Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
01/01/2025, 18:55
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_601d3fd3b8dac3a98814b7899b011501.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
JaffaCakes118_601d3fd3b8dac3a98814b7899b011501.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_601d3fd3b8dac3a98814b7899b011501.exe
-
Size
728KB
-
MD5
601d3fd3b8dac3a98814b7899b011501
-
SHA1
348df659f348d296eef0708a570f39faf2b6acb6
-
SHA256
b47df5fad7cfe6d5f6f97aa37b2bacd950197202cce4fa139c0405b6fdbb957a
-
SHA512
abe6adcb77eb2473aba1a97a785031b98a5129992959c378da04a30d8af32f17a9ed5e100f60b694f4101186aaca3c28adfd1aee201831c2c936c04ceb8da24a
-
SSDEEP
12288:7iLERtSJj3culKz/LXzqCFeJ8eAQlfmO8hzrFsaCT6xwb2T99X//Mbt:71ij3cJzTXz/Ub8NYmxxTnX
Malware Config
Signatures
-
Darkcomet family
-
Executes dropped EXE 2 IoCs
pid Process 2308 firefox udate.exe 2120 firefox udate.exe -
Loads dropped DLL 5 IoCs
pid Process 3012 JaffaCakes118_601d3fd3b8dac3a98814b7899b011501.exe 3012 JaffaCakes118_601d3fd3b8dac3a98814b7899b011501.exe 3012 JaffaCakes118_601d3fd3b8dac3a98814b7899b011501.exe 3012 JaffaCakes118_601d3fd3b8dac3a98814b7899b011501.exe 3012 JaffaCakes118_601d3fd3b8dac3a98814b7899b011501.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\firefox udate.exe = "C:\\Users\\Admin\\AppData\\Roaming\\temp\\firefox udate.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2644 set thread context of 3012 2644 JaffaCakes118_601d3fd3b8dac3a98814b7899b011501.exe 30 PID 2308 set thread context of 2120 2308 firefox udate.exe 36 PID 2308 set thread context of 2320 2308 firefox udate.exe 37 -
resource yara_rule behavioral1/memory/3012-74-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/3012-70-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/3012-68-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/3012-76-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/3012-77-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/3012-79-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/3012-78-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/3012-220-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2120-226-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language firefox udate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language firefox udate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_601d3fd3b8dac3a98814b7899b011501.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_601d3fd3b8dac3a98814b7899b011501.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2320 svchost.exe Token: SeSecurityPrivilege 2320 svchost.exe Token: SeTakeOwnershipPrivilege 2320 svchost.exe Token: SeLoadDriverPrivilege 2320 svchost.exe Token: SeSystemProfilePrivilege 2320 svchost.exe Token: SeSystemtimePrivilege 2320 svchost.exe Token: SeProfSingleProcessPrivilege 2320 svchost.exe Token: SeIncBasePriorityPrivilege 2320 svchost.exe Token: SeCreatePagefilePrivilege 2320 svchost.exe Token: SeBackupPrivilege 2320 svchost.exe Token: SeRestorePrivilege 2320 svchost.exe Token: SeShutdownPrivilege 2320 svchost.exe Token: SeDebugPrivilege 2320 svchost.exe Token: SeSystemEnvironmentPrivilege 2320 svchost.exe Token: SeChangeNotifyPrivilege 2320 svchost.exe Token: SeRemoteShutdownPrivilege 2320 svchost.exe Token: SeUndockPrivilege 2320 svchost.exe Token: SeManageVolumePrivilege 2320 svchost.exe Token: SeImpersonatePrivilege 2320 svchost.exe Token: SeCreateGlobalPrivilege 2320 svchost.exe Token: 33 2320 svchost.exe Token: 34 2320 svchost.exe Token: 35 2320 svchost.exe Token: SeDebugPrivilege 2120 firefox udate.exe Token: SeDebugPrivilege 2120 firefox udate.exe Token: SeDebugPrivilege 2120 firefox udate.exe Token: SeDebugPrivilege 2120 firefox udate.exe Token: SeDebugPrivilege 2120 firefox udate.exe Token: SeDebugPrivilege 2120 firefox udate.exe Token: SeDebugPrivilege 2120 firefox udate.exe Token: SeDebugPrivilege 2120 firefox udate.exe Token: SeDebugPrivilege 2120 firefox udate.exe Token: SeDebugPrivilege 2120 firefox udate.exe Token: SeDebugPrivilege 2120 firefox udate.exe Token: SeDebugPrivilege 2120 firefox udate.exe Token: SeDebugPrivilege 2120 firefox udate.exe Token: SeDebugPrivilege 2120 firefox udate.exe Token: SeDebugPrivilege 2120 firefox udate.exe Token: SeDebugPrivilege 2120 firefox udate.exe Token: SeDebugPrivilege 2120 firefox udate.exe Token: SeDebugPrivilege 2120 firefox udate.exe Token: SeDebugPrivilege 2120 firefox udate.exe Token: SeDebugPrivilege 2120 firefox udate.exe Token: SeDebugPrivilege 2120 firefox udate.exe Token: SeDebugPrivilege 2120 firefox udate.exe Token: SeDebugPrivilege 2120 firefox udate.exe Token: SeDebugPrivilege 2120 firefox udate.exe Token: SeDebugPrivilege 2120 firefox udate.exe Token: SeDebugPrivilege 2120 firefox udate.exe Token: SeDebugPrivilege 2120 firefox udate.exe Token: SeDebugPrivilege 2120 firefox udate.exe Token: SeDebugPrivilege 2120 firefox udate.exe Token: SeDebugPrivilege 2120 firefox udate.exe Token: SeDebugPrivilege 2120 firefox udate.exe Token: SeDebugPrivilege 2120 firefox udate.exe Token: SeDebugPrivilege 2120 firefox udate.exe Token: SeDebugPrivilege 2120 firefox udate.exe Token: SeDebugPrivilege 2120 firefox udate.exe Token: SeDebugPrivilege 2120 firefox udate.exe Token: SeDebugPrivilege 2120 firefox udate.exe Token: SeDebugPrivilege 2120 firefox udate.exe Token: SeDebugPrivilege 2120 firefox udate.exe Token: SeDebugPrivilege 2120 firefox udate.exe Token: SeDebugPrivilege 2120 firefox udate.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2644 JaffaCakes118_601d3fd3b8dac3a98814b7899b011501.exe 3012 JaffaCakes118_601d3fd3b8dac3a98814b7899b011501.exe 2308 firefox udate.exe 2120 firefox udate.exe 2320 svchost.exe -
Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 2644 wrote to memory of 3012 2644 JaffaCakes118_601d3fd3b8dac3a98814b7899b011501.exe 30 PID 2644 wrote to memory of 3012 2644 JaffaCakes118_601d3fd3b8dac3a98814b7899b011501.exe 30 PID 2644 wrote to memory of 3012 2644 JaffaCakes118_601d3fd3b8dac3a98814b7899b011501.exe 30 PID 2644 wrote to memory of 3012 2644 JaffaCakes118_601d3fd3b8dac3a98814b7899b011501.exe 30 PID 2644 wrote to memory of 3012 2644 JaffaCakes118_601d3fd3b8dac3a98814b7899b011501.exe 30 PID 2644 wrote to memory of 3012 2644 JaffaCakes118_601d3fd3b8dac3a98814b7899b011501.exe 30 PID 2644 wrote to memory of 3012 2644 JaffaCakes118_601d3fd3b8dac3a98814b7899b011501.exe 30 PID 2644 wrote to memory of 3012 2644 JaffaCakes118_601d3fd3b8dac3a98814b7899b011501.exe 30 PID 3012 wrote to memory of 2736 3012 JaffaCakes118_601d3fd3b8dac3a98814b7899b011501.exe 31 PID 3012 wrote to memory of 2736 3012 JaffaCakes118_601d3fd3b8dac3a98814b7899b011501.exe 31 PID 3012 wrote to memory of 2736 3012 JaffaCakes118_601d3fd3b8dac3a98814b7899b011501.exe 31 PID 3012 wrote to memory of 2736 3012 JaffaCakes118_601d3fd3b8dac3a98814b7899b011501.exe 31 PID 2736 wrote to memory of 3016 2736 cmd.exe 33 PID 2736 wrote to memory of 3016 2736 cmd.exe 33 PID 2736 wrote to memory of 3016 2736 cmd.exe 33 PID 2736 wrote to memory of 3016 2736 cmd.exe 33 PID 3012 wrote to memory of 2308 3012 JaffaCakes118_601d3fd3b8dac3a98814b7899b011501.exe 34 PID 3012 wrote to memory of 2308 3012 JaffaCakes118_601d3fd3b8dac3a98814b7899b011501.exe 34 PID 3012 wrote to memory of 2308 3012 JaffaCakes118_601d3fd3b8dac3a98814b7899b011501.exe 34 PID 3012 wrote to memory of 2308 3012 JaffaCakes118_601d3fd3b8dac3a98814b7899b011501.exe 34 PID 2308 wrote to memory of 2120 2308 firefox udate.exe 36 PID 2308 wrote to memory of 2120 2308 firefox udate.exe 36 PID 2308 wrote to memory of 2120 2308 firefox udate.exe 36 PID 2308 wrote to memory of 2120 2308 firefox udate.exe 36 PID 2308 wrote to memory of 2120 2308 firefox udate.exe 36 PID 2308 wrote to memory of 2120 2308 firefox udate.exe 36 PID 2308 wrote to memory of 2120 2308 firefox udate.exe 36 PID 2308 wrote to memory of 2120 2308 firefox udate.exe 36 PID 2308 wrote to memory of 2320 2308 firefox udate.exe 37 PID 2308 wrote to memory of 2320 2308 firefox udate.exe 37 PID 2308 wrote to memory of 2320 2308 firefox udate.exe 37 PID 2308 wrote to memory of 2320 2308 firefox udate.exe 37 PID 2308 wrote to memory of 2320 2308 firefox udate.exe 37 PID 2308 wrote to memory of 2320 2308 firefox udate.exe 37 PID 2308 wrote to memory of 2320 2308 firefox udate.exe 37 PID 2308 wrote to memory of 2320 2308 firefox udate.exe 37 PID 2308 wrote to memory of 2320 2308 firefox udate.exe 37 PID 2308 wrote to memory of 2320 2308 firefox udate.exe 37 PID 2308 wrote to memory of 2320 2308 firefox udate.exe 37 PID 2308 wrote to memory of 2320 2308 firefox udate.exe 37 PID 2308 wrote to memory of 2320 2308 firefox udate.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_601d3fd3b8dac3a98814b7899b011501.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_601d3fd3b8dac3a98814b7899b011501.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_601d3fd3b8dac3a98814b7899b011501.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_601d3fd3b8dac3a98814b7899b011501.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\CRSPY.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "firefox udate.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\temp\firefox udate.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3016
-
-
-
C:\Users\Admin\AppData\Roaming\temp\firefox udate.exe"C:\Users\Admin\AppData\Roaming\temp\firefox udate.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Roaming\temp\firefox udate.exe"C:\Users\Admin\AppData\Roaming\temp\firefox udate.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2120
-
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2320
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
157B
MD5b03159f96ccac2ce831bdb56b8d4fa0f
SHA1575391e3af00ffe0b31e5fafadb8b0d87609c94a
SHA256c94041f2bd22f248f9bd175a089d9d8461af32add1fff5b8ce00816cce520d3c
SHA512889199d3e641bfcc15b2be03781196736538e7407e03eaeba0393226efea09983be622858c8bbc6f17997358aa42cd71bb81c3b82387164a78205a553a899be4
-
Filesize
728KB
MD5601d3fd3b8dac3a98814b7899b011501
SHA1348df659f348d296eef0708a570f39faf2b6acb6
SHA256b47df5fad7cfe6d5f6f97aa37b2bacd950197202cce4fa139c0405b6fdbb957a
SHA512abe6adcb77eb2473aba1a97a785031b98a5129992959c378da04a30d8af32f17a9ed5e100f60b694f4101186aaca3c28adfd1aee201831c2c936c04ceb8da24a