Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    d05fb610df9c9fdbaff6a83ba87d1a02_JaffaCakes118

  • Size

    285KB

  • Sample

    240906-yzy7pswarr

  • MD5

    d05fb610df9c9fdbaff6a83ba87d1a02

  • SHA1

    0faa815fe32b741485a5606b098196bc38a0cdd4

  • SHA256

    ec3d2b696e963ba862eddefb725ab08e3e980023c0d7c524615ee8533ba46d70

  • SHA512

    6b415f43e5f1730d6e0cfed10109e96755a12f92b8c3a72c4a2afb2ca4d82f5fb0ca719f974f5a4cf6370543004c442b7678db9ed27b97020283f7189998a6fd

  • SSDEEP

    6144:Flb6SDOiIN4o2cOMayarS0IjX7n6wXmzbBFX:F0Siiu2cOMayaZerXXmhFX

Malware Config

Targets

    • Target

      d05fb610df9c9fdbaff6a83ba87d1a02_JaffaCakes118

    • Size

      285KB

    • MD5

      d05fb610df9c9fdbaff6a83ba87d1a02

    • SHA1

      0faa815fe32b741485a5606b098196bc38a0cdd4

    • SHA256

      ec3d2b696e963ba862eddefb725ab08e3e980023c0d7c524615ee8533ba46d70

    • SHA512

      6b415f43e5f1730d6e0cfed10109e96755a12f92b8c3a72c4a2afb2ca4d82f5fb0ca719f974f5a4cf6370543004c442b7678db9ed27b97020283f7189998a6fd

    • SSDEEP

      6144:Flb6SDOiIN4o2cOMayarS0IjX7n6wXmzbBFX:F0Siiu2cOMayaZerXXmhFX

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    • Modifies WinLogon for persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks