Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    000406bb03366b4744852f4bac0f383c_JaffaCakes118

  • Size

    636KB

  • Sample

    240619-xcx6fs1dkj

  • MD5

    000406bb03366b4744852f4bac0f383c

  • SHA1

    ad761bf48d747d4293d24ad43a621f526b0906b3

  • SHA256

    8cb7b1f28da387aa0a88d4b3b4005a6497dbd244b730b8d6f0ef78e882bc6a34

  • SHA512

    1aa215cfa5b8324e18958234dc9364fc866b114ff35a11f7f65608bd495845f8ce137b8847a318ce9269e9c0a4bea0aad900df7ef097b47fed44fed02d92b8f4

  • SSDEEP

    12288:/pwABK90BOe/x9lPAYvxPQVjdsAY2XjWlnlpTMMXG91uhKIXn/t:xwAcu99lPzvxP+Bsz2XjWTRMQckkIXnF

Malware Config

Targets

    • Target

      000406bb03366b4744852f4bac0f383c_JaffaCakes118

    • Size

      636KB

    • MD5

      000406bb03366b4744852f4bac0f383c

    • SHA1

      ad761bf48d747d4293d24ad43a621f526b0906b3

    • SHA256

      8cb7b1f28da387aa0a88d4b3b4005a6497dbd244b730b8d6f0ef78e882bc6a34

    • SHA512

      1aa215cfa5b8324e18958234dc9364fc866b114ff35a11f7f65608bd495845f8ce137b8847a318ce9269e9c0a4bea0aad900df7ef097b47fed44fed02d92b8f4

    • SSDEEP

      12288:/pwABK90BOe/x9lPAYvxPQVjdsAY2XjWlnlpTMMXG91uhKIXn/t:xwAcu99lPzvxP+Bsz2XjWTRMQckkIXnF

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Modifies WinLogon for persistence

    • Modifies firewall policy service

    • Modifies security service

    • Windows security bypass

    • Disables RegEdit via registry modification

    • Disables Task Manager via registry modification

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks