Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    08/07/2024, 22:23

General

  • Target

    2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe

  • Size

    3.3MB

  • MD5

    2e08760d785ca73395fdb40af2a11df6

  • SHA1

    79f554c1f6124675ba3fde9959d43d01e67775ca

  • SHA256

    09c95ba487f26ff77390e9b3c677833ccd73b378d7f0e05e7bd15d568f3cf64b

  • SHA512

    6845569a8203db430c184ef13daf7055cc97cb0abcdf443dbe45903b23bedccfc01a8602193a19acb9e978ef24f0b1146f5ec1f0dbe826fbe8ecd9568c4d62cb

  • SSDEEP

    49152:5ls8QyAsFPgMmS4/8GbgApQg7XsWBFCxWpPamyu:5ls8KIgW4vTTZ9V/

Score
10/10

Malware Config

Extracted

Family

darkcomet

Attributes
  • gencode

  • install

    false

  • offline_keylogger

    false

  • persistence

    false

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1292
    • C:\Users\Admin\AppData\Local\Temp\2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE
      "C:\Users\Admin\AppData\Local\Temp\2e08760d785ca73395fdb40af2a11df6_JaffaCakes118.EXE"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2708-10-0x0000000000400000-0x000000000098D000-memory.dmp

    Filesize

    5.6MB

  • memory/2708-12-0x0000000000400000-0x000000000098D000-memory.dmp

    Filesize

    5.6MB

  • memory/2708-22-0x0000000000400000-0x000000000098D000-memory.dmp

    Filesize

    5.6MB

  • memory/2708-23-0x0000000000400000-0x000000000098D000-memory.dmp

    Filesize

    5.6MB

  • memory/2708-16-0x0000000000400000-0x000000000098D000-memory.dmp

    Filesize

    5.6MB

  • memory/2708-8-0x0000000000400000-0x000000000098D000-memory.dmp

    Filesize

    5.6MB

  • memory/2708-4-0x0000000000400000-0x000000000098D000-memory.dmp

    Filesize

    5.6MB

  • memory/2708-20-0x0000000000400000-0x000000000098D000-memory.dmp

    Filesize

    5.6MB

  • memory/2708-18-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2708-14-0x0000000000400000-0x000000000098D000-memory.dmp

    Filesize

    5.6MB

  • memory/2708-7-0x0000000000400000-0x000000000098D000-memory.dmp

    Filesize

    5.6MB

  • memory/2708-2-0x0000000000400000-0x000000000098D000-memory.dmp

    Filesize

    5.6MB

  • memory/2708-24-0x0000000000400000-0x000000000098D000-memory.dmp

    Filesize

    5.6MB

  • memory/2708-21-0x0000000000400000-0x000000000098D000-memory.dmp

    Filesize

    5.6MB

  • memory/2708-25-0x0000000000400000-0x000000000098D000-memory.dmp

    Filesize

    5.6MB

  • memory/2708-26-0x0000000000400000-0x000000000098D000-memory.dmp

    Filesize

    5.6MB

  • memory/2708-28-0x0000000000400000-0x000000000098D000-memory.dmp

    Filesize

    5.6MB