Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03/01/2025, 18:14
Behavioral task
behavioral1
Sample
JaffaCakes118_6e88c32f0b1369e3b8fe915c4ce9695d.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_6e88c32f0b1369e3b8fe915c4ce9695d.exe
-
Size
658KB
-
MD5
6e88c32f0b1369e3b8fe915c4ce9695d
-
SHA1
6a19811861c193ba2cac395107e748f5b79e0bb8
-
SHA256
3fcd38543946990afe3e33779c23c2dff9481cec20db42e181d522604a1e6e87
-
SHA512
f5cf99f320c6c1fb04a9292a5f5d0bc5f52750c0fc046d97cf05d8f2851d65920bb77a23f416ff14663d825d1112cc5131da23b7ff8e2530338b9610a80c4a4c
-
SSDEEP
12288:e9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hC:qZ1xuVVjfFoynPaVBUR8f+kN10EBU
Malware Config
Extracted
darkcomet
Guest16
donatas1.no-ip.biz:1604
DC_MUTEX-9D9P6SH
-
InstallPath
MSDCSC\svchost.exe
-
gencode
UhZ0ESjQBiJy
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Darkcomet family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\svchost.exe" JaffaCakes118_6e88c32f0b1369e3b8fe915c4ce9695d.exe -
Executes dropped EXE 1 IoCs
pid Process 2896 svchost.exe -
Loads dropped DLL 2 IoCs
pid Process 2192 JaffaCakes118_6e88c32f0b1369e3b8fe915c4ce9695d.exe 2192 JaffaCakes118_6e88c32f0b1369e3b8fe915c4ce9695d.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\svchost.exe" JaffaCakes118_6e88c32f0b1369e3b8fe915c4ce9695d.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\svchost.exe" svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_6e88c32f0b1369e3b8fe915c4ce9695d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2896 svchost.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2192 JaffaCakes118_6e88c32f0b1369e3b8fe915c4ce9695d.exe Token: SeSecurityPrivilege 2192 JaffaCakes118_6e88c32f0b1369e3b8fe915c4ce9695d.exe Token: SeTakeOwnershipPrivilege 2192 JaffaCakes118_6e88c32f0b1369e3b8fe915c4ce9695d.exe Token: SeLoadDriverPrivilege 2192 JaffaCakes118_6e88c32f0b1369e3b8fe915c4ce9695d.exe Token: SeSystemProfilePrivilege 2192 JaffaCakes118_6e88c32f0b1369e3b8fe915c4ce9695d.exe Token: SeSystemtimePrivilege 2192 JaffaCakes118_6e88c32f0b1369e3b8fe915c4ce9695d.exe Token: SeProfSingleProcessPrivilege 2192 JaffaCakes118_6e88c32f0b1369e3b8fe915c4ce9695d.exe Token: SeIncBasePriorityPrivilege 2192 JaffaCakes118_6e88c32f0b1369e3b8fe915c4ce9695d.exe Token: SeCreatePagefilePrivilege 2192 JaffaCakes118_6e88c32f0b1369e3b8fe915c4ce9695d.exe Token: SeBackupPrivilege 2192 JaffaCakes118_6e88c32f0b1369e3b8fe915c4ce9695d.exe Token: SeRestorePrivilege 2192 JaffaCakes118_6e88c32f0b1369e3b8fe915c4ce9695d.exe Token: SeShutdownPrivilege 2192 JaffaCakes118_6e88c32f0b1369e3b8fe915c4ce9695d.exe Token: SeDebugPrivilege 2192 JaffaCakes118_6e88c32f0b1369e3b8fe915c4ce9695d.exe Token: SeSystemEnvironmentPrivilege 2192 JaffaCakes118_6e88c32f0b1369e3b8fe915c4ce9695d.exe Token: SeChangeNotifyPrivilege 2192 JaffaCakes118_6e88c32f0b1369e3b8fe915c4ce9695d.exe Token: SeRemoteShutdownPrivilege 2192 JaffaCakes118_6e88c32f0b1369e3b8fe915c4ce9695d.exe Token: SeUndockPrivilege 2192 JaffaCakes118_6e88c32f0b1369e3b8fe915c4ce9695d.exe Token: SeManageVolumePrivilege 2192 JaffaCakes118_6e88c32f0b1369e3b8fe915c4ce9695d.exe Token: SeImpersonatePrivilege 2192 JaffaCakes118_6e88c32f0b1369e3b8fe915c4ce9695d.exe Token: SeCreateGlobalPrivilege 2192 JaffaCakes118_6e88c32f0b1369e3b8fe915c4ce9695d.exe Token: 33 2192 JaffaCakes118_6e88c32f0b1369e3b8fe915c4ce9695d.exe Token: 34 2192 JaffaCakes118_6e88c32f0b1369e3b8fe915c4ce9695d.exe Token: 35 2192 JaffaCakes118_6e88c32f0b1369e3b8fe915c4ce9695d.exe Token: SeIncreaseQuotaPrivilege 2896 svchost.exe Token: SeSecurityPrivilege 2896 svchost.exe Token: SeTakeOwnershipPrivilege 2896 svchost.exe Token: SeLoadDriverPrivilege 2896 svchost.exe Token: SeSystemProfilePrivilege 2896 svchost.exe Token: SeSystemtimePrivilege 2896 svchost.exe Token: SeProfSingleProcessPrivilege 2896 svchost.exe Token: SeIncBasePriorityPrivilege 2896 svchost.exe Token: SeCreatePagefilePrivilege 2896 svchost.exe Token: SeBackupPrivilege 2896 svchost.exe Token: SeRestorePrivilege 2896 svchost.exe Token: SeShutdownPrivilege 2896 svchost.exe Token: SeDebugPrivilege 2896 svchost.exe Token: SeSystemEnvironmentPrivilege 2896 svchost.exe Token: SeChangeNotifyPrivilege 2896 svchost.exe Token: SeRemoteShutdownPrivilege 2896 svchost.exe Token: SeUndockPrivilege 2896 svchost.exe Token: SeManageVolumePrivilege 2896 svchost.exe Token: SeImpersonatePrivilege 2896 svchost.exe Token: SeCreateGlobalPrivilege 2896 svchost.exe Token: 33 2896 svchost.exe Token: 34 2896 svchost.exe Token: 35 2896 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2896 svchost.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 2192 wrote to memory of 2896 2192 JaffaCakes118_6e88c32f0b1369e3b8fe915c4ce9695d.exe 30 PID 2192 wrote to memory of 2896 2192 JaffaCakes118_6e88c32f0b1369e3b8fe915c4ce9695d.exe 30 PID 2192 wrote to memory of 2896 2192 JaffaCakes118_6e88c32f0b1369e3b8fe915c4ce9695d.exe 30 PID 2192 wrote to memory of 2896 2192 JaffaCakes118_6e88c32f0b1369e3b8fe915c4ce9695d.exe 30 PID 2896 wrote to memory of 2616 2896 svchost.exe 31 PID 2896 wrote to memory of 2616 2896 svchost.exe 31 PID 2896 wrote to memory of 2616 2896 svchost.exe 31 PID 2896 wrote to memory of 2616 2896 svchost.exe 31 PID 2896 wrote to memory of 2616 2896 svchost.exe 31 PID 2896 wrote to memory of 2616 2896 svchost.exe 31 PID 2896 wrote to memory of 2616 2896 svchost.exe 31 PID 2896 wrote to memory of 2616 2896 svchost.exe 31 PID 2896 wrote to memory of 2616 2896 svchost.exe 31 PID 2896 wrote to memory of 2616 2896 svchost.exe 31 PID 2896 wrote to memory of 2616 2896 svchost.exe 31 PID 2896 wrote to memory of 2616 2896 svchost.exe 31 PID 2896 wrote to memory of 2616 2896 svchost.exe 31 PID 2896 wrote to memory of 2616 2896 svchost.exe 31 PID 2896 wrote to memory of 2616 2896 svchost.exe 31 PID 2896 wrote to memory of 2616 2896 svchost.exe 31 PID 2896 wrote to memory of 2616 2896 svchost.exe 31 PID 2896 wrote to memory of 2616 2896 svchost.exe 31 PID 2896 wrote to memory of 2616 2896 svchost.exe 31 PID 2896 wrote to memory of 2616 2896 svchost.exe 31 PID 2896 wrote to memory of 2616 2896 svchost.exe 31 PID 2896 wrote to memory of 2616 2896 svchost.exe 31 PID 2896 wrote to memory of 2616 2896 svchost.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6e88c32f0b1369e3b8fe915c4ce9695d.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6e88c32f0b1369e3b8fe915c4ce9695d.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\MSDCSC\svchost.exe"C:\Users\Admin\AppData\Local\Temp\MSDCSC\svchost.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\SysWOW64\notepad.exenotepad3⤵
- System Location Discovery: System Language Discovery
PID:2616
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
658KB
MD56e88c32f0b1369e3b8fe915c4ce9695d
SHA16a19811861c193ba2cac395107e748f5b79e0bb8
SHA2563fcd38543946990afe3e33779c23c2dff9481cec20db42e181d522604a1e6e87
SHA512f5cf99f320c6c1fb04a9292a5f5d0bc5f52750c0fc046d97cf05d8f2851d65920bb77a23f416ff14663d825d1112cc5131da23b7ff8e2530338b9610a80c4a4c