Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
04/01/2025, 18:31
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_7b2c058c92c0bfcdc36f6eb6bcd0f66b.exe
Resource
win7-20240729-en
General
-
Target
JaffaCakes118_7b2c058c92c0bfcdc36f6eb6bcd0f66b.exe
-
Size
797KB
-
MD5
7b2c058c92c0bfcdc36f6eb6bcd0f66b
-
SHA1
c7eb1f8c37df44d4f5560f1734dafdd12ed6477e
-
SHA256
776d7d11b5d27b5b3a713f3839fd7128e05fa6a9134fa2fed9b2928e59852322
-
SHA512
328816178c32125b73c01d03bd9670ae703e3a35c11c53e0ebbe43a9739b14ba2e77fa26be0cf215add3e2766035342253d668cb5b3f3012a172c18e60e8bec4
-
SSDEEP
12288:QQLcijICEZ+6vFkqeXGvyxngsm/CEUCR264lGYxtFYB6dsqvPMySJR2SePaG1vhW:ZcfZxFTKn8/+CR26gGYxUYFvPMygGBW
Malware Config
Extracted
darkcomet
Guest16
imdaco.no-ip.org:1604
DC_MUTEX-L9KM9Y7
-
InstallPath
MSDCS\Rundll32.exe
-
gencode
LJp33LCadVtB
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
Rundll32
Signatures
-
Darkcomet family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\MSDCS\\Rundll32.exe" csc.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 216 attrib.exe 4132 attrib.exe -
Executes dropped EXE 1 IoCs
pid Process 1412 Rundll32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rundll32 = "C:\\MSDCS\\Rundll32.exe" csc.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3852 set thread context of 1732 3852 JaffaCakes118_7b2c058c92c0bfcdc36f6eb6bcd0f66b.exe 83 -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe attrib.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727 attrib.exe -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_7b2c058c92c0bfcdc36f6eb6bcd0f66b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1732 csc.exe Token: SeSecurityPrivilege 1732 csc.exe Token: SeTakeOwnershipPrivilege 1732 csc.exe Token: SeLoadDriverPrivilege 1732 csc.exe Token: SeSystemProfilePrivilege 1732 csc.exe Token: SeSystemtimePrivilege 1732 csc.exe Token: SeProfSingleProcessPrivilege 1732 csc.exe Token: SeIncBasePriorityPrivilege 1732 csc.exe Token: SeCreatePagefilePrivilege 1732 csc.exe Token: SeBackupPrivilege 1732 csc.exe Token: SeRestorePrivilege 1732 csc.exe Token: SeShutdownPrivilege 1732 csc.exe Token: SeDebugPrivilege 1732 csc.exe Token: SeSystemEnvironmentPrivilege 1732 csc.exe Token: SeChangeNotifyPrivilege 1732 csc.exe Token: SeRemoteShutdownPrivilege 1732 csc.exe Token: SeUndockPrivilege 1732 csc.exe Token: SeManageVolumePrivilege 1732 csc.exe Token: SeImpersonatePrivilege 1732 csc.exe Token: SeCreateGlobalPrivilege 1732 csc.exe Token: 33 1732 csc.exe Token: 34 1732 csc.exe Token: 35 1732 csc.exe Token: 36 1732 csc.exe -
Suspicious use of WriteProcessMemory 46 IoCs
description pid Process procid_target PID 3852 wrote to memory of 1732 3852 JaffaCakes118_7b2c058c92c0bfcdc36f6eb6bcd0f66b.exe 83 PID 3852 wrote to memory of 1732 3852 JaffaCakes118_7b2c058c92c0bfcdc36f6eb6bcd0f66b.exe 83 PID 3852 wrote to memory of 1732 3852 JaffaCakes118_7b2c058c92c0bfcdc36f6eb6bcd0f66b.exe 83 PID 3852 wrote to memory of 1732 3852 JaffaCakes118_7b2c058c92c0bfcdc36f6eb6bcd0f66b.exe 83 PID 3852 wrote to memory of 1732 3852 JaffaCakes118_7b2c058c92c0bfcdc36f6eb6bcd0f66b.exe 83 PID 3852 wrote to memory of 1732 3852 JaffaCakes118_7b2c058c92c0bfcdc36f6eb6bcd0f66b.exe 83 PID 3852 wrote to memory of 1732 3852 JaffaCakes118_7b2c058c92c0bfcdc36f6eb6bcd0f66b.exe 83 PID 3852 wrote to memory of 1732 3852 JaffaCakes118_7b2c058c92c0bfcdc36f6eb6bcd0f66b.exe 83 PID 3852 wrote to memory of 1732 3852 JaffaCakes118_7b2c058c92c0bfcdc36f6eb6bcd0f66b.exe 83 PID 3852 wrote to memory of 1732 3852 JaffaCakes118_7b2c058c92c0bfcdc36f6eb6bcd0f66b.exe 83 PID 3852 wrote to memory of 1732 3852 JaffaCakes118_7b2c058c92c0bfcdc36f6eb6bcd0f66b.exe 83 PID 3852 wrote to memory of 1732 3852 JaffaCakes118_7b2c058c92c0bfcdc36f6eb6bcd0f66b.exe 83 PID 3852 wrote to memory of 1732 3852 JaffaCakes118_7b2c058c92c0bfcdc36f6eb6bcd0f66b.exe 83 PID 3852 wrote to memory of 1732 3852 JaffaCakes118_7b2c058c92c0bfcdc36f6eb6bcd0f66b.exe 83 PID 1732 wrote to memory of 3164 1732 csc.exe 84 PID 1732 wrote to memory of 3164 1732 csc.exe 84 PID 1732 wrote to memory of 3164 1732 csc.exe 84 PID 1732 wrote to memory of 2140 1732 csc.exe 85 PID 1732 wrote to memory of 2140 1732 csc.exe 85 PID 1732 wrote to memory of 2140 1732 csc.exe 85 PID 1732 wrote to memory of 2160 1732 csc.exe 87 PID 1732 wrote to memory of 2160 1732 csc.exe 87 PID 1732 wrote to memory of 2160 1732 csc.exe 87 PID 1732 wrote to memory of 2160 1732 csc.exe 87 PID 1732 wrote to memory of 2160 1732 csc.exe 87 PID 1732 wrote to memory of 2160 1732 csc.exe 87 PID 1732 wrote to memory of 2160 1732 csc.exe 87 PID 1732 wrote to memory of 2160 1732 csc.exe 87 PID 1732 wrote to memory of 2160 1732 csc.exe 87 PID 1732 wrote to memory of 2160 1732 csc.exe 87 PID 1732 wrote to memory of 2160 1732 csc.exe 87 PID 1732 wrote to memory of 2160 1732 csc.exe 87 PID 1732 wrote to memory of 2160 1732 csc.exe 87 PID 1732 wrote to memory of 2160 1732 csc.exe 87 PID 1732 wrote to memory of 2160 1732 csc.exe 87 PID 1732 wrote to memory of 2160 1732 csc.exe 87 PID 1732 wrote to memory of 2160 1732 csc.exe 87 PID 3164 wrote to memory of 216 3164 cmd.exe 89 PID 3164 wrote to memory of 216 3164 cmd.exe 89 PID 3164 wrote to memory of 216 3164 cmd.exe 89 PID 2140 wrote to memory of 4132 2140 cmd.exe 90 PID 2140 wrote to memory of 4132 2140 cmd.exe 90 PID 2140 wrote to memory of 4132 2140 cmd.exe 90 PID 1732 wrote to memory of 1412 1732 csc.exe 91 PID 1732 wrote to memory of 1412 1732 csc.exe 91 PID 1732 wrote to memory of 1412 1732 csc.exe 91 -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 216 attrib.exe 4132 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7b2c058c92c0bfcdc36f6eb6bcd0f66b.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_7b2c058c92c0bfcdc36f6eb6bcd0f66b.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe2⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" +s +h3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" +s +h4⤵
- Sets file to hidden
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:216
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727" +s +h3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Windows\Microsoft.NET\Framework\v2.0.50727" +s +h4⤵
- Sets file to hidden
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:4132
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
- System Location Discovery: System Language Discovery
PID:2160
-
-
C:\MSDCS\Rundll32.exe"C:\MSDCS\Rundll32.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1412
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
78KB
MD52b9482eb5d3af71029277e18f6c656c0
SHA1d594dc39c6e5f8fbd145d8970e096dc1d9b4a7f1
SHA2561be7a63415f03400065f2beb2ca991c8b0b914bd41310cf9dd93c5e1fc0ed072
SHA51246abaf2e57e498dd60352f76b484825eff7ebdd89cf512ba046d229d5d24a34e5f67c48a1d59551e0b49603a1ffee2ffbc124eef0042ddf3fe7fae423b4af0a8