Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    03/01/2025, 02:59

General

  • Target

    JaffaCakes118_69d22f16921aa332e713bd5a024b1c80.exe

  • Size

    952KB

  • MD5

    69d22f16921aa332e713bd5a024b1c80

  • SHA1

    4b11df5107ec6e113e92d569412c3b51dba4b53b

  • SHA256

    b995936f557d4947a2c98abc6231ac77c950a358fed5975c40097fd3d88764d0

  • SHA512

    15779137bef9ecc5387d1e946267a4e8d754185847f56ea7e61e6cd1bed36a6b7c21d59e59d82271a65026a5907ad3f3a463fa84375cc4f3cd9a91396e89b7b6

  • SSDEEP

    12288:byyy7Z3z4I8NXOGjwwG/ZjXsAHHz79p9NM5Tz103j2CF4TxQUOfhVPOSAE//VAci:baCI2OewFJN4mkxyHnnew1SatLRzD

Malware Config

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Darkcomet family
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 7 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_69d22f16921aa332e713bd5a024b1c80.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_69d22f16921aa332e713bd5a024b1c80.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2516
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_69d22f16921aa332e713bd5a024b1c80.exe
      "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_69d22f16921aa332e713bd5a024b1c80.exe"
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3292
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\HIFOA.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3448
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "msoffice" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe" /f
          4⤵
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          PID:3500
      • C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe
        "C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3524
        • C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe
          "C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:1564
        • C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe
          "C:\Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:3272

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\HIFOA.bat

    Filesize

    155B

    MD5

    f07b93136766adced3c6f0d74d869da0

    SHA1

    787c530f33687d758b41295e01d7a9a1bba3a467

    SHA256

    cd603067047c028fe12d4b099d13b3681dd698d25bc32474184e9d8edd3ed701

    SHA512

    050105a5f14939a37f653421b24959cc90cb082b20df5bb1a81335fd0ad5e70c740b43f1d6df0fc7324551425894668acc3af0c533c7d90ff149d84e844c2d10

  • \Users\Admin\AppData\Roaming\MicrosoftOffice\micoffice.exe

    Filesize

    952KB

    MD5

    8480f1af7a1765c763b6ce2f7ee4367b

    SHA1

    cf4d550159f7024d0eb43148fe5b1579f4fc8253

    SHA256

    d25f8b026f651ef623592749291b23e23261721ce3ad3353151022c535fbf76b

    SHA512

    894be8c23600773ee0977263b2bfc403405ec3ddc0fc9003a58c2f89099ffe6f56dab4f5ce69adb37ab2100131f0f7ba59a2eeb3af13c06fb8b2d3cb6144ca9e

  • memory/1564-1044-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1564-883-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2516-72-0x0000000002590000-0x0000000002591000-memory.dmp

    Filesize

    4KB

  • memory/2516-136-0x0000000002A00000-0x0000000002A01000-memory.dmp

    Filesize

    4KB

  • memory/2516-28-0x0000000002B20000-0x0000000002B21000-memory.dmp

    Filesize

    4KB

  • memory/2516-26-0x0000000002B20000-0x0000000002B21000-memory.dmp

    Filesize

    4KB

  • memory/2516-24-0x00000000025A0000-0x00000000025A1000-memory.dmp

    Filesize

    4KB

  • memory/2516-22-0x00000000025A0000-0x00000000025A1000-memory.dmp

    Filesize

    4KB

  • memory/2516-20-0x00000000007F0000-0x00000000007F1000-memory.dmp

    Filesize

    4KB

  • memory/2516-18-0x00000000007F0000-0x00000000007F1000-memory.dmp

    Filesize

    4KB

  • memory/2516-14-0x00000000025B0000-0x00000000025B1000-memory.dmp

    Filesize

    4KB

  • memory/2516-12-0x00000000025B0000-0x00000000025B1000-memory.dmp

    Filesize

    4KB

  • memory/2516-8-0x0000000002930000-0x0000000002931000-memory.dmp

    Filesize

    4KB

  • memory/2516-6-0x0000000002930000-0x0000000002931000-memory.dmp

    Filesize

    4KB

  • memory/2516-4-0x0000000000790000-0x0000000000791000-memory.dmp

    Filesize

    4KB

  • memory/2516-2-0x0000000000790000-0x0000000000791000-memory.dmp

    Filesize

    4KB

  • memory/2516-434-0x00000000003D0000-0x00000000003D1000-memory.dmp

    Filesize

    4KB

  • memory/2516-150-0x0000000002ED0000-0x0000000002ED1000-memory.dmp

    Filesize

    4KB

  • memory/2516-144-0x0000000002EE0000-0x0000000002EE1000-memory.dmp

    Filesize

    4KB

  • memory/2516-30-0x0000000002AD0000-0x0000000002AD1000-memory.dmp

    Filesize

    4KB

  • memory/2516-122-0x0000000000690000-0x0000000000691000-memory.dmp

    Filesize

    4KB

  • memory/2516-112-0x0000000002640000-0x0000000002641000-memory.dmp

    Filesize

    4KB

  • memory/2516-104-0x0000000002C30000-0x0000000002C31000-memory.dmp

    Filesize

    4KB

  • memory/2516-90-0x00000000028D0000-0x00000000028D1000-memory.dmp

    Filesize

    4KB

  • memory/2516-80-0x0000000002CF0000-0x0000000002CF1000-memory.dmp

    Filesize

    4KB

  • memory/2516-435-0x00000000003E0000-0x00000000003E1000-memory.dmp

    Filesize

    4KB

  • memory/2516-62-0x0000000002910000-0x0000000002911000-memory.dmp

    Filesize

    4KB

  • memory/2516-52-0x0000000002650000-0x0000000002651000-memory.dmp

    Filesize

    4KB

  • memory/2516-44-0x0000000002D20000-0x0000000002D21000-memory.dmp

    Filesize

    4KB

  • memory/2516-36-0x0000000002A20000-0x0000000002A21000-memory.dmp

    Filesize

    4KB

  • memory/2516-32-0x0000000002AD0000-0x0000000002AD1000-memory.dmp

    Filesize

    4KB

  • memory/2516-34-0x0000000002A20000-0x0000000002A21000-memory.dmp

    Filesize

    4KB

  • memory/3292-445-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/3292-1038-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/3292-428-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB