Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

637daf3052...18.exe

windows7-x64

10

637daf3052...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    637daf30521254a80bbf15ca8b41d806_JaffaCakes118

  • Size

    952KB

  • Sample

    240722-rjbyxa1fje

  • MD5

    637daf30521254a80bbf15ca8b41d806

  • SHA1

    12933f36aa69639705669f0d02129f2350aa87f4

  • SHA256

    bfb31bccdc8e75f3fdda73277dbf909a94c78c1782a0fbbc95132f8d2698cd21

  • SHA512

    45f0726ddeddd1c3a70a158910fea8268d801e9b902f98a029fd09aee51340474a1f1df8e84a59663b6e68f10c5dcc46b9a523c6120c973a9f5e9ad3fd171049

  • SSDEEP

    24576:Q+7twzoBD5iwnI7E2zP4ktydXkBsXPYw0A2E0g9YMX/:Q+7ezoV5fnIw2zVEduw0ng9Y

Score
10/10
darkcometpersistencerattrojan

Malware Config

Targets

    • Target

      637daf30521254a80bbf15ca8b41d806_JaffaCakes118

    • Size

      952KB

    • MD5

      637daf30521254a80bbf15ca8b41d806

    • SHA1

      12933f36aa69639705669f0d02129f2350aa87f4

    • SHA256

      bfb31bccdc8e75f3fdda73277dbf909a94c78c1782a0fbbc95132f8d2698cd21

    • SHA512

      45f0726ddeddd1c3a70a158910fea8268d801e9b902f98a029fd09aee51340474a1f1df8e84a59663b6e68f10c5dcc46b9a523c6120c973a9f5e9ad3fd171049

    • SSDEEP

      24576:Q+7twzoBD5iwnI7E2zP4ktydXkBsXPYw0A2E0g9YMX/:Q+7ezoV5fnIw2zVEduw0ng9Y

    Score
    10/10
    darkcometpersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks