Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02/01/2025, 09:50
Behavioral task
behavioral1
Sample
JaffaCakes118_643aeee51a1f63290748a405d15a37d0.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_643aeee51a1f63290748a405d15a37d0.exe
-
Size
742KB
-
MD5
643aeee51a1f63290748a405d15a37d0
-
SHA1
f585d6199e88ca686bd52d922eb939d74ba83611
-
SHA256
b4a2d5dc782af456e9d2c3703cdabb4e3fe501c0eae77361af57d97285042782
-
SHA512
cfac2c01b577be39ce578d32e4b1360ea84e2498d132dca02126add2c655ec8e0cca4650206d954eb57e615d78b28974a8b66ba2cd2f0dbfc3c6820761fe086f
-
SSDEEP
12288:IFLlJnnbWOtz6sVJhvaz1Qc/WdI//vfM4qwrbkniafLo6vUTyl0w/q9jJ:o3nbWmJVJFwSddIXvfhqbiaxvRxq9
Malware Config
Signatures
-
Darkcomet family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" JaffaCakes118_643aeee51a1f63290748a405d15a37d0.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" iexplore.exe -
Deletes itself 1 IoCs
pid Process 2120 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 1740 msdcsc.exe -
Loads dropped DLL 2 IoCs
pid Process 2196 JaffaCakes118_643aeee51a1f63290748a405d15a37d0.exe 2196 JaffaCakes118_643aeee51a1f63290748a405d15a37d0.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" JaffaCakes118_643aeee51a1f63290748a405d15a37d0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" msdcsc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" iexplore.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1740 set thread context of 892 1740 msdcsc.exe 34 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_643aeee51a1f63290748a405d15a37d0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdcsc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language iexplore.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2712 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2712 PING.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 892 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2196 JaffaCakes118_643aeee51a1f63290748a405d15a37d0.exe Token: SeSecurityPrivilege 2196 JaffaCakes118_643aeee51a1f63290748a405d15a37d0.exe Token: SeTakeOwnershipPrivilege 2196 JaffaCakes118_643aeee51a1f63290748a405d15a37d0.exe Token: SeLoadDriverPrivilege 2196 JaffaCakes118_643aeee51a1f63290748a405d15a37d0.exe Token: SeSystemProfilePrivilege 2196 JaffaCakes118_643aeee51a1f63290748a405d15a37d0.exe Token: SeSystemtimePrivilege 2196 JaffaCakes118_643aeee51a1f63290748a405d15a37d0.exe Token: SeProfSingleProcessPrivilege 2196 JaffaCakes118_643aeee51a1f63290748a405d15a37d0.exe Token: SeIncBasePriorityPrivilege 2196 JaffaCakes118_643aeee51a1f63290748a405d15a37d0.exe Token: SeCreatePagefilePrivilege 2196 JaffaCakes118_643aeee51a1f63290748a405d15a37d0.exe Token: SeBackupPrivilege 2196 JaffaCakes118_643aeee51a1f63290748a405d15a37d0.exe Token: SeRestorePrivilege 2196 JaffaCakes118_643aeee51a1f63290748a405d15a37d0.exe Token: SeShutdownPrivilege 2196 JaffaCakes118_643aeee51a1f63290748a405d15a37d0.exe Token: SeDebugPrivilege 2196 JaffaCakes118_643aeee51a1f63290748a405d15a37d0.exe Token: SeSystemEnvironmentPrivilege 2196 JaffaCakes118_643aeee51a1f63290748a405d15a37d0.exe Token: SeChangeNotifyPrivilege 2196 JaffaCakes118_643aeee51a1f63290748a405d15a37d0.exe Token: SeRemoteShutdownPrivilege 2196 JaffaCakes118_643aeee51a1f63290748a405d15a37d0.exe Token: SeUndockPrivilege 2196 JaffaCakes118_643aeee51a1f63290748a405d15a37d0.exe Token: SeManageVolumePrivilege 2196 JaffaCakes118_643aeee51a1f63290748a405d15a37d0.exe Token: SeImpersonatePrivilege 2196 JaffaCakes118_643aeee51a1f63290748a405d15a37d0.exe Token: SeCreateGlobalPrivilege 2196 JaffaCakes118_643aeee51a1f63290748a405d15a37d0.exe Token: 33 2196 JaffaCakes118_643aeee51a1f63290748a405d15a37d0.exe Token: 34 2196 JaffaCakes118_643aeee51a1f63290748a405d15a37d0.exe Token: 35 2196 JaffaCakes118_643aeee51a1f63290748a405d15a37d0.exe Token: SeIncreaseQuotaPrivilege 1740 msdcsc.exe Token: SeSecurityPrivilege 1740 msdcsc.exe Token: SeTakeOwnershipPrivilege 1740 msdcsc.exe Token: SeLoadDriverPrivilege 1740 msdcsc.exe Token: SeSystemProfilePrivilege 1740 msdcsc.exe Token: SeSystemtimePrivilege 1740 msdcsc.exe Token: SeProfSingleProcessPrivilege 1740 msdcsc.exe Token: SeIncBasePriorityPrivilege 1740 msdcsc.exe Token: SeCreatePagefilePrivilege 1740 msdcsc.exe Token: SeBackupPrivilege 1740 msdcsc.exe Token: SeRestorePrivilege 1740 msdcsc.exe Token: SeShutdownPrivilege 1740 msdcsc.exe Token: SeDebugPrivilege 1740 msdcsc.exe Token: SeSystemEnvironmentPrivilege 1740 msdcsc.exe Token: SeChangeNotifyPrivilege 1740 msdcsc.exe Token: SeRemoteShutdownPrivilege 1740 msdcsc.exe Token: SeUndockPrivilege 1740 msdcsc.exe Token: SeManageVolumePrivilege 1740 msdcsc.exe Token: SeImpersonatePrivilege 1740 msdcsc.exe Token: SeCreateGlobalPrivilege 1740 msdcsc.exe Token: 33 1740 msdcsc.exe Token: 34 1740 msdcsc.exe Token: 35 1740 msdcsc.exe Token: SeIncreaseQuotaPrivilege 892 iexplore.exe Token: SeSecurityPrivilege 892 iexplore.exe Token: SeTakeOwnershipPrivilege 892 iexplore.exe Token: SeLoadDriverPrivilege 892 iexplore.exe Token: SeSystemProfilePrivilege 892 iexplore.exe Token: SeSystemtimePrivilege 892 iexplore.exe Token: SeProfSingleProcessPrivilege 892 iexplore.exe Token: SeIncBasePriorityPrivilege 892 iexplore.exe Token: SeCreatePagefilePrivilege 892 iexplore.exe Token: SeBackupPrivilege 892 iexplore.exe Token: SeRestorePrivilege 892 iexplore.exe Token: SeShutdownPrivilege 892 iexplore.exe Token: SeDebugPrivilege 892 iexplore.exe Token: SeSystemEnvironmentPrivilege 892 iexplore.exe Token: SeChangeNotifyPrivilege 892 iexplore.exe Token: SeRemoteShutdownPrivilege 892 iexplore.exe Token: SeUndockPrivilege 892 iexplore.exe Token: SeManageVolumePrivilege 892 iexplore.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 892 iexplore.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2196 wrote to memory of 2120 2196 JaffaCakes118_643aeee51a1f63290748a405d15a37d0.exe 30 PID 2196 wrote to memory of 2120 2196 JaffaCakes118_643aeee51a1f63290748a405d15a37d0.exe 30 PID 2196 wrote to memory of 2120 2196 JaffaCakes118_643aeee51a1f63290748a405d15a37d0.exe 30 PID 2196 wrote to memory of 2120 2196 JaffaCakes118_643aeee51a1f63290748a405d15a37d0.exe 30 PID 2196 wrote to memory of 1740 2196 JaffaCakes118_643aeee51a1f63290748a405d15a37d0.exe 32 PID 2196 wrote to memory of 1740 2196 JaffaCakes118_643aeee51a1f63290748a405d15a37d0.exe 32 PID 2196 wrote to memory of 1740 2196 JaffaCakes118_643aeee51a1f63290748a405d15a37d0.exe 32 PID 2196 wrote to memory of 1740 2196 JaffaCakes118_643aeee51a1f63290748a405d15a37d0.exe 32 PID 2120 wrote to memory of 2712 2120 cmd.exe 33 PID 2120 wrote to memory of 2712 2120 cmd.exe 33 PID 2120 wrote to memory of 2712 2120 cmd.exe 33 PID 2120 wrote to memory of 2712 2120 cmd.exe 33 PID 1740 wrote to memory of 892 1740 msdcsc.exe 34 PID 1740 wrote to memory of 892 1740 msdcsc.exe 34 PID 1740 wrote to memory of 892 1740 msdcsc.exe 34 PID 1740 wrote to memory of 892 1740 msdcsc.exe 34 PID 1740 wrote to memory of 892 1740 msdcsc.exe 34 PID 1740 wrote to memory of 892 1740 msdcsc.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_643aeee51a1f63290748a405d15a37d0.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_643aeee51a1f63290748a405d15a37d0.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 53⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2712
-
-
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Windows security bypass
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:892
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
113B
MD5e354513348bf27e4e15dacd843019a91
SHA10fd9c42bdf1f2dbe249491b61e6b88f6746b7829
SHA256b4c76e4d5197c62e9a43c9d4ec71162d94c95f442245268351d7b92800346cfc
SHA512b73a4bc76ad63980c76ffa19fe303bfb7d8fef336489fb98b597d478eed2843c18381e712abc857d585881e68ca0da2d3292eddadcba76b9cdec8fd512abc858
-
Filesize
742KB
MD5643aeee51a1f63290748a405d15a37d0
SHA1f585d6199e88ca686bd52d922eb939d74ba83611
SHA256b4a2d5dc782af456e9d2c3703cdabb4e3fe501c0eae77361af57d97285042782
SHA512cfac2c01b577be39ce578d32e4b1360ea84e2498d132dca02126add2c655ec8e0cca4650206d954eb57e615d78b28974a8b66ba2cd2f0dbfc3c6820761fe086f