Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
22/01/2025, 06:24
Behavioral task
behavioral1
Sample
JaffaCakes118_0b1fab19dd007270cb56fa3220f71712.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_0b1fab19dd007270cb56fa3220f71712.exe
-
Size
658KB
-
MD5
0b1fab19dd007270cb56fa3220f71712
-
SHA1
ac80ef7bc1b9f6951f398977a8f3f6572e66f9b9
-
SHA256
52d93be4d86690b5ecd529dd5825151542196dded9b28125f39e92c583f603b8
-
SHA512
e6b35a11278ab6fa8bb1da49c2c780d05a5c77b8d93ab0baeb431d5d002bac5a2a0a719fdb8f8058780d9d04f384644a3fff35b4a0c23dd7e419b44bb69c87a8
-
SSDEEP
12288:y9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hF:eZ1xuVVjfFoynPaVBUR8f+kN10EB3
Malware Config
Extracted
darkcomet
Guest16
spyderrrr.no-ip.org:25565
DC_MUTEX-QAATZ9T
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
oBG9XVMzL9fQ
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Darkcomet family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" JaffaCakes118_0b1fab19dd007270cb56fa3220f71712.exe -
Executes dropped EXE 1 IoCs
pid Process 2896 msdcsc.exe -
Loads dropped DLL 2 IoCs
pid Process 2888 JaffaCakes118_0b1fab19dd007270cb56fa3220f71712.exe 2888 JaffaCakes118_0b1fab19dd007270cb56fa3220f71712.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" JaffaCakes118_0b1fab19dd007270cb56fa3220f71712.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" msdcsc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_0b1fab19dd007270cb56fa3220f71712.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2888 JaffaCakes118_0b1fab19dd007270cb56fa3220f71712.exe Token: SeSecurityPrivilege 2888 JaffaCakes118_0b1fab19dd007270cb56fa3220f71712.exe Token: SeTakeOwnershipPrivilege 2888 JaffaCakes118_0b1fab19dd007270cb56fa3220f71712.exe Token: SeLoadDriverPrivilege 2888 JaffaCakes118_0b1fab19dd007270cb56fa3220f71712.exe Token: SeSystemProfilePrivilege 2888 JaffaCakes118_0b1fab19dd007270cb56fa3220f71712.exe Token: SeSystemtimePrivilege 2888 JaffaCakes118_0b1fab19dd007270cb56fa3220f71712.exe Token: SeProfSingleProcessPrivilege 2888 JaffaCakes118_0b1fab19dd007270cb56fa3220f71712.exe Token: SeIncBasePriorityPrivilege 2888 JaffaCakes118_0b1fab19dd007270cb56fa3220f71712.exe Token: SeCreatePagefilePrivilege 2888 JaffaCakes118_0b1fab19dd007270cb56fa3220f71712.exe Token: SeBackupPrivilege 2888 JaffaCakes118_0b1fab19dd007270cb56fa3220f71712.exe Token: SeRestorePrivilege 2888 JaffaCakes118_0b1fab19dd007270cb56fa3220f71712.exe Token: SeShutdownPrivilege 2888 JaffaCakes118_0b1fab19dd007270cb56fa3220f71712.exe Token: SeDebugPrivilege 2888 JaffaCakes118_0b1fab19dd007270cb56fa3220f71712.exe Token: SeSystemEnvironmentPrivilege 2888 JaffaCakes118_0b1fab19dd007270cb56fa3220f71712.exe Token: SeChangeNotifyPrivilege 2888 JaffaCakes118_0b1fab19dd007270cb56fa3220f71712.exe Token: SeRemoteShutdownPrivilege 2888 JaffaCakes118_0b1fab19dd007270cb56fa3220f71712.exe Token: SeUndockPrivilege 2888 JaffaCakes118_0b1fab19dd007270cb56fa3220f71712.exe Token: SeManageVolumePrivilege 2888 JaffaCakes118_0b1fab19dd007270cb56fa3220f71712.exe Token: SeImpersonatePrivilege 2888 JaffaCakes118_0b1fab19dd007270cb56fa3220f71712.exe Token: SeCreateGlobalPrivilege 2888 JaffaCakes118_0b1fab19dd007270cb56fa3220f71712.exe Token: 33 2888 JaffaCakes118_0b1fab19dd007270cb56fa3220f71712.exe Token: 34 2888 JaffaCakes118_0b1fab19dd007270cb56fa3220f71712.exe Token: 35 2888 JaffaCakes118_0b1fab19dd007270cb56fa3220f71712.exe Token: SeIncreaseQuotaPrivilege 2896 msdcsc.exe Token: SeSecurityPrivilege 2896 msdcsc.exe Token: SeTakeOwnershipPrivilege 2896 msdcsc.exe Token: SeLoadDriverPrivilege 2896 msdcsc.exe Token: SeSystemProfilePrivilege 2896 msdcsc.exe Token: SeSystemtimePrivilege 2896 msdcsc.exe Token: SeProfSingleProcessPrivilege 2896 msdcsc.exe Token: SeIncBasePriorityPrivilege 2896 msdcsc.exe Token: SeCreatePagefilePrivilege 2896 msdcsc.exe Token: SeBackupPrivilege 2896 msdcsc.exe Token: SeRestorePrivilege 2896 msdcsc.exe Token: SeShutdownPrivilege 2896 msdcsc.exe Token: SeDebugPrivilege 2896 msdcsc.exe Token: SeSystemEnvironmentPrivilege 2896 msdcsc.exe Token: SeChangeNotifyPrivilege 2896 msdcsc.exe Token: SeRemoteShutdownPrivilege 2896 msdcsc.exe Token: SeUndockPrivilege 2896 msdcsc.exe Token: SeManageVolumePrivilege 2896 msdcsc.exe Token: SeImpersonatePrivilege 2896 msdcsc.exe Token: SeCreateGlobalPrivilege 2896 msdcsc.exe Token: 33 2896 msdcsc.exe Token: 34 2896 msdcsc.exe Token: 35 2896 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2896 msdcsc.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 2888 wrote to memory of 2896 2888 JaffaCakes118_0b1fab19dd007270cb56fa3220f71712.exe 30 PID 2888 wrote to memory of 2896 2888 JaffaCakes118_0b1fab19dd007270cb56fa3220f71712.exe 30 PID 2888 wrote to memory of 2896 2888 JaffaCakes118_0b1fab19dd007270cb56fa3220f71712.exe 30 PID 2888 wrote to memory of 2896 2888 JaffaCakes118_0b1fab19dd007270cb56fa3220f71712.exe 30 PID 2896 wrote to memory of 2612 2896 msdcsc.exe 31 PID 2896 wrote to memory of 2612 2896 msdcsc.exe 31 PID 2896 wrote to memory of 2612 2896 msdcsc.exe 31 PID 2896 wrote to memory of 2612 2896 msdcsc.exe 31 PID 2896 wrote to memory of 2612 2896 msdcsc.exe 31 PID 2896 wrote to memory of 2612 2896 msdcsc.exe 31 PID 2896 wrote to memory of 2612 2896 msdcsc.exe 31 PID 2896 wrote to memory of 2612 2896 msdcsc.exe 31 PID 2896 wrote to memory of 2612 2896 msdcsc.exe 31 PID 2896 wrote to memory of 2612 2896 msdcsc.exe 31 PID 2896 wrote to memory of 2612 2896 msdcsc.exe 31 PID 2896 wrote to memory of 2612 2896 msdcsc.exe 31 PID 2896 wrote to memory of 2612 2896 msdcsc.exe 31 PID 2896 wrote to memory of 2612 2896 msdcsc.exe 31 PID 2896 wrote to memory of 2612 2896 msdcsc.exe 31 PID 2896 wrote to memory of 2612 2896 msdcsc.exe 31 PID 2896 wrote to memory of 2612 2896 msdcsc.exe 31 PID 2896 wrote to memory of 2612 2896 msdcsc.exe 31 PID 2896 wrote to memory of 2612 2896 msdcsc.exe 31 PID 2896 wrote to memory of 2612 2896 msdcsc.exe 31 PID 2896 wrote to memory of 2612 2896 msdcsc.exe 31 PID 2896 wrote to memory of 2612 2896 msdcsc.exe 31 PID 2896 wrote to memory of 2612 2896 msdcsc.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0b1fab19dd007270cb56fa3220f71712.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0b1fab19dd007270cb56fa3220f71712.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\SysWOW64\notepad.exenotepad3⤵
- System Location Discovery: System Language Discovery
PID:2612
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
658KB
MD50b1fab19dd007270cb56fa3220f71712
SHA1ac80ef7bc1b9f6951f398977a8f3f6572e66f9b9
SHA25652d93be4d86690b5ecd529dd5825151542196dded9b28125f39e92c583f603b8
SHA512e6b35a11278ab6fa8bb1da49c2c780d05a5c77b8d93ab0baeb431d5d002bac5a2a0a719fdb8f8058780d9d04f384644a3fff35b4a0c23dd7e419b44bb69c87a8