Analysis
-
max time kernel
134s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
29/03/2025, 20:25
Behavioral task
behavioral1
Sample
JaffaCakes118_97fa35487115e8da157cdc4dad881ae0.exe
Resource
win7-20241010-en
windows7-x64
16 signatures
150 seconds
General
-
Target
JaffaCakes118_97fa35487115e8da157cdc4dad881ae0.exe
-
Size
754KB
-
MD5
97fa35487115e8da157cdc4dad881ae0
-
SHA1
16e3b24c4683f215bf7379736c023ee5ff69513f
-
SHA256
88e456c8868b446aa5eef3be893e0c842eeda9e2a888b9a2a3d343048caf8772
-
SHA512
026e9bebd5bf473b3c2fc204b2405392f76f05a9379bf279baa6f9647e6c3980141a84163acda5b51ac53ade89cf2e76ae3b1bb7719e151b7d91e0c7d0c169e4
-
SSDEEP
12288:5aAchpWsuVtDnBsBDJIcynnC90levX4CuYf2D82T3s99+VHuNK3oK:UAEE3uBDhynCylQgi63O9+VuN
Malware Config
Extracted
Family
darkcomet
Botnet
Default
C2
w-394.no-ip.biz:81
Mutex
���� ���
Attributes
-
InstallPath
System\boys.exe
-
gencode
E�1odsU�4RC6
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
winupdater
rc4.plain
Signatures
-
Darkcomet family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\\\System\\boys.exe" JaffaCakes118_97fa35487115e8da157cdc4dad881ae0.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate JaffaCakes118_97fa35487115e8da157cdc4dad881ae0.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\\\System\\boys.exe" JaffaCakes118_97fa35487115e8da157cdc4dad881ae0.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\System\boys.exe JaffaCakes118_97fa35487115e8da157cdc4dad881ae0.exe File opened for modification C:\Windows\System\boys.exe JaffaCakes118_97fa35487115e8da157cdc4dad881ae0.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_97fa35487115e8da157cdc4dad881ae0.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier JaffaCakes118_97fa35487115e8da157cdc4dad881ae0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier JaffaCakes118_97fa35487115e8da157cdc4dad881ae0.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 JaffaCakes118_97fa35487115e8da157cdc4dad881ae0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString JaffaCakes118_97fa35487115e8da157cdc4dad881ae0.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier JaffaCakes118_97fa35487115e8da157cdc4dad881ae0.exe -
Modifies registry class 5 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2176 explorer.exe -
Suspicious use of AdjustPrivilegeToken 39 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2608 JaffaCakes118_97fa35487115e8da157cdc4dad881ae0.exe Token: SeSecurityPrivilege 2608 JaffaCakes118_97fa35487115e8da157cdc4dad881ae0.exe Token: SeTakeOwnershipPrivilege 2608 JaffaCakes118_97fa35487115e8da157cdc4dad881ae0.exe Token: SeLoadDriverPrivilege 2608 JaffaCakes118_97fa35487115e8da157cdc4dad881ae0.exe Token: SeSystemProfilePrivilege 2608 JaffaCakes118_97fa35487115e8da157cdc4dad881ae0.exe Token: SeSystemtimePrivilege 2608 JaffaCakes118_97fa35487115e8da157cdc4dad881ae0.exe Token: SeProfSingleProcessPrivilege 2608 JaffaCakes118_97fa35487115e8da157cdc4dad881ae0.exe Token: SeIncBasePriorityPrivilege 2608 JaffaCakes118_97fa35487115e8da157cdc4dad881ae0.exe Token: SeCreatePagefilePrivilege 2608 JaffaCakes118_97fa35487115e8da157cdc4dad881ae0.exe Token: SeBackupPrivilege 2608 JaffaCakes118_97fa35487115e8da157cdc4dad881ae0.exe Token: SeRestorePrivilege 2608 JaffaCakes118_97fa35487115e8da157cdc4dad881ae0.exe Token: SeShutdownPrivilege 2608 JaffaCakes118_97fa35487115e8da157cdc4dad881ae0.exe Token: SeDebugPrivilege 2608 JaffaCakes118_97fa35487115e8da157cdc4dad881ae0.exe Token: SeSystemEnvironmentPrivilege 2608 JaffaCakes118_97fa35487115e8da157cdc4dad881ae0.exe Token: SeChangeNotifyPrivilege 2608 JaffaCakes118_97fa35487115e8da157cdc4dad881ae0.exe Token: SeRemoteShutdownPrivilege 2608 JaffaCakes118_97fa35487115e8da157cdc4dad881ae0.exe Token: SeUndockPrivilege 2608 JaffaCakes118_97fa35487115e8da157cdc4dad881ae0.exe Token: SeManageVolumePrivilege 2608 JaffaCakes118_97fa35487115e8da157cdc4dad881ae0.exe Token: SeImpersonatePrivilege 2608 JaffaCakes118_97fa35487115e8da157cdc4dad881ae0.exe Token: SeCreateGlobalPrivilege 2608 JaffaCakes118_97fa35487115e8da157cdc4dad881ae0.exe Token: 33 2608 JaffaCakes118_97fa35487115e8da157cdc4dad881ae0.exe Token: 34 2608 JaffaCakes118_97fa35487115e8da157cdc4dad881ae0.exe Token: 35 2608 JaffaCakes118_97fa35487115e8da157cdc4dad881ae0.exe Token: SeShutdownPrivilege 2176 explorer.exe Token: SeShutdownPrivilege 2176 explorer.exe Token: SeShutdownPrivilege 2176 explorer.exe Token: SeShutdownPrivilege 2176 explorer.exe Token: SeShutdownPrivilege 2176 explorer.exe Token: SeShutdownPrivilege 2176 explorer.exe Token: SeShutdownPrivilege 2176 explorer.exe Token: SeShutdownPrivilege 2176 explorer.exe Token: SeShutdownPrivilege 2176 explorer.exe Token: SeShutdownPrivilege 2176 explorer.exe Token: 33 2816 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2816 AUDIODG.EXE Token: 33 2816 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2816 AUDIODG.EXE Token: SeShutdownPrivilege 2176 explorer.exe Token: SeShutdownPrivilege 2176 explorer.exe -
Suspicious use of FindShellTrayWindow 28 IoCs
pid Process 2176 explorer.exe 2176 explorer.exe 2176 explorer.exe 2176 explorer.exe 2176 explorer.exe 2176 explorer.exe 2176 explorer.exe 2176 explorer.exe 2176 explorer.exe 2176 explorer.exe 2176 explorer.exe 2176 explorer.exe 2176 explorer.exe 2176 explorer.exe 2176 explorer.exe 2176 explorer.exe 2176 explorer.exe 2176 explorer.exe 2176 explorer.exe 2176 explorer.exe 2176 explorer.exe 2176 explorer.exe 2176 explorer.exe 2176 explorer.exe 2176 explorer.exe 2176 explorer.exe 2176 explorer.exe 2176 explorer.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 2176 explorer.exe 2176 explorer.exe 2176 explorer.exe 2176 explorer.exe 2176 explorer.exe 2176 explorer.exe 2176 explorer.exe 2176 explorer.exe 2176 explorer.exe 2176 explorer.exe 2176 explorer.exe 2176 explorer.exe 2176 explorer.exe 2176 explorer.exe 2176 explorer.exe 2176 explorer.exe 2176 explorer.exe 2176 explorer.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_97fa35487115e8da157cdc4dad881ae0.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_97fa35487115e8da157cdc4dad881ae0.exe"1⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:2608
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2176
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5ac1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2816
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1