Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
20/01/2025, 21:28
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_001869f0c707119d1c61a28d39807809.exe
Resource
win7-20240708-en
General
-
Target
JaffaCakes118_001869f0c707119d1c61a28d39807809.exe
-
Size
1.1MB
-
MD5
001869f0c707119d1c61a28d39807809
-
SHA1
395843f369dd1447fa29a2272384e1b73c87012c
-
SHA256
e608dbda1dd28a2ebc5cd824438da519fb5f891792e3e700975132a01ce1b575
-
SHA512
a0fad88a2cf00d3324baed656123ddce7e314558f98029a829d8c1e27a9e4ba126b402b45894d26d49a96e94f4e0a3a896b51bd65d5ba4614d6266bc8db0f29d
-
SSDEEP
24576:7MwVWXpMrfQZMzHfmExF5qiTdT6srVDXleHXcwvtlc:7ps8tzdT6yVDXleHsAtm
Malware Config
Extracted
darkcomet
Guest16
cgate.no-ip.biz:1604
60.229.1.182:1604
dark132.no-ip.org:1604
DC_MUTEX-NFQFG4V
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
bGc1YKkXWoLk
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
MicroUpdate
Signatures
-
Darkcomet family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" JaffaCakes118_001869f0c707119d1c61a28d39807809.exe -
Executes dropped EXE 3 IoCs
pid Process 3044 msdcsc.exe 2672 msdcsc.exe 2840 msdcsc.exe -
Loads dropped DLL 4 IoCs
pid Process 2764 JaffaCakes118_001869f0c707119d1c61a28d39807809.exe 2764 JaffaCakes118_001869f0c707119d1c61a28d39807809.exe 3044 msdcsc.exe 2672 msdcsc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" JaffaCakes118_001869f0c707119d1c61a28d39807809.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1908 set thread context of 2648 1908 JaffaCakes118_001869f0c707119d1c61a28d39807809.exe 30 PID 2648 set thread context of 2764 2648 JaffaCakes118_001869f0c707119d1c61a28d39807809.exe 31 PID 3044 set thread context of 2672 3044 msdcsc.exe 33 PID 2672 set thread context of 2840 2672 msdcsc.exe 34 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_001869f0c707119d1c61a28d39807809.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_001869f0c707119d1c61a28d39807809.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_001869f0c707119d1c61a28d39807809.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdcsc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdcsc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2764 JaffaCakes118_001869f0c707119d1c61a28d39807809.exe Token: SeSecurityPrivilege 2764 JaffaCakes118_001869f0c707119d1c61a28d39807809.exe Token: SeTakeOwnershipPrivilege 2764 JaffaCakes118_001869f0c707119d1c61a28d39807809.exe Token: SeLoadDriverPrivilege 2764 JaffaCakes118_001869f0c707119d1c61a28d39807809.exe Token: SeSystemProfilePrivilege 2764 JaffaCakes118_001869f0c707119d1c61a28d39807809.exe Token: SeSystemtimePrivilege 2764 JaffaCakes118_001869f0c707119d1c61a28d39807809.exe Token: SeProfSingleProcessPrivilege 2764 JaffaCakes118_001869f0c707119d1c61a28d39807809.exe Token: SeIncBasePriorityPrivilege 2764 JaffaCakes118_001869f0c707119d1c61a28d39807809.exe Token: SeCreatePagefilePrivilege 2764 JaffaCakes118_001869f0c707119d1c61a28d39807809.exe Token: SeBackupPrivilege 2764 JaffaCakes118_001869f0c707119d1c61a28d39807809.exe Token: SeRestorePrivilege 2764 JaffaCakes118_001869f0c707119d1c61a28d39807809.exe Token: SeShutdownPrivilege 2764 JaffaCakes118_001869f0c707119d1c61a28d39807809.exe Token: SeDebugPrivilege 2764 JaffaCakes118_001869f0c707119d1c61a28d39807809.exe Token: SeSystemEnvironmentPrivilege 2764 JaffaCakes118_001869f0c707119d1c61a28d39807809.exe Token: SeChangeNotifyPrivilege 2764 JaffaCakes118_001869f0c707119d1c61a28d39807809.exe Token: SeRemoteShutdownPrivilege 2764 JaffaCakes118_001869f0c707119d1c61a28d39807809.exe Token: SeUndockPrivilege 2764 JaffaCakes118_001869f0c707119d1c61a28d39807809.exe Token: SeManageVolumePrivilege 2764 JaffaCakes118_001869f0c707119d1c61a28d39807809.exe Token: SeImpersonatePrivilege 2764 JaffaCakes118_001869f0c707119d1c61a28d39807809.exe Token: SeCreateGlobalPrivilege 2764 JaffaCakes118_001869f0c707119d1c61a28d39807809.exe Token: 33 2764 JaffaCakes118_001869f0c707119d1c61a28d39807809.exe Token: 34 2764 JaffaCakes118_001869f0c707119d1c61a28d39807809.exe Token: 35 2764 JaffaCakes118_001869f0c707119d1c61a28d39807809.exe Token: SeIncreaseQuotaPrivilege 2840 msdcsc.exe Token: SeSecurityPrivilege 2840 msdcsc.exe Token: SeTakeOwnershipPrivilege 2840 msdcsc.exe Token: SeLoadDriverPrivilege 2840 msdcsc.exe Token: SeSystemProfilePrivilege 2840 msdcsc.exe Token: SeSystemtimePrivilege 2840 msdcsc.exe Token: SeProfSingleProcessPrivilege 2840 msdcsc.exe Token: SeIncBasePriorityPrivilege 2840 msdcsc.exe Token: SeCreatePagefilePrivilege 2840 msdcsc.exe Token: SeBackupPrivilege 2840 msdcsc.exe Token: SeRestorePrivilege 2840 msdcsc.exe Token: SeShutdownPrivilege 2840 msdcsc.exe Token: SeDebugPrivilege 2840 msdcsc.exe Token: SeSystemEnvironmentPrivilege 2840 msdcsc.exe Token: SeChangeNotifyPrivilege 2840 msdcsc.exe Token: SeRemoteShutdownPrivilege 2840 msdcsc.exe Token: SeUndockPrivilege 2840 msdcsc.exe Token: SeManageVolumePrivilege 2840 msdcsc.exe Token: SeImpersonatePrivilege 2840 msdcsc.exe Token: SeCreateGlobalPrivilege 2840 msdcsc.exe Token: 33 2840 msdcsc.exe Token: 34 2840 msdcsc.exe Token: 35 2840 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2840 msdcsc.exe -
Suspicious use of WriteProcessMemory 50 IoCs
description pid Process procid_target PID 1908 wrote to memory of 2648 1908 JaffaCakes118_001869f0c707119d1c61a28d39807809.exe 30 PID 1908 wrote to memory of 2648 1908 JaffaCakes118_001869f0c707119d1c61a28d39807809.exe 30 PID 1908 wrote to memory of 2648 1908 JaffaCakes118_001869f0c707119d1c61a28d39807809.exe 30 PID 1908 wrote to memory of 2648 1908 JaffaCakes118_001869f0c707119d1c61a28d39807809.exe 30 PID 1908 wrote to memory of 2648 1908 JaffaCakes118_001869f0c707119d1c61a28d39807809.exe 30 PID 1908 wrote to memory of 2648 1908 JaffaCakes118_001869f0c707119d1c61a28d39807809.exe 30 PID 1908 wrote to memory of 2648 1908 JaffaCakes118_001869f0c707119d1c61a28d39807809.exe 30 PID 1908 wrote to memory of 2648 1908 JaffaCakes118_001869f0c707119d1c61a28d39807809.exe 30 PID 1908 wrote to memory of 2648 1908 JaffaCakes118_001869f0c707119d1c61a28d39807809.exe 30 PID 1908 wrote to memory of 2648 1908 JaffaCakes118_001869f0c707119d1c61a28d39807809.exe 30 PID 2648 wrote to memory of 2764 2648 JaffaCakes118_001869f0c707119d1c61a28d39807809.exe 31 PID 2648 wrote to memory of 2764 2648 JaffaCakes118_001869f0c707119d1c61a28d39807809.exe 31 PID 2648 wrote to memory of 2764 2648 JaffaCakes118_001869f0c707119d1c61a28d39807809.exe 31 PID 2648 wrote to memory of 2764 2648 JaffaCakes118_001869f0c707119d1c61a28d39807809.exe 31 PID 2648 wrote to memory of 2764 2648 JaffaCakes118_001869f0c707119d1c61a28d39807809.exe 31 PID 2648 wrote to memory of 2764 2648 JaffaCakes118_001869f0c707119d1c61a28d39807809.exe 31 PID 2648 wrote to memory of 2764 2648 JaffaCakes118_001869f0c707119d1c61a28d39807809.exe 31 PID 2648 wrote to memory of 2764 2648 JaffaCakes118_001869f0c707119d1c61a28d39807809.exe 31 PID 2648 wrote to memory of 2764 2648 JaffaCakes118_001869f0c707119d1c61a28d39807809.exe 31 PID 2648 wrote to memory of 2764 2648 JaffaCakes118_001869f0c707119d1c61a28d39807809.exe 31 PID 2648 wrote to memory of 2764 2648 JaffaCakes118_001869f0c707119d1c61a28d39807809.exe 31 PID 2648 wrote to memory of 2764 2648 JaffaCakes118_001869f0c707119d1c61a28d39807809.exe 31 PID 2648 wrote to memory of 2764 2648 JaffaCakes118_001869f0c707119d1c61a28d39807809.exe 31 PID 2764 wrote to memory of 3044 2764 JaffaCakes118_001869f0c707119d1c61a28d39807809.exe 32 PID 2764 wrote to memory of 3044 2764 JaffaCakes118_001869f0c707119d1c61a28d39807809.exe 32 PID 2764 wrote to memory of 3044 2764 JaffaCakes118_001869f0c707119d1c61a28d39807809.exe 32 PID 2764 wrote to memory of 3044 2764 JaffaCakes118_001869f0c707119d1c61a28d39807809.exe 32 PID 3044 wrote to memory of 2672 3044 msdcsc.exe 33 PID 3044 wrote to memory of 2672 3044 msdcsc.exe 33 PID 3044 wrote to memory of 2672 3044 msdcsc.exe 33 PID 3044 wrote to memory of 2672 3044 msdcsc.exe 33 PID 3044 wrote to memory of 2672 3044 msdcsc.exe 33 PID 3044 wrote to memory of 2672 3044 msdcsc.exe 33 PID 3044 wrote to memory of 2672 3044 msdcsc.exe 33 PID 3044 wrote to memory of 2672 3044 msdcsc.exe 33 PID 3044 wrote to memory of 2672 3044 msdcsc.exe 33 PID 3044 wrote to memory of 2672 3044 msdcsc.exe 33 PID 2672 wrote to memory of 2840 2672 msdcsc.exe 34 PID 2672 wrote to memory of 2840 2672 msdcsc.exe 34 PID 2672 wrote to memory of 2840 2672 msdcsc.exe 34 PID 2672 wrote to memory of 2840 2672 msdcsc.exe 34 PID 2672 wrote to memory of 2840 2672 msdcsc.exe 34 PID 2672 wrote to memory of 2840 2672 msdcsc.exe 34 PID 2672 wrote to memory of 2840 2672 msdcsc.exe 34 PID 2672 wrote to memory of 2840 2672 msdcsc.exe 34 PID 2672 wrote to memory of 2840 2672 msdcsc.exe 34 PID 2672 wrote to memory of 2840 2672 msdcsc.exe 34 PID 2672 wrote to memory of 2840 2672 msdcsc.exe 34 PID 2672 wrote to memory of 2840 2672 msdcsc.exe 34 PID 2672 wrote to memory of 2840 2672 msdcsc.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_001869f0c707119d1c61a28d39807809.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_001869f0c707119d1c61a28d39807809.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_001869f0c707119d1c61a28d39807809.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_001869f0c707119d1c61a28d39807809.exe2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_001869f0c707119d1c61a28d39807809.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_001869f0c707119d1c61a28d39807809.exe3⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeC:\Users\Admin\Documents\MSDCSC\msdcsc.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeC:\Users\Admin\Documents\MSDCSC\msdcsc.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2840
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5001869f0c707119d1c61a28d39807809
SHA1395843f369dd1447fa29a2272384e1b73c87012c
SHA256e608dbda1dd28a2ebc5cd824438da519fb5f891792e3e700975132a01ce1b575
SHA512a0fad88a2cf00d3324baed656123ddce7e314558f98029a829d8c1e27a9e4ba126b402b45894d26d49a96e94f4e0a3a896b51bd65d5ba4614d6266bc8db0f29d