Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    01/01/2025, 18:55

General

  • Target

    JaffaCakes118_601d3fd3b8dac3a98814b7899b011501.exe

  • Size

    728KB

  • MD5

    601d3fd3b8dac3a98814b7899b011501

  • SHA1

    348df659f348d296eef0708a570f39faf2b6acb6

  • SHA256

    b47df5fad7cfe6d5f6f97aa37b2bacd950197202cce4fa139c0405b6fdbb957a

  • SHA512

    abe6adcb77eb2473aba1a97a785031b98a5129992959c378da04a30d8af32f17a9ed5e100f60b694f4101186aaca3c28adfd1aee201831c2c936c04ceb8da24a

  • SSDEEP

    12288:7iLERtSJj3culKz/LXzqCFeJ8eAQlfmO8hzrFsaCT6xwb2T99X//Mbt:71ij3cJzTXz/Ub8NYmxxTnX

Malware Config

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Darkcomet family
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 5 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_601d3fd3b8dac3a98814b7899b011501.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_601d3fd3b8dac3a98814b7899b011501.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2644
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_601d3fd3b8dac3a98814b7899b011501.exe
      "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_601d3fd3b8dac3a98814b7899b011501.exe"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3012
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\CRSPY.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2736
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "firefox udate.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\temp\firefox udate.exe" /f
          4⤵
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          PID:3016
      • C:\Users\Admin\AppData\Roaming\temp\firefox udate.exe
        "C:\Users\Admin\AppData\Roaming\temp\firefox udate.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2308
        • C:\Users\Admin\AppData\Roaming\temp\firefox udate.exe
          "C:\Users\Admin\AppData\Roaming\temp\firefox udate.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:2120
        • C:\Windows\SysWOW64\svchost.exe
          "C:\Windows\system32\svchost.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:2320

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\CRSPY.bat

    Filesize

    157B

    MD5

    b03159f96ccac2ce831bdb56b8d4fa0f

    SHA1

    575391e3af00ffe0b31e5fafadb8b0d87609c94a

    SHA256

    c94041f2bd22f248f9bd175a089d9d8461af32add1fff5b8ce00816cce520d3c

    SHA512

    889199d3e641bfcc15b2be03781196736538e7407e03eaeba0393226efea09983be622858c8bbc6f17997358aa42cd71bb81c3b82387164a78205a553a899be4

  • \Users\Admin\AppData\Roaming\temp\firefox udate.exe

    Filesize

    728KB

    MD5

    601d3fd3b8dac3a98814b7899b011501

    SHA1

    348df659f348d296eef0708a570f39faf2b6acb6

    SHA256

    b47df5fad7cfe6d5f6f97aa37b2bacd950197202cce4fa139c0405b6fdbb957a

    SHA512

    abe6adcb77eb2473aba1a97a785031b98a5129992959c378da04a30d8af32f17a9ed5e100f60b694f4101186aaca3c28adfd1aee201831c2c936c04ceb8da24a

  • memory/2120-226-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2308-128-0x0000000002890000-0x0000000002947000-memory.dmp

    Filesize

    732KB

  • memory/2320-205-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/2320-196-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/2320-198-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/2320-200-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/2320-202-0x0000000000400000-0x00000000004B5000-memory.dmp

    Filesize

    724KB

  • memory/2644-8-0x0000000002A80000-0x0000000002B37000-memory.dmp

    Filesize

    732KB

  • memory/2644-10-0x0000000000270000-0x0000000000271000-memory.dmp

    Filesize

    4KB

  • memory/3012-70-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/3012-78-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/3012-79-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/3012-220-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/3012-77-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/3012-76-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/3012-68-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/3012-72-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/3012-74-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/3012-66-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB