Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
25/07/2024, 17:27
General
-
Target
708d11b4ea44a535aff234c67126476c_JaffaCakes118.exe
-
Size
713KB
-
MD5
708d11b4ea44a535aff234c67126476c
-
SHA1
41b1f80a886ad1e879d625e8c3ed0c543edec3e5
-
SHA256
9acd6e6d7de619ebffd68ef84963f3804cea80099df09dc9b9892eda6d655f0e
-
SHA512
627d5bcaaac76dd50080de6e82b283bc23cc926110d03039025ca5416745239761b13863b3f98fb750a514ee82a7b734f7495050d56bcbd932965eafb7901574
-
SSDEEP
12288:aaAchpWsuVTv7ItY8XljyypHP7cOLBev03hlULsmWZ++09ZcKDVsgd3t:7AEENIq8XwyVPQclDq/+WnpsS3t
Malware Config
Signatures
-
Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\708d11b4ea44a535aff234c67126476c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\708d11b4ea44a535aff234c67126476c_JaffaCakes118.exe"1⤵
- Checks BIOS information in registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB