Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02/01/2025, 13:45
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_658497c8c9ef6f24d71e03cfcee57700.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_658497c8c9ef6f24d71e03cfcee57700.exe
-
Size
1.2MB
-
MD5
658497c8c9ef6f24d71e03cfcee57700
-
SHA1
6a04eff1dd11351b1520e112465cd0dd73731c55
-
SHA256
35a1772280f518a87b6778ba4bb388b192c67202f2ec4c76b056e8db167624ca
-
SHA512
3f646ab7bd56b793d5f45a3a4f39176310ed21479091665c7aec8b95cadbc38492c4d06748a59718753de7c129eae419993d566517ef8eb2cbf077369451300a
-
SSDEEP
24576:yU26IocyuCRdsvk496tF+Fg+NrDL6ZvqV2j43K/cRgOnmq9g6OiYJY/RKPt:yUCocyuCz0k+AQSAHovXcOU7m6OzS/RI
Malware Config
Extracted
darkcomet
Guest16
127.0.0.1:1604
algerinooo.ddns.net:1604
DC_MUTEX-8631A1S
-
gencode
MLZlM4WyBLH5
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Darkcomet family
-
Executes dropped EXE 1 IoCs
pid Process 2192 377.exe -
Loads dropped DLL 2 IoCs
pid Process 576 JaffaCakes118_658497c8c9ef6f24d71e03cfcee57700.exe 576 JaffaCakes118_658497c8c9ef6f24d71e03cfcee57700.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_658497c8c9ef6f24d71e03cfcee57700.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 377.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2192 377.exe Token: SeSecurityPrivilege 2192 377.exe Token: SeTakeOwnershipPrivilege 2192 377.exe Token: SeLoadDriverPrivilege 2192 377.exe Token: SeSystemProfilePrivilege 2192 377.exe Token: SeSystemtimePrivilege 2192 377.exe Token: SeProfSingleProcessPrivilege 2192 377.exe Token: SeIncBasePriorityPrivilege 2192 377.exe Token: SeCreatePagefilePrivilege 2192 377.exe Token: SeBackupPrivilege 2192 377.exe Token: SeRestorePrivilege 2192 377.exe Token: SeShutdownPrivilege 2192 377.exe Token: SeDebugPrivilege 2192 377.exe Token: SeSystemEnvironmentPrivilege 2192 377.exe Token: SeChangeNotifyPrivilege 2192 377.exe Token: SeRemoteShutdownPrivilege 2192 377.exe Token: SeUndockPrivilege 2192 377.exe Token: SeManageVolumePrivilege 2192 377.exe Token: SeImpersonatePrivilege 2192 377.exe Token: SeCreateGlobalPrivilege 2192 377.exe Token: 33 2192 377.exe Token: 34 2192 377.exe Token: 35 2192 377.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2192 377.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 576 wrote to memory of 2192 576 JaffaCakes118_658497c8c9ef6f24d71e03cfcee57700.exe 32 PID 576 wrote to memory of 2192 576 JaffaCakes118_658497c8c9ef6f24d71e03cfcee57700.exe 32 PID 576 wrote to memory of 2192 576 JaffaCakes118_658497c8c9ef6f24d71e03cfcee57700.exe 32 PID 576 wrote to memory of 2192 576 JaffaCakes118_658497c8c9ef6f24d71e03cfcee57700.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_658497c8c9ef6f24d71e03cfcee57700.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_658497c8c9ef6f24d71e03cfcee57700.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Users\Admin\AppData\Local\Temp\377.exeC:\Users\Admin\AppData\Local\Temp\377.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2192
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
658KB
MD58bd92dee950bf6d09b8240dfb6bf7ffb
SHA13bf5a6a49c8100b0812b9c6c8649a036b2ce0d85
SHA25666a8a79cec9360edc8f3db2f8930734f6f0935db5091c2d3305099ada99c215c
SHA51229df1d77e17a75c96ec0e64958274d460fade736229e538289135e5a8c730fb47e7a67a9798d65f30bf0b38c6c494bff682bd76c554fb3c95ee063da6bd0cba9