 33 2608 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Token: 34 2608 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Token: 35 2608 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Token: 33 2148 kplu.exe Token: SeIncBasePriorityPrivilege 2148 kplu.exe Token: SeIncreaseQuotaPrivilege 2148 kplu.exe Token: SeSecurityPrivilege 2148 kplu.exe Token: SeTakeOwnershipPrivilege 2148 kplu.exe Token: SeLoadDriverPrivilege 2148 kplu.exe Token: SeSystemProfilePrivilege 2148 kplu.exe Token: SeSystemtimePrivilege 2148 kplu.exe Token: SeProfSingleProcessPrivilege 2148 kplu.exe Token: SeIncBasePriorityPrivilege 2148 kplu.exe Token: SeCreatePagefilePrivilege 2148 kplu.exe Token: SeBackupPrivilege 2148 kplu.exe Token: SeRestorePrivilege 2148 kplu.exe Token: SeShutdownPrivilege 2148 kplu.exe Token: SeDebugPrivilege 2148 kplu.exe Token: SeSystemEnvironmentPrivilege 2148 kplu.exe Token: SeChangeNotifyPrivilege 2148 kplu.exe Token: SeRemoteShutdownPrivilege 2148 kplu.exe Token: SeUndockPrivilege 2148 kplu.exe Token: SeManageVolumePrivilege 2148 kplu.exe Token: SeImpersonatePrivilege 2148 kplu.exe Token: SeCreateGlobalPrivilege 2148 kplu.exe Token: 33 2148 kplu.exe Token: 34 2148 kplu.exe Token: 35 2148 kplu.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2148 kplu.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2608 wrote to memory of 2148 2608 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe 29 PID 2608 wrote to memory of 2148 2608 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe 29 PID 2608 wrote to memory of 2148 2608 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe 29 PID 2608 wrote to memory of 2148 2608 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe"1⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\System\kplu.exe"C:\System\kplu.exe"2⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Checks BIOS information in registry
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2148
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Defense Evasion
Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
253KB
MD5347b333924f23ed13f9da9eb7b97a130
SHA1360ca7cf588fa21d701076ecb829de1ebd9315d3
SHA2564e001ae37dd5550b531927aeb7afbc030322d32ae9917387caf862ea51c1da5d
SHA512d5da1a4c7512b7ef78d19d33f30a0fba4d6887e8d841763c7073edeadb31708e15a36b0fdf5fb8fcc4105829557378c78d0a61f002f9ecff2a0f4d549659ab92