Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/09/2024, 13:26

General

  • Target

    d208ad20d240b437f84f6df7c87caee7_JaffaCakes118.exe

  • Size

    833KB

  • MD5

    d208ad20d240b437f84f6df7c87caee7

  • SHA1

    b595aff2cada2868a99e9df7d2856362c955d4dd

  • SHA256

    ab5ee538853974ccb6bc195c9488578f1217c05a6f2246bbda2304d9d2bc8a09

  • SHA512

    43e22060459bfe329860dadd3f4c45a040b4e07dc5442336991ccdbf9fa40e23e03248af851e03f9a400b8d1bb303c7d32f11775abec80cd03e4d22a0af06396

  • SSDEEP

    24576:tTEviA7EjZtXFiB8ziZfDGHbwA/MDBb+oxRXWZ:6H74XFiBEsfD65/Mtb+SRXWZ

Malware Config

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d208ad20d240b437f84f6df7c87caee7_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d208ad20d240b437f84f6df7c87caee7_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1432
    • C:\Users\Admin\AppData\Local\Temp\d208ad20d240b437f84f6df7c87caee7_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\d208ad20d240b437f84f6df7c87caee7_JaffaCakes118.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Checks computer location settings
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1328
      • C:\Users\Admin\Documents\MSDCSC\scost.exe
        "C:\Users\Admin\Documents\MSDCSC\scost.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3604
        • C:\Users\Admin\Documents\MSDCSC\scost.exe
          "C:\Users\Admin\Documents\MSDCSC\scost.exe"
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:1584

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\Documents\MSDCSC\scost.exe

    Filesize

    833KB

    MD5

    d208ad20d240b437f84f6df7c87caee7

    SHA1

    b595aff2cada2868a99e9df7d2856362c955d4dd

    SHA256

    ab5ee538853974ccb6bc195c9488578f1217c05a6f2246bbda2304d9d2bc8a09

    SHA512

    43e22060459bfe329860dadd3f4c45a040b4e07dc5442336991ccdbf9fa40e23e03248af851e03f9a400b8d1bb303c7d32f11775abec80cd03e4d22a0af06396

  • memory/1328-3-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/1328-2-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/1328-4-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/1328-5-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/1328-6-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/1328-21-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/1584-34-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/1584-38-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/1584-29-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/1584-31-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/1584-33-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/1584-32-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/1584-30-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/1584-27-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/1584-36-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/1584-35-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/1584-37-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/1584-28-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/1584-39-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/1584-40-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/1584-41-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/1584-42-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/1584-43-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/1584-44-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/1584-45-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/1584-46-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/1584-47-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/1584-48-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB

  • memory/1584-49-0x0000000000400000-0x00000000004C3000-memory.dmp

    Filesize

    780KB