Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    28s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    10/07/2024, 09:13

General

  • Target

    341b77aef07a6db7a0a4435d14f116fe_JaffaCakes118.exe

  • Size

    692KB

  • MD5

    341b77aef07a6db7a0a4435d14f116fe

  • SHA1

    8aa6a8878963ee3cf88a0dcd4b6c319f4dd41935

  • SHA256

    4052813833a832623f0954f57ddc69290c9444ad1d58fb634531dc36dc3bb92c

  • SHA512

    37e83bfe6fe0e12984e8caf8dc4ec16f27e623c1734a2530608725cc39227f0fece374471144a40d24b7ec6529b71fb44858806169b619b46bc0453501c649d1

  • SSDEEP

    12288:yYhVRuOgn9xe/ZYjQ8Sme0uAnGj97gLfjYnIqZJ9XaXCIdjLaxWQnM82:3R4n9xs2c0Nw0XxqZzQpxeA

Malware Config

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 60 IoCs
  • Suspicious use of AdjustPrivilegeToken 26 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\341b77aef07a6db7a0a4435d14f116fe_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\341b77aef07a6db7a0a4435d14f116fe_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1708
    • C:\Users\Admin\AppData\Local\Temp\341b77aef07a6db7a0a4435d14f116fe_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\Temp\341b77aef07a6db7a0a4435d14f116fe_JaffaCakes118.exe
      2⤵
        PID:1744
      • C:\Users\Admin\AppData\Local\Temp\System\audioadg.exe
        C:\Users\Admin\AppData\Local\Temp\System\audioadg.exe
        2⤵
        • Adds policy Run key to start application
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1160
        • C:\Users\Admin\AppData\Local\Temp\System\Wmiprwsd.exe
          C:\Users\Admin\AppData\Local\Temp\System\Wmiprwsd.exe
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2504
          • C:\Users\Admin\AppData\Local\Temp\System\Wmiprwsd.exe
            C:\Users\Admin\AppData\Local\Temp\System\Wmiprwsd.exe
            4⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:2220

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\System\Wmiprwsd.exe

      Filesize

      692KB

      MD5

      341b77aef07a6db7a0a4435d14f116fe

      SHA1

      8aa6a8878963ee3cf88a0dcd4b6c319f4dd41935

      SHA256

      4052813833a832623f0954f57ddc69290c9444ad1d58fb634531dc36dc3bb92c

      SHA512

      37e83bfe6fe0e12984e8caf8dc4ec16f27e623c1734a2530608725cc39227f0fece374471144a40d24b7ec6529b71fb44858806169b619b46bc0453501c649d1

    • \Users\Admin\AppData\Local\Temp\System\audioadg.exe

      Filesize

      8KB

      MD5

      6ac73d462625d27d9f0f599ca1190dea

      SHA1

      746cbcaf898421e361baa72ac5400d6e5d6ef732

      SHA256

      fa35e4d655c8d1eefd9d4bacab0f6d932bd061e23c49503af747161248307f0c

      SHA512

      5789644e331955e2363fd45e45a49bb4266b01ab772d503a8324e4d126ddb2e244297462030a4c63c0088551ef6cac94fa460e4f7ce9f844757afdca4a5d4601

    • memory/1160-14-0x0000000074C50000-0x00000000751FB000-memory.dmp

      Filesize

      5.7MB

    • memory/1160-15-0x0000000074C50000-0x00000000751FB000-memory.dmp

      Filesize

      5.7MB

    • memory/1160-43-0x0000000074C50000-0x00000000751FB000-memory.dmp

      Filesize

      5.7MB

    • memory/1708-0-0x0000000074C51000-0x0000000074C52000-memory.dmp

      Filesize

      4KB

    • memory/1708-1-0x0000000074C50000-0x00000000751FB000-memory.dmp

      Filesize

      5.7MB

    • memory/1708-2-0x0000000074C50000-0x00000000751FB000-memory.dmp

      Filesize

      5.7MB

    • memory/1708-42-0x0000000074C50000-0x00000000751FB000-memory.dmp

      Filesize

      5.7MB

    • memory/1708-41-0x0000000074C50000-0x00000000751FB000-memory.dmp

      Filesize

      5.7MB

    • memory/2220-37-0x0000000000400000-0x00000000004B3000-memory.dmp

      Filesize

      716KB

    • memory/2220-30-0x0000000000400000-0x00000000004B3000-memory.dmp

      Filesize

      716KB

    • memory/2220-31-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2220-29-0x0000000000400000-0x00000000004B3000-memory.dmp

      Filesize

      716KB

    • memory/2220-27-0x0000000000400000-0x00000000004B3000-memory.dmp

      Filesize

      716KB

    • memory/2220-28-0x0000000000400000-0x00000000004B3000-memory.dmp

      Filesize

      716KB

    • memory/2220-25-0x0000000000400000-0x00000000004B3000-memory.dmp

      Filesize

      716KB

    • memory/2220-23-0x0000000000400000-0x00000000004B3000-memory.dmp

      Filesize

      716KB

    • memory/2220-21-0x0000000000400000-0x00000000004B3000-memory.dmp

      Filesize

      716KB

    • memory/2220-33-0x0000000000400000-0x00000000004B3000-memory.dmp

      Filesize

      716KB

    • memory/2220-36-0x0000000000400000-0x00000000004B3000-memory.dmp

      Filesize

      716KB

    • memory/2220-35-0x0000000000400000-0x00000000004B3000-memory.dmp

      Filesize

      716KB

    • memory/2220-39-0x0000000000400000-0x00000000004B3000-memory.dmp

      Filesize

      716KB

    • memory/2220-40-0x0000000000400000-0x00000000004B3000-memory.dmp

      Filesize

      716KB

    • memory/2220-38-0x0000000000400000-0x00000000004B3000-memory.dmp

      Filesize

      716KB

    • memory/2220-26-0x0000000000400000-0x00000000004B3000-memory.dmp

      Filesize

      716KB

    • memory/2220-45-0x0000000000400000-0x00000000004B3000-memory.dmp

      Filesize

      716KB

    • memory/2504-19-0x0000000074C50000-0x00000000751FB000-memory.dmp

      Filesize

      5.7MB

    • memory/2504-44-0x0000000074C50000-0x00000000751FB000-memory.dmp

      Filesize

      5.7MB

    • memory/2504-18-0x0000000074C50000-0x00000000751FB000-memory.dmp

      Filesize

      5.7MB