Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
10/07/2024, 08:02
General
-
Target
33e668568255b8de07e1ba5a34bbada3_JaffaCakes118.exe
-
Size
235KB
-
MD5
33e668568255b8de07e1ba5a34bbada3
-
SHA1
6c4ad7fe066e1b2bd8a3ebf5375875ae93f67fcf
-
SHA256
b63fdf28be1287aaadba09faec135752abbd6d24b3a7b2b19d8553e52a4e4e2c
-
SHA512
15a0b02d44c5e7b2b45c59fe7ebf5c82d2b812fe2344953b42c151921ac117bc22ecc7fa3710e3ce9becce52852b6e94831074261524a4bc1c4537009ab3beb5
-
SSDEEP
6144:WmDUj24gqU85IzrFA9NfmDuLpNr5NhWudrWDh7:WqUj2LkizrzDujVNhWucDJ
Malware Config
Extracted
darkcomet
xwz
kuider.dyndns-at-home.com:1604
DC_MUTEX-B218V5W
-
gencode
9nEcALkkhAmM
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\33e668568255b8de07e1ba5a34bbada3_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\33e668568255b8de07e1ba5a34bbada3_JaffaCakes118.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
736KB
-
Filesize
4KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB
-
Filesize
736KB