Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
95s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25/01/2025, 19:52
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_2f1a1badc1a79faf8a4a0431c263579b.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_2f1a1badc1a79faf8a4a0431c263579b.exe
-
Size
308KB
-
MD5
2f1a1badc1a79faf8a4a0431c263579b
-
SHA1
1e6e83589b5bfc0d537f133c4700957f24e8f61e
-
SHA256
327f07cd24c80890ccb59b357c3b3b43f2677611b79e75a48fea41bd13f9c4bd
-
SHA512
f2011b65ff171f9bd1f345817ca2b762fc67de8daea13fd3c3faf3515f6a21cd5b3fd6bf3634f7bd579dae8cb708d4915a711823b83704ddb5f26d4f9c902a88
-
SSDEEP
6144:C0M4E7FBVUlcGFpbUY9R+rBywLWbvOm8b8yhKJgobfKycJ4nu:C3bnVUlcGjZWynvLHygLKyuK
Malware Config
Extracted
darkcomet
Guest16
severfin.no-ip.biz:10111
DC_MUTEX-KW3265T
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
cm7bvMvxrvgA
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
MicroUpdate
Signatures
-
Darkcomet family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" svchost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation svchost.exe -
Executes dropped EXE 2 IoCs
pid Process 4748 svchost.exe 3560 msdcsc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Java = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Java.exe" JaffaCakes118_2f1a1badc1a79faf8a4a0431c263579b.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1216 set thread context of 4748 1216 JaffaCakes118_2f1a1badc1a79faf8a4a0431c263579b.exe 85 -
resource yara_rule behavioral2/memory/4748-5-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4748-9-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4748-13-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4748-11-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4748-15-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4748-14-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/4748-31-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdcsc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_2f1a1badc1a79faf8a4a0431c263579b.exe -
Suspicious use of AdjustPrivilegeToken 25 IoCs
description pid Process Token: SeDebugPrivilege 1216 JaffaCakes118_2f1a1badc1a79faf8a4a0431c263579b.exe Token: SeIncreaseQuotaPrivilege 4748 svchost.exe Token: SeSecurityPrivilege 4748 svchost.exe Token: SeTakeOwnershipPrivilege 4748 svchost.exe Token: SeLoadDriverPrivilege 4748 svchost.exe Token: SeSystemProfilePrivilege 4748 svchost.exe Token: SeSystemtimePrivilege 4748 svchost.exe Token: SeProfSingleProcessPrivilege 4748 svchost.exe Token: SeIncBasePriorityPrivilege 4748 svchost.exe Token: SeCreatePagefilePrivilege 4748 svchost.exe Token: SeBackupPrivilege 4748 svchost.exe Token: SeRestorePrivilege 4748 svchost.exe Token: SeShutdownPrivilege 4748 svchost.exe Token: SeDebugPrivilege 4748 svchost.exe Token: SeSystemEnvironmentPrivilege 4748 svchost.exe Token: SeChangeNotifyPrivilege 4748 svchost.exe Token: SeRemoteShutdownPrivilege 4748 svchost.exe Token: SeUndockPrivilege 4748 svchost.exe Token: SeManageVolumePrivilege 4748 svchost.exe Token: SeImpersonatePrivilege 4748 svchost.exe Token: SeCreateGlobalPrivilege 4748 svchost.exe Token: 33 4748 svchost.exe Token: 34 4748 svchost.exe Token: 35 4748 svchost.exe Token: 36 4748 svchost.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1216 wrote to memory of 4748 1216 JaffaCakes118_2f1a1badc1a79faf8a4a0431c263579b.exe 85 PID 1216 wrote to memory of 4748 1216 JaffaCakes118_2f1a1badc1a79faf8a4a0431c263579b.exe 85 PID 1216 wrote to memory of 4748 1216 JaffaCakes118_2f1a1badc1a79faf8a4a0431c263579b.exe 85 PID 1216 wrote to memory of 4748 1216 JaffaCakes118_2f1a1badc1a79faf8a4a0431c263579b.exe 85 PID 1216 wrote to memory of 4748 1216 JaffaCakes118_2f1a1badc1a79faf8a4a0431c263579b.exe 85 PID 1216 wrote to memory of 4748 1216 JaffaCakes118_2f1a1badc1a79faf8a4a0431c263579b.exe 85 PID 1216 wrote to memory of 4748 1216 JaffaCakes118_2f1a1badc1a79faf8a4a0431c263579b.exe 85 PID 1216 wrote to memory of 4748 1216 JaffaCakes118_2f1a1badc1a79faf8a4a0431c263579b.exe 85 PID 4748 wrote to memory of 3560 4748 svchost.exe 86 PID 4748 wrote to memory of 3560 4748 svchost.exe 86 PID 4748 wrote to memory of 3560 4748 svchost.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2f1a1badc1a79faf8a4a0431c263579b.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2f1a1badc1a79faf8a4a0431c263579b.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\svchost.exe2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3560
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
34KB
MD5e118330b4629b12368d91b9df6488be0
SHA1ce90218c7e3b90df2a3409ec253048bb6472c2fd
SHA2563a0f2936b8c45e8ba3458d69d7859a63844469e698652e15fb56639d32f40cc9
SHA512ac91c04cb20223dbaaf594440cb778dff36e857921be427c8528ba4c6cdb3e8bf8e71e1ae8af7bde9c04ff5b97b379231625bc1a2b66aba2f98cd340cd8a94b0