Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    17/08/2024, 08:39

General

  • Target

    a1e0143bee6e9d53d1c290e34ef34775_JaffaCakes118.exe

  • Size

    733KB

  • MD5

    a1e0143bee6e9d53d1c290e34ef34775

  • SHA1

    04482b63cf83830cc858564e36273df9ebe67a24

  • SHA256

    482db49b56d32a64bdee5e75639e30de7ed7481675e217c670f5b564426c233b

  • SHA512

    56812848d06d9061446508680881e3ca6706b7e94efa4ce8da541b1fa623220b52b7e2b608a229ecc5e31c8e6922c918ce2713f830577a67def05a29358ab51a

  • SSDEEP

    12288:TpwABK90BOe/x9lPAYvxPQVjdsAY2XjWlnlTTMMXG96uhKI0n/SG:1wAcu99lPzvxP+Bsz2XjWT/MQcVkI0nL

Malware Config

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 3 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 12 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a1e0143bee6e9d53d1c290e34ef34775_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a1e0143bee6e9d53d1c290e34ef34775_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Checks BIOS information in registry
    • Loads dropped DLL
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2328
    • C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\SysWOW64\explorer.exe"
      2⤵
        PID:1972
      • C:\Windupdt\winupdate.exe
        "C:\Windupdt\winupdate.exe"
        2⤵
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2552
        • C:\Windows\SysWOW64\explorer.exe
          "C:\Windows\SysWOW64\explorer.exe"
          3⤵
          • Checks BIOS information in registry
          • System Location Discovery: System Language Discovery
          • Checks processor information in registry
          • Enumerates system info in registry
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:2056

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Windupdt\winupdate.exe

      Filesize

      733KB

      MD5

      a1e0143bee6e9d53d1c290e34ef34775

      SHA1

      04482b63cf83830cc858564e36273df9ebe67a24

      SHA256

      482db49b56d32a64bdee5e75639e30de7ed7481675e217c670f5b564426c233b

      SHA512

      56812848d06d9061446508680881e3ca6706b7e94efa4ce8da541b1fa623220b52b7e2b608a229ecc5e31c8e6922c918ce2713f830577a67def05a29358ab51a

    • memory/2056-20-0x0000000000400000-0x00000000004C8000-memory.dmp

      Filesize

      800KB

    • memory/2056-13-0x0000000000400000-0x00000000004C8000-memory.dmp

      Filesize

      800KB

    • memory/2056-16-0x0000000000400000-0x00000000004C8000-memory.dmp

      Filesize

      800KB

    • memory/2056-18-0x0000000000400000-0x00000000004C8000-memory.dmp

      Filesize

      800KB

    • memory/2056-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2056-21-0x0000000000400000-0x00000000004C8000-memory.dmp

      Filesize

      800KB

    • memory/2056-22-0x0000000000400000-0x00000000004C8000-memory.dmp

      Filesize

      800KB

    • memory/2056-24-0x0000000000400000-0x00000000004C8000-memory.dmp

      Filesize

      800KB

    • memory/2056-23-0x0000000000400000-0x00000000004C8000-memory.dmp

      Filesize

      800KB

    • memory/2328-8-0x0000000000400000-0x00000000004C8000-memory.dmp

      Filesize

      800KB

    • memory/2328-0-0x0000000000330000-0x0000000000331000-memory.dmp

      Filesize

      4KB

    • memory/2552-17-0x0000000000400000-0x00000000004C8000-memory.dmp

      Filesize

      800KB