Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
08/07/2024, 22:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe
Resource
win7-20240704-en
5 signatures
150 seconds
General
-
Target
2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe
-
Size
3.3MB
-
MD5
2e08760d785ca73395fdb40af2a11df6
-
SHA1
79f554c1f6124675ba3fde9959d43d01e67775ca
-
SHA256
09c95ba487f26ff77390e9b3c677833ccd73b378d7f0e05e7bd15d568f3cf64b
-
SHA512
6845569a8203db430c184ef13daf7055cc97cb0abcdf443dbe45903b23bedccfc01a8602193a19acb9e978ef24f0b1146f5ec1f0dbe826fbe8ecd9568c4d62cb
-
SSDEEP
49152:5ls8QyAsFPgMmS4/8GbgApQg7XsWBFCxWpPamyu:5ls8KIgW4vTTZ9V/
Malware Config
Extracted
Family
darkcomet
Attributes
- gencode
-
install
false
-
offline_keylogger
false
-
persistence
false
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1292 set thread context of 2708 1292 2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe 28 -
Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2708 2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE Token: SeSecurityPrivilege 2708 2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE Token: SeTakeOwnershipPrivilege 2708 2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE Token: SeLoadDriverPrivilege 2708 2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE Token: SeSystemProfilePrivilege 2708 2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE Token: SeSystemtimePrivilege 2708 2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE Token: SeProfSingleProcessPrivilege 2708 2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE Token: SeIncBasePriorityPrivilege 2708 2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE Token: SeCreatePagefilePrivilege 2708 2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE Token: SeBackupPrivilege 2708 2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE Token: SeRestorePrivilege 2708 2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE Token: SeShutdownPrivilege 2708 2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE Token: SeDebugPrivilege 2708 2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE Token: SeSystemEnvironmentPrivilege 2708 2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE Token: SeChangeNotifyPrivilege 2708 2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE Token: SeRemoteShutdownPrivilege 2708 2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE Token: SeUndockPrivilege 2708 2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE Token: SeManageVolumePrivilege 2708 2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE Token: SeImpersonatePrivilege 2708 2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE Token: SeCreateGlobalPrivilege 2708 2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE Token: 33 2708 2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE Token: 34 2708 2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE Token: 35 2708 2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1292 2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 1292 wrote to memory of 2708 1292 2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe 28 PID 1292 wrote to memory of 2708 1292 2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe 28 PID 1292 wrote to memory of 2708 1292 2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe 28 PID 1292 wrote to memory of 2708 1292 2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe 28 PID 1292 wrote to memory of 2708 1292 2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe 28 PID 1292 wrote to memory of 2708 1292 2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe 28 PID 1292 wrote to memory of 2708 1292 2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe 28 PID 1292 wrote to memory of 2708 1292 2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe 28 PID 1292 wrote to memory of 2708 1292 2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe 28 PID 1292 wrote to memory of 2708 1292 2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe 28 PID 1292 wrote to memory of 2708 1292 2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe 28 PID 1292 wrote to memory of 2708 1292 2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe 28 PID 1292 wrote to memory of 2708 1292 2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE"C:\Users\Admin\AppData\Local\Temp\2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2708
-