Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21/01/2025, 09:52
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_03b794dd5a1f48698efaba82986e0c24.exe
Resource
win7-20240729-en
General
-
Target
JaffaCakes118_03b794dd5a1f48698efaba82986e0c24.exe
-
Size
2.5MB
-
MD5
03b794dd5a1f48698efaba82986e0c24
-
SHA1
8abe8064f81f8bcd7d04b19dc59bb98333908ce6
-
SHA256
35b1fc1278b92658c6e6af725253aaf7a060f69fdc58e3a2a696ca9fbc799c81
-
SHA512
36e6956e5a5b92af08658c1770f3da017b63bc630e5533016d67d09abd7870a01033b12d2aa31b0b727ba1e268fe80bf1f35f9152cf2bd058628e379a37cffd7
-
SSDEEP
49152:S/SJ5InRTIKCzHuLLiNUlNeHmFpAh+CJdZbSoIfKN5lH9aDHD89t:sSJXZHmOmokpEvJpoI7H9aDj8
Malware Config
Extracted
darkcomet
Guest16
cucu.no-ip.org:1500
DC_MUTEX-23UB63C
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
naPTMgVpHACh
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
MicroUpdate
Signatures
-
Darkcomet family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\MSDCSC\\msdcsc.exe" trojan.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation JaffaCakes118_03b794dd5a1f48698efaba82986e0c24.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation trojan.exe -
Executes dropped EXE 5 IoCs
pid Process 3636 trojan.exe 1936 LBoF6.exe 4520 msdcsc.exe 1932 LBoF6.exe 5068 LBoF6.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\MSDCSC\\msdcsc.exe" trojan.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 JaffaCakes118_03b794dd5a1f48698efaba82986e0c24.exe File opened for modification \??\PhysicalDrive0 LBoF6.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3256 set thread context of 2860 3256 JaffaCakes118_03b794dd5a1f48698efaba82986e0c24.exe 84 PID 1936 set thread context of 1932 1936 LBoF6.exe 89 PID 1932 set thread context of 5068 1932 LBoF6.exe 90 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_03b794dd5a1f48698efaba82986e0c24.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_03b794dd5a1f48698efaba82986e0c24.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language trojan.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LBoF6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdcsc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LBoF6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LBoF6.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3636 trojan.exe Token: SeSecurityPrivilege 3636 trojan.exe Token: SeTakeOwnershipPrivilege 3636 trojan.exe Token: SeLoadDriverPrivilege 3636 trojan.exe Token: SeSystemProfilePrivilege 3636 trojan.exe Token: SeSystemtimePrivilege 3636 trojan.exe Token: SeProfSingleProcessPrivilege 3636 trojan.exe Token: SeIncBasePriorityPrivilege 3636 trojan.exe Token: SeCreatePagefilePrivilege 3636 trojan.exe Token: SeBackupPrivilege 3636 trojan.exe Token: SeRestorePrivilege 3636 trojan.exe Token: SeShutdownPrivilege 3636 trojan.exe Token: SeDebugPrivilege 3636 trojan.exe Token: SeSystemEnvironmentPrivilege 3636 trojan.exe Token: SeChangeNotifyPrivilege 3636 trojan.exe Token: SeRemoteShutdownPrivilege 3636 trojan.exe Token: SeUndockPrivilege 3636 trojan.exe Token: SeManageVolumePrivilege 3636 trojan.exe Token: SeImpersonatePrivilege 3636 trojan.exe Token: SeCreateGlobalPrivilege 3636 trojan.exe Token: 33 3636 trojan.exe Token: 34 3636 trojan.exe Token: 35 3636 trojan.exe Token: 36 3636 trojan.exe Token: SeIncreaseQuotaPrivilege 4520 msdcsc.exe Token: SeSecurityPrivilege 4520 msdcsc.exe Token: SeTakeOwnershipPrivilege 4520 msdcsc.exe Token: SeLoadDriverPrivilege 4520 msdcsc.exe Token: SeSystemProfilePrivilege 4520 msdcsc.exe Token: SeSystemtimePrivilege 4520 msdcsc.exe Token: SeProfSingleProcessPrivilege 4520 msdcsc.exe Token: SeIncBasePriorityPrivilege 4520 msdcsc.exe Token: SeCreatePagefilePrivilege 4520 msdcsc.exe Token: SeBackupPrivilege 4520 msdcsc.exe Token: SeRestorePrivilege 4520 msdcsc.exe Token: SeShutdownPrivilege 4520 msdcsc.exe Token: SeDebugPrivilege 4520 msdcsc.exe Token: SeSystemEnvironmentPrivilege 4520 msdcsc.exe Token: SeChangeNotifyPrivilege 4520 msdcsc.exe Token: SeRemoteShutdownPrivilege 4520 msdcsc.exe Token: SeUndockPrivilege 4520 msdcsc.exe Token: SeManageVolumePrivilege 4520 msdcsc.exe Token: SeImpersonatePrivilege 4520 msdcsc.exe Token: SeCreateGlobalPrivilege 4520 msdcsc.exe Token: 33 4520 msdcsc.exe Token: 34 4520 msdcsc.exe Token: 35 4520 msdcsc.exe Token: 36 4520 msdcsc.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 3256 JaffaCakes118_03b794dd5a1f48698efaba82986e0c24.exe 2860 JaffaCakes118_03b794dd5a1f48698efaba82986e0c24.exe 1936 LBoF6.exe 4520 msdcsc.exe 1932 LBoF6.exe 5068 LBoF6.exe 5068 LBoF6.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 3256 wrote to memory of 2860 3256 JaffaCakes118_03b794dd5a1f48698efaba82986e0c24.exe 84 PID 3256 wrote to memory of 2860 3256 JaffaCakes118_03b794dd5a1f48698efaba82986e0c24.exe 84 PID 3256 wrote to memory of 2860 3256 JaffaCakes118_03b794dd5a1f48698efaba82986e0c24.exe 84 PID 3256 wrote to memory of 2860 3256 JaffaCakes118_03b794dd5a1f48698efaba82986e0c24.exe 84 PID 3256 wrote to memory of 2860 3256 JaffaCakes118_03b794dd5a1f48698efaba82986e0c24.exe 84 PID 3256 wrote to memory of 2860 3256 JaffaCakes118_03b794dd5a1f48698efaba82986e0c24.exe 84 PID 3256 wrote to memory of 2860 3256 JaffaCakes118_03b794dd5a1f48698efaba82986e0c24.exe 84 PID 3256 wrote to memory of 2860 3256 JaffaCakes118_03b794dd5a1f48698efaba82986e0c24.exe 84 PID 2860 wrote to memory of 3636 2860 JaffaCakes118_03b794dd5a1f48698efaba82986e0c24.exe 85 PID 2860 wrote to memory of 3636 2860 JaffaCakes118_03b794dd5a1f48698efaba82986e0c24.exe 85 PID 2860 wrote to memory of 3636 2860 JaffaCakes118_03b794dd5a1f48698efaba82986e0c24.exe 85 PID 2860 wrote to memory of 1936 2860 JaffaCakes118_03b794dd5a1f48698efaba82986e0c24.exe 86 PID 2860 wrote to memory of 1936 2860 JaffaCakes118_03b794dd5a1f48698efaba82986e0c24.exe 86 PID 2860 wrote to memory of 1936 2860 JaffaCakes118_03b794dd5a1f48698efaba82986e0c24.exe 86 PID 3636 wrote to memory of 4520 3636 trojan.exe 87 PID 3636 wrote to memory of 4520 3636 trojan.exe 87 PID 3636 wrote to memory of 4520 3636 trojan.exe 87 PID 1936 wrote to memory of 1932 1936 LBoF6.exe 89 PID 1936 wrote to memory of 1932 1936 LBoF6.exe 89 PID 1936 wrote to memory of 1932 1936 LBoF6.exe 89 PID 1936 wrote to memory of 1932 1936 LBoF6.exe 89 PID 1936 wrote to memory of 1932 1936 LBoF6.exe 89 PID 1936 wrote to memory of 1932 1936 LBoF6.exe 89 PID 1936 wrote to memory of 1932 1936 LBoF6.exe 89 PID 1936 wrote to memory of 1932 1936 LBoF6.exe 89 PID 1932 wrote to memory of 5068 1932 LBoF6.exe 90 PID 1932 wrote to memory of 5068 1932 LBoF6.exe 90 PID 1932 wrote to memory of 5068 1932 LBoF6.exe 90 PID 1932 wrote to memory of 5068 1932 LBoF6.exe 90 PID 1932 wrote to memory of 5068 1932 LBoF6.exe 90 PID 1932 wrote to memory of 5068 1932 LBoF6.exe 90 PID 1932 wrote to memory of 5068 1932 LBoF6.exe 90 PID 1932 wrote to memory of 5068 1932 LBoF6.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_03b794dd5a1f48698efaba82986e0c24.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_03b794dd5a1f48698efaba82986e0c24.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_03b794dd5a1f48698efaba82986e0c24.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_03b794dd5a1f48698efaba82986e0c24.exe"2⤵
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\trojan.exe"C:\Users\Admin\AppData\Local\Temp\trojan.exe"3⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe"C:\ProgramData\Microsoft\Windows\Start Menu\MSDCSC\msdcsc.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4520
-
-
-
C:\Users\Admin\AppData\Local\Temp\LBoF6.exe"C:\Users\Admin\AppData\Local\Temp\LBoF6.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\LBoF6.exe"C:\Users\Admin\AppData\Local\Temp\LBoF6.exe"4⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\LBoF6.exe"C:\Users\Admin\AppData\Local\Temp\LBoF6.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5068
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5337d4b79a668a7cdf6f9535476222062
SHA12cc60501c6541dcfd0ffd9d6c6f7915964baac1a
SHA256a8a902657a802233269065ec6f3561a1c609567e2aa5c22ad4d18a38e1bef101
SHA512305cb6956e960eab0f25f94deb3c7dbdd3fc60af3b4be070d9441ae7c229d50b5117c53abdf85fe2713a9e8875c32a81c36234ab72724e74025bd6646572be39
-
Filesize
660KB
MD5bdf4c532e7a22cbe0fe391ff3928b9f2
SHA1f965ae04198d63dfd72dd519f9d5273ef268adbb
SHA25697bbfbaba5b573d5f55658883e93e4bca98619a85898a937103b8d0cd012bd8e
SHA51204a031ab74f6ee636288780fd5cfa704d4afb7ac0a1f9dc0543db6fec2fdb9aa93552aea8306aca2562e4238d522da745a140f9177c6229c6724ac5c5a32c71b