Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
16/03/2025, 18:28
Behavioral task
behavioral1
Sample
JaffaCakes118_7b48b4e633304c78ddda3457eb050e5d.exe
Resource
win7-20241010-en
windows7-x64
13 signatures
150 seconds
General
-
Target
JaffaCakes118_7b48b4e633304c78ddda3457eb050e5d.exe
-
Size
233KB
-
MD5
7b48b4e633304c78ddda3457eb050e5d
-
SHA1
dfe210e81f3a5a2f90946768454ab1b67de8d052
-
SHA256
6245fb1e910ebb1907076cc70d35c9de45a9554470459a7763536ece4f7088ec
-
SHA512
ec3afd57a1d0aa159813987f82a20aeca6336b8ee7cf98c851d2e7a14d0d676ee803072d407f632d9b9e9450b3af843af725bd0697828bda821431e4a49996a7
-
SSDEEP
6144:54CFfifD2gVKVTQQ249HZ52KTh9XKOCgLJacj5/AZtRsL:5Xgr8VMQDT52WXKq9fj5/AZjU
Malware Config
Extracted
Family
darkcomet
Botnet
Guest16
C2
snarglozog.zapto.org:32897
Mutex
DC_MUTEX-SVHWYMW
Attributes
-
InstallPath
sys\sysupdt.exe
-
gencode
swn6qBbDLcVC
-
install
true
-
offline_keylogger
false
-
password
pauls0212
-
persistence
true
-
reg_key
sysupdt
rc4.plain
Signatures
-
Darkcomet family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\sys\\sysupdt.exe" JaffaCakes118_7b48b4e633304c78ddda3457eb050e5d.exe -
Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate JaffaCakes118_7b48b4e633304c78ddda3457eb050e5d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate sysupdt.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate explorer.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation JaffaCakes118_7b48b4e633304c78ddda3457eb050e5d.exe -
Executes dropped EXE 1 IoCs
pid Process 1188 sysupdt.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysupdt = "C:\\Users\\Admin\\AppData\\Roaming\\sys\\sysupdt.exe" JaffaCakes118_7b48b4e633304c78ddda3457eb050e5d.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1188 set thread context of 3168 1188 sysupdt.exe 90 -
resource yara_rule behavioral2/memory/4380-0-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/files/0x00080000000242f9-6.dat upx behavioral2/memory/4380-35-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3168-37-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3168-38-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1188-41-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3168-43-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3168-42-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3168-44-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3168-39-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3168-46-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3168-47-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3168-45-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3168-48-0x0000000000400000-0x00000000004B5000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_7b48b4e633304c78ddda3457eb050e5d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysupdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe -
Checks processor information in registry 2 TTPs 12 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString JaffaCakes118_7b48b4e633304c78ddda3457eb050e5d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier JaffaCakes118_7b48b4e633304c78ddda3457eb050e5d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier sysupdt.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 JaffaCakes118_7b48b4e633304c78ddda3457eb050e5d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier JaffaCakes118_7b48b4e633304c78ddda3457eb050e5d.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 sysupdt.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString sysupdt.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier sysupdt.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier JaffaCakes118_7b48b4e633304c78ddda3457eb050e5d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier sysupdt.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier explorer.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ JaffaCakes118_7b48b4e633304c78ddda3457eb050e5d.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4380 JaffaCakes118_7b48b4e633304c78ddda3457eb050e5d.exe Token: SeSecurityPrivilege 4380 JaffaCakes118_7b48b4e633304c78ddda3457eb050e5d.exe Token: SeTakeOwnershipPrivilege 4380 JaffaCakes118_7b48b4e633304c78ddda3457eb050e5d.exe Token: SeLoadDriverPrivilege 4380 JaffaCakes118_7b48b4e633304c78ddda3457eb050e5d.exe Token: SeSystemProfilePrivilege 4380 JaffaCakes118_7b48b4e633304c78ddda3457eb050e5d.exe Token: SeSystemtimePrivilege 4380 JaffaCakes118_7b48b4e633304c78ddda3457eb050e5d.exe Token: SeProfSingleProcessPrivilege 4380 JaffaCakes118_7b48b4e633304c78ddda3457eb050e5d.exe Token: SeIncBasePriorityPrivilege 4380 JaffaCakes118_7b48b4e633304c78ddda3457eb050e5d.exe Token: SeCreatePagefilePrivilege 4380 JaffaCakes118_7b48b4e633304c78ddda3457eb050e5d.exe Token: SeBackupPrivilege 4380 JaffaCakes118_7b48b4e633304c78ddda3457eb050e5d.exe Token: SeRestorePrivilege 4380 JaffaCakes118_7b48b4e633304c78ddda3457eb050e5d.exe Token: SeShutdownPrivilege 4380 JaffaCakes118_7b48b4e633304c78ddda3457eb050e5d.exe Token: SeDebugPrivilege 4380 JaffaCakes118_7b48b4e633304c78ddda3457eb050e5d.exe Token: SeSystemEnvironmentPrivilege 4380 JaffaCakes118_7b48b4e633304c78ddda3457eb050e5d.exe Token: SeChangeNotifyPrivilege 4380 JaffaCakes118_7b48b4e633304c78ddda3457eb050e5d.exe Token: SeRemoteShutdownPrivilege 4380 JaffaCakes118_7b48b4e633304c78ddda3457eb050e5d.exe Token: SeUndockPrivilege 4380 JaffaCakes118_7b48b4e633304c78ddda3457eb050e5d.exe Token: SeManageVolumePrivilege 4380 JaffaCakes118_7b48b4e633304c78ddda3457eb050e5d.exe Token: SeImpersonatePrivilege 4380 JaffaCakes118_7b48b4e633304c78ddda3457eb050e5d.exe Token: SeCreateGlobalPrivilege 4380 JaffaCakes118_7b48b4e633304c78ddda3457eb050e5d.exe Token: 33 4380 JaffaCakes118_7b48b4e633304c78ddda3457eb050e5d.exe Token: 34 4380 JaffaCakes118_7b48b4e633304c78ddda3457eb050e5d.exe Token: 35 4380 JaffaCakes118_7b48b4e633304c78ddda3457eb050e5d.exe Token: 36 4380 JaffaCakes118_7b48b4e633304c78ddda3457eb050e5d.exe Token: SeIncreaseQuotaPrivilege 1188 sysupdt.exe Token: SeSecurityPrivilege 1188 sysupdt.exe Token: SeTakeOwnershipPrivilege 1188 sysupdt.exe Token: SeLoadDriverPrivilege 1188 sysupdt.exe Token: SeSystemProfilePrivilege 1188 sysupdt.exe Token: SeSystemtimePrivilege 1188 sysupdt.exe Token: SeProfSingleProcessPrivilege 1188 sysupdt.exe Token: SeIncBasePriorityPrivilege 1188 sysupdt.exe Token: SeCreatePagefilePrivilege 1188 sysupdt.exe Token: SeBackupPrivilege 1188 sysupdt.exe Token: SeRestorePrivilege 1188 sysupdt.exe Token: SeShutdownPrivilege 1188 sysupdt.exe Token: SeDebugPrivilege 1188 sysupdt.exe Token: SeSystemEnvironmentPrivilege 1188 sysupdt.exe Token: SeChangeNotifyPrivilege 1188 sysupdt.exe Token: SeRemoteShutdownPrivilege 1188 sysupdt.exe Token: SeUndockPrivilege 1188 sysupdt.exe Token: SeManageVolumePrivilege 1188 sysupdt.exe Token: SeImpersonatePrivilege 1188 sysupdt.exe Token: SeCreateGlobalPrivilege 1188 sysupdt.exe Token: 33 1188 sysupdt.exe Token: 34 1188 sysupdt.exe Token: 35 1188 sysupdt.exe Token: 36 1188 sysupdt.exe Token: SeIncreaseQuotaPrivilege 3168 explorer.exe Token: SeSecurityPrivilege 3168 explorer.exe Token: SeTakeOwnershipPrivilege 3168 explorer.exe Token: SeLoadDriverPrivilege 3168 explorer.exe Token: SeSystemProfilePrivilege 3168 explorer.exe Token: SeSystemtimePrivilege 3168 explorer.exe Token: SeProfSingleProcessPrivilege 3168 explorer.exe Token: SeIncBasePriorityPrivilege 3168 explorer.exe Token: SeCreatePagefilePrivilege 3168 explorer.exe Token: SeBackupPrivilege 3168 explorer.exe Token: SeRestorePrivilege 3168 explorer.exe Token: SeShutdownPrivilege 3168 explorer.exe Token: SeDebugPrivilege 3168 explorer.exe Token: SeSystemEnvironmentPrivilege 3168 explorer.exe Token: SeChangeNotifyPrivilege 3168 explorer.exe Token: SeRemoteShutdownPrivilege 3168 explorer.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 4380 wrote to memory of 3016 4380 JaffaCakes118_7b48b4e633304c78ddda3457eb050e5d.exe 86 PID 4380 wrote to memory of 3016 4380 JaffaCakes118_7b48b4e633304c78ddda3457eb050e5d.exe 86 PID 4380 wrote to memory of 3016 4380 JaffaCakes118_7b48b4e633304c78ddda3457eb050e5d.exe 86 PID 4380 wrote to memory of 1188 4380 JaffaCakes118_7b48b4e633304c78ddda3457eb050e5d.exe 89 PID 4380 wrote to memory of 1188 4380 JaffaCakes118_7b48b4e633304c78ddda3457eb050e5d.exe 89 PID 4380 wrote to memory of 1188 4380 JaffaCakes118_7b48b4e633304c78ddda3457eb050e5d.exe 89 PID 1188 wrote to memory of 3168 1188 sysupdt.exe 90 PID 1188 wrote to memory of 3168 1188 sysupdt.exe 90 PID 1188 wrote to memory of 3168 1188 sysupdt.exe 90 PID 1188 wrote to memory of 3168 1188 sysupdt.exe 90 PID 1188 wrote to memory of 3168 1188 sysupdt.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7b48b4e633304c78ddda3457eb050e5d.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7b48b4e633304c78ddda3457eb050e5d.exe"1⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵PID:3016
-
-
C:\Users\Admin\AppData\Roaming\sys\sysupdt.exe"C:\Users\Admin\AppData\Roaming\sys\sysupdt.exe"2⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"3⤵
- Checks BIOS information in registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:3168
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
233KB
MD57b48b4e633304c78ddda3457eb050e5d
SHA1dfe210e81f3a5a2f90946768454ab1b67de8d052
SHA2566245fb1e910ebb1907076cc70d35c9de45a9554470459a7763536ece4f7088ec
SHA512ec3afd57a1d0aa159813987f82a20aeca6336b8ee7cf98c851d2e7a14d0d676ee803072d407f632d9b9e9450b3af843af725bd0697828bda821431e4a49996a7