Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
29/03/2025, 18:47
Behavioral task
behavioral1
Sample
JaffaCakes118_92bd43f58c78a41f0b27a018bfb7f367.exe
Resource
win7-20241023-en
windows7-x64
23 signatures
150 seconds
Behavioral task
behavioral2
Sample
JaffaCakes118_92bd43f58c78a41f0b27a018bfb7f367.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
18 signatures
150 seconds
General
-
Target
JaffaCakes118_92bd43f58c78a41f0b27a018bfb7f367.exe
-
Size
271KB
-
MD5
92bd43f58c78a41f0b27a018bfb7f367
-
SHA1
8cac44f1a7f8b507baecf228a97538758b464ecf
-
SHA256
90c720c9410e1575ef1dabdf2e1640b55f123339d372589de814eb06096b47ec
-
SHA512
1142d9662ca560bc8011ddbd22f11fc2724c1e33e617a6fc74cbafc5e354180762c15426f6abbe668a9b5a40bf08c1087995bf3f6f279415e85885419458f3b3
-
SSDEEP
6144:oz+ZIja7JiVzDfdUITRilQ37imhVltGNPl4/fRq4vTBxvVjk5CKOR:oz+4KMVzDfrTRYQ3+WltCiHE4vTB3cwR
Malware Config
Extracted
Family
darkcomet
Botnet
Flyff
C2
crashmob.no-ip.biz:1090
Mutex
DC_MUTEX-W1S6CAL
Attributes
-
InstallPath
C:\Dokumente und Einstellungen\All Users\Startmen�\Programme\Autostart
-
gencode
Fd�kkey$KJxb
-
install
true
-
offline_keylogger
false
-
password
1a6c7c5de758a2e5933e962b1a5538a1bf11ba42d88e96b9d873d4eba9
-
persistence
false
-
reg_key
logon
rc4.plain
Signatures
-
Darkcomet family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\C:\\Dokumente und Einstellungen\\All Users\\Startmenü\\Programme\\Autostart" JaffaCakes118_92bd43f58c78a41f0b27a018bfb7f367.exe -
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile JaffaCakes118_92bd43f58c78a41f0b27a018bfb7f367.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "1" JaffaCakes118_92bd43f58c78a41f0b27a018bfb7f367.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" JaffaCakes118_92bd43f58c78a41f0b27a018bfb7f367.exe -
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" JaffaCakes118_92bd43f58c78a41f0b27a018bfb7f367.exe -
Windows security bypass 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" JaffaCakes118_92bd43f58c78a41f0b27a018bfb7f367.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" JaffaCakes118_92bd43f58c78a41f0b27a018bfb7f367.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" JaffaCakes118_92bd43f58c78a41f0b27a018bfb7f367.exe -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate JaffaCakes118_92bd43f58c78a41f0b27a018bfb7f367.exe -
Windows security modification 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" JaffaCakes118_92bd43f58c78a41f0b27a018bfb7f367.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" JaffaCakes118_92bd43f58c78a41f0b27a018bfb7f367.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\logon = "C:\\C:\\Dokumente und Einstellungen\\All Users\\Startmenü\\Programme\\Autostart" JaffaCakes118_92bd43f58c78a41f0b27a018bfb7f367.exe -
resource yara_rule behavioral1/memory/2320-0-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral1/memory/2320-2-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral1/memory/2320-3-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral1/memory/2320-5-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral1/memory/2320-6-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral1/memory/2320-7-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral1/memory/2320-8-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral1/memory/2320-9-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral1/memory/2320-13-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral1/memory/2320-14-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral1/memory/2320-15-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral1/memory/2320-16-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral1/memory/2320-17-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral1/memory/2320-18-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral1/memory/2320-19-0x0000000000400000-0x00000000004C7000-memory.dmp upx behavioral1/memory/2320-21-0x0000000000400000-0x00000000004C7000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_92bd43f58c78a41f0b27a018bfb7f367.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 JaffaCakes118_92bd43f58c78a41f0b27a018bfb7f367.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString JaffaCakes118_92bd43f58c78a41f0b27a018bfb7f367.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier JaffaCakes118_92bd43f58c78a41f0b27a018bfb7f367.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier JaffaCakes118_92bd43f58c78a41f0b27a018bfb7f367.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier JaffaCakes118_92bd43f58c78a41f0b27a018bfb7f367.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe -
NTFS ADS 3 IoCs
description ioc Process File created C:\C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart JaffaCakes118_92bd43f58c78a41f0b27a018bfb7f367.exe File opened for modification C:\C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart JaffaCakes118_92bd43f58c78a41f0b27a018bfb7f367.exe File opened for modification C:\C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\ JaffaCakes118_92bd43f58c78a41f0b27a018bfb7f367.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 2320 JaffaCakes118_92bd43f58c78a41f0b27a018bfb7f367.exe 292 explorer.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2320 JaffaCakes118_92bd43f58c78a41f0b27a018bfb7f367.exe Token: SeSecurityPrivilege 2320 JaffaCakes118_92bd43f58c78a41f0b27a018bfb7f367.exe Token: SeTakeOwnershipPrivilege 2320 JaffaCakes118_92bd43f58c78a41f0b27a018bfb7f367.exe Token: SeLoadDriverPrivilege 2320 JaffaCakes118_92bd43f58c78a41f0b27a018bfb7f367.exe Token: SeSystemProfilePrivilege 2320 JaffaCakes118_92bd43f58c78a41f0b27a018bfb7f367.exe Token: SeSystemtimePrivilege 2320 JaffaCakes118_92bd43f58c78a41f0b27a018bfb7f367.exe Token: SeProfSingleProcessPrivilege 2320 JaffaCakes118_92bd43f58c78a41f0b27a018bfb7f367.exe Token: SeIncBasePriorityPrivilege 2320 JaffaCakes118_92bd43f58c78a41f0b27a018bfb7f367.exe Token: SeCreatePagefilePrivilege 2320 JaffaCakes118_92bd43f58c78a41f0b27a018bfb7f367.exe Token: SeBackupPrivilege 2320 JaffaCakes118_92bd43f58c78a41f0b27a018bfb7f367.exe Token: SeRestorePrivilege 2320 JaffaCakes118_92bd43f58c78a41f0b27a018bfb7f367.exe Token: SeShutdownPrivilege 2320 JaffaCakes118_92bd43f58c78a41f0b27a018bfb7f367.exe Token: SeDebugPrivilege 2320 JaffaCakes118_92bd43f58c78a41f0b27a018bfb7f367.exe Token: SeSystemEnvironmentPrivilege 2320 JaffaCakes118_92bd43f58c78a41f0b27a018bfb7f367.exe Token: SeChangeNotifyPrivilege 2320 JaffaCakes118_92bd43f58c78a41f0b27a018bfb7f367.exe Token: SeRemoteShutdownPrivilege 2320 JaffaCakes118_92bd43f58c78a41f0b27a018bfb7f367.exe Token: SeUndockPrivilege 2320 JaffaCakes118_92bd43f58c78a41f0b27a018bfb7f367.exe Token: SeManageVolumePrivilege 2320 JaffaCakes118_92bd43f58c78a41f0b27a018bfb7f367.exe Token: SeImpersonatePrivilege 2320 JaffaCakes118_92bd43f58c78a41f0b27a018bfb7f367.exe Token: SeCreateGlobalPrivilege 2320 JaffaCakes118_92bd43f58c78a41f0b27a018bfb7f367.exe Token: 33 2320 JaffaCakes118_92bd43f58c78a41f0b27a018bfb7f367.exe Token: 34 2320 JaffaCakes118_92bd43f58c78a41f0b27a018bfb7f367.exe Token: 35 2320 JaffaCakes118_92bd43f58c78a41f0b27a018bfb7f367.exe Token: SeShutdownPrivilege 292 explorer.exe Token: SeShutdownPrivilege 292 explorer.exe Token: SeShutdownPrivilege 292 explorer.exe Token: SeShutdownPrivilege 292 explorer.exe Token: SeShutdownPrivilege 292 explorer.exe Token: SeShutdownPrivilege 292 explorer.exe Token: SeShutdownPrivilege 292 explorer.exe Token: SeShutdownPrivilege 292 explorer.exe Token: SeShutdownPrivilege 292 explorer.exe Token: SeShutdownPrivilege 292 explorer.exe Token: SeShutdownPrivilege 292 explorer.exe Token: SeShutdownPrivilege 292 explorer.exe -
Suspicious use of FindShellTrayWindow 29 IoCs
pid Process 292 explorer.exe 292 explorer.exe 292 explorer.exe 292 explorer.exe 292 explorer.exe 292 explorer.exe 292 explorer.exe 292 explorer.exe 292 explorer.exe 292 explorer.exe 292 explorer.exe 292 explorer.exe 292 explorer.exe 292 explorer.exe 292 explorer.exe 292 explorer.exe 292 explorer.exe 292 explorer.exe 292 explorer.exe 292 explorer.exe 292 explorer.exe 292 explorer.exe 292 explorer.exe 292 explorer.exe 292 explorer.exe 292 explorer.exe 292 explorer.exe 292 explorer.exe 292 explorer.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 292 explorer.exe 292 explorer.exe 292 explorer.exe 292 explorer.exe 292 explorer.exe 292 explorer.exe 292 explorer.exe 292 explorer.exe 292 explorer.exe 292 explorer.exe 292 explorer.exe 292 explorer.exe 292 explorer.exe 292 explorer.exe 292 explorer.exe 292 explorer.exe 292 explorer.exe 292 explorer.exe -
System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion JaffaCakes118_92bd43f58c78a41f0b27a018bfb7f367.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern JaffaCakes118_92bd43f58c78a41f0b27a018bfb7f367.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" JaffaCakes118_92bd43f58c78a41f0b27a018bfb7f367.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_92bd43f58c78a41f0b27a018bfb7f367.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_92bd43f58c78a41f0b27a018bfb7f367.exe"1⤵
- Modifies WinLogon for persistence
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Checks BIOS information in registry
- Windows security modification
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2320
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:292
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Defense Evasion
Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Modify Registry
8