Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
28/02/2025, 20:53
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe
Resource
win10v2004-20250217-en
General
-
Target
JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe
-
Size
253KB
-
MD5
347b333924f23ed13f9da9eb7b97a130
-
SHA1
360ca7cf588fa21d701076ecb829de1ebd9315d3
-
SHA256
4e001ae37dd5550b531927aeb7afbc030322d32ae9917387caf862ea51c1da5d
-
SHA512
d5da1a4c7512b7ef78d19d33f30a0fba4d6887e8d841763c7073edeadb31708e15a36b0fdf5fb8fcc4105829557378c78d0a61f002f9ecff2a0f4d549659ab92
-
SSDEEP
6144:Rl4jPPrpF1s3SV0rK3Ab5lmlaFtL9FuJW:gjHrpF1M40uQHmlqLzu4
Malware Config
Extracted
darkcomet
Guest16
italy.no-ip.biz:1604
AbduLrhmaN-Hacker
-
InstallPath
System\kplu.exe
-
gencode
PgrSd3GMuDAJ
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
winupdater
Signatures
-
Darkcomet family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\System\\kplu.exe" JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe -
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "1" kplu.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" kplu.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile kplu.exe -
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" kplu.exe -
Windows security bypass 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" kplu.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate kplu.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Control Panel\International\Geo\Nation JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe -
Executes dropped EXE 1 IoCs
pid Process 4992 kplu.exe -
Windows security modification 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" kplu.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\System\\kplu.exe" JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kplu.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 kplu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString kplu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier kplu.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier kplu.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier kplu.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe -
Suspicious use of AdjustPrivilegeToken 52 IoCs
description pid Process Token: 33 892 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Token: SeIncBasePriorityPrivilege 892 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Token: SeIncreaseQuotaPrivilege 892 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Token: SeSecurityPrivilege 892 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Token: SeTakeOwnershipPrivilege 892 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Token: SeLoadDriverPrivilege 892 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Token: SeSystemProfilePrivilege 892 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Token: SeSystemtimePrivilege 892 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Token: SeProfSingleProcessPrivilege 892 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Token: SeIncBasePriorityPrivilege 892 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Token: SeCreatePagefilePrivilege 892 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Token: SeBackupPrivilege 892 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Token: SeRestorePrivilege 892 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Token: SeShutdownPrivilege 892 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Token: SeDebugPrivilege 892 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Token: SeSystemEnvironmentPrivilege 892 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Token: SeChangeNotifyPrivilege 892 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Token: SeRemoteShutdownPrivilege 892 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Token: SeUndockPrivilege 892 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Token: SeManageVolumePrivilege 892 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Token: SeImpersonatePrivilege 892 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Token: SeCreateGlobalPrivilege 892 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Token: 33 892 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Token: 34 892 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Token: 35 892 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Token: 36 892 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe Token: 33 4992 kplu.exe Token: SeIncBasePriorityPrivilege 4992 kplu.exe Token: SeIncreaseQuotaPrivilege 4992 kplu.exe Token: SeSecurityPrivilege 4992 kplu.exe Token: SeTakeOwnershipPrivilege 4992 kplu.exe Token: SeLoadDriverPrivilege 4992 kplu.exe Token: SeSystemProfilePrivilege 4992 kplu.exe Token: SeSystemtimePrivilege 4992 kplu.exe Token: SeProfSingleProcessPrivilege 4992 kplu.exe Token: SeIncBasePriorityPrivilege 4992 kplu.exe Token: SeCreatePagefilePrivilege 4992 kplu.exe Token: SeBackupPrivilege 4992 kplu.exe Token: SeRestorePrivilege 4992 kplu.exe Token: SeShutdownPrivilege 4992 kplu.exe Token: SeDebugPrivilege 4992 kplu.exe Token: SeSystemEnvironmentPrivilege 4992 kplu.exe Token: SeChangeNotifyPrivilege 4992 kplu.exe Token: SeRemoteShutdownPrivilege 4992 kplu.exe Token: SeUndockPrivilege 4992 kplu.exe Token: SeManageVolumePrivilege 4992 kplu.exe Token: SeImpersonatePrivilege 4992 kplu.exe Token: SeCreateGlobalPrivilege 4992 kplu.exe Token: 33 4992 kplu.exe Token: 34 4992 kplu.exe Token: 35 4992 kplu.exe Token: 36 4992 kplu.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4992 kplu.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 892 wrote to memory of 4992 892 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe 88 PID 892 wrote to memory of 4992 892 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe 88 PID 892 wrote to memory of 4992 892 JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_347b333924f23ed13f9da9eb7b97a130.exe"1⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:892 -
C:\System\kplu.exe"C:\System\kplu.exe"2⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Checks BIOS information in registry
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4992
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Defense Evasion
Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
253KB
MD5347b333924f23ed13f9da9eb7b97a130
SHA1360ca7cf588fa21d701076ecb829de1ebd9315d3
SHA2564e001ae37dd5550b531927aeb7afbc030322d32ae9917387caf862ea51c1da5d
SHA512d5da1a4c7512b7ef78d19d33f30a0fba4d6887e8d841763c7073edeadb31708e15a36b0fdf5fb8fcc4105829557378c78d0a61f002f9ecff2a0f4d549659ab92