Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

6adc3c73fd...18.exe

windows7-x64

10

6adc3c73fd...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6adc3c73fdc00ef24b9ae2cca104bd77_JaffaCakes118

  • Size

    744KB

  • Sample

    240724-jzn96syfqf

  • MD5

    6adc3c73fdc00ef24b9ae2cca104bd77

  • SHA1

    29f1b4488db4dabbccf7a599201c88d226407e49

  • SHA256

    97a339ef4e3bf5d850b732552c8cab17ef3dbbcf37f6b936ac589b0fedf3eb8c

  • SHA512

    d2064240c5faeb774c9263f88b00efd09e5b72425e113644a24bec3bf4901bd89468af379f56582b4bdd2d23df75cd3fc1912372de6a33948571fa8762833410

  • SSDEEP

    12288:Rmntf+yXc2kO6/NBLI1dFBoA04Z/xRQRgzDK9EvfJPAPNGjA7TUty+LHnd:8JtcZv/M1d7e4Z/x6CWev6GjA7TUtNj

Score
10/10
darkcometdiscoverypersistencerattrojan

Malware Config

Targets

    • Target

      6adc3c73fdc00ef24b9ae2cca104bd77_JaffaCakes118

    • Size

      744KB

    • MD5

      6adc3c73fdc00ef24b9ae2cca104bd77

    • SHA1

      29f1b4488db4dabbccf7a599201c88d226407e49

    • SHA256

      97a339ef4e3bf5d850b732552c8cab17ef3dbbcf37f6b936ac589b0fedf3eb8c

    • SHA512

      d2064240c5faeb774c9263f88b00efd09e5b72425e113644a24bec3bf4901bd89468af379f56582b4bdd2d23df75cd3fc1912372de6a33948571fa8762833410

    • SSDEEP

      12288:Rmntf+yXc2kO6/NBLI1dFBoA04Z/xRQRgzDK9EvfJPAPNGjA7TUty+LHnd:8JtcZv/M1d7e4Z/x6CWev6GjA7TUtNj

    Score
    10/10
    darkcometdiscoverypersistencerattrojan

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Modifies WinLogon for persistence

      persistence

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks