Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20250207-en -
resource tags
arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system -
submitted
20/02/2025, 02:37
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_092362ef67e69075208c724ae99293e7.exe
Resource
win7-20250207-en
Behavioral task
behavioral2
Sample
JaffaCakes118_092362ef67e69075208c724ae99293e7.exe
Resource
win10v2004-20250217-en
General
-
Target
JaffaCakes118_092362ef67e69075208c724ae99293e7.exe
-
Size
1.8MB
-
MD5
092362ef67e69075208c724ae99293e7
-
SHA1
5461580bd10ff1f995793c66033d12b53bf56f85
-
SHA256
1076ec5e878c8e71d9430d078799dd0a4d775ad2a23120e38cd8bb93b37e4d70
-
SHA512
53bd7ade262e421d1726ad79c636919507750ba9b0b7dc34cc7778165cc4fbd474cfb2dd4851f5d5ffc17bb69e53ac0ee557af22818fbb4cf220100974bf38f1
-
SSDEEP
24576:MMWFK6ZlLOZ2j9cRTPSqANPah6ZFaBLOPZVKTsSxK7:coa9uSqAVa1Cs/K
Malware Config
Extracted
darkcomet
Opfer
panzaknacka.hopto.org:1337
MAC-7UVFFZ6
-
InstallPath
MSDCSC\sysdate.exe
-
gencode
5KLmF0Xbpz15
-
install
true
-
offline_keylogger
true
-
password
l0rn
-
persistence
false
-
reg_key
sysdate.exe
Signatures
-
Darkcomet family
-
ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
-
ISR Stealer payload 4 IoCs
resource yara_rule behavioral1/memory/2900-21-0x0000000000400000-0x0000000000470000-memory.dmp family_isrstealer behavioral1/memory/2900-23-0x0000000000400000-0x0000000000470000-memory.dmp family_isrstealer behavioral1/memory/2900-17-0x0000000000400000-0x0000000000470000-memory.dmp family_isrstealer behavioral1/memory/2900-84-0x0000000000400000-0x0000000000470000-memory.dmp family_isrstealer -
Isrstealer family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\sysdate.exe" vbc.exe -
Detected Nirsoft tools 8 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule behavioral1/memory/2552-60-0x0000000000400000-0x0000000000454000-memory.dmp Nirsoft behavioral1/memory/3032-78-0x0000000000400000-0x000000000041F000-memory.dmp Nirsoft behavioral1/memory/2072-77-0x0000000000400000-0x0000000000426000-memory.dmp Nirsoft behavioral1/memory/2072-68-0x0000000000400000-0x0000000000426000-memory.dmp Nirsoft behavioral1/memory/2072-67-0x0000000000400000-0x0000000000426000-memory.dmp Nirsoft behavioral1/memory/2552-61-0x0000000000400000-0x0000000000454000-memory.dmp Nirsoft behavioral1/memory/2552-87-0x0000000000400000-0x0000000000454000-memory.dmp Nirsoft behavioral1/memory/3032-90-0x0000000000400000-0x000000000041F000-memory.dmp Nirsoft -
NirSoft MailPassView 2 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral1/memory/3032-78-0x0000000000400000-0x000000000041F000-memory.dmp MailPassView behavioral1/memory/3032-90-0x0000000000400000-0x000000000041F000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 3 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral1/memory/2552-60-0x0000000000400000-0x0000000000454000-memory.dmp WebBrowserPassView behavioral1/memory/2552-61-0x0000000000400000-0x0000000000454000-memory.dmp WebBrowserPassView behavioral1/memory/2552-87-0x0000000000400000-0x0000000000454000-memory.dmp WebBrowserPassView -
Executes dropped EXE 1 IoCs
pid Process 2644 sysdate.exe -
Loads dropped DLL 1 IoCs
pid Process 2828 vbc.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Windows\CurrentVersion\Run\sysdate.exe = "C:\\Windows\\system32\\MSDCSC\\sysdate.exe" vbc.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\MSDCSC\sysdate.exe vbc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\sysdate.exe vbc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\ vbc.exe -
Suspicious use of SetThreadContext 6 IoCs
description pid Process procid_target PID 2780 set thread context of 2828 2780 JaffaCakes118_092362ef67e69075208c724ae99293e7.exe 31 PID 2780 set thread context of 2900 2780 JaffaCakes118_092362ef67e69075208c724ae99293e7.exe 33 PID 2900 set thread context of 2940 2900 vbc.exe 36 PID 2940 set thread context of 2552 2940 vbc.exe 37 PID 2940 set thread context of 2072 2940 vbc.exe 38 PID 2940 set thread context of 3032 2940 vbc.exe 39 -
resource yara_rule behavioral1/memory/2828-6-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2828-10-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2828-11-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2828-12-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2828-7-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2828-24-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2828-27-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2828-29-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2828-28-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2828-26-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2072-65-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral1/memory/3032-75-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/3032-78-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/2072-77-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral1/memory/3032-74-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral1/memory/2072-68-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral1/memory/2072-67-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral1/memory/2072-66-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral1/memory/2828-82-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/3032-90-0x0000000000400000-0x000000000041F000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_092362ef67e69075208c724ae99293e7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2900 vbc.exe 2900 vbc.exe 2900 vbc.exe 2900 vbc.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2828 vbc.exe Token: SeSecurityPrivilege 2828 vbc.exe Token: SeTakeOwnershipPrivilege 2828 vbc.exe Token: SeLoadDriverPrivilege 2828 vbc.exe Token: SeSystemProfilePrivilege 2828 vbc.exe Token: SeSystemtimePrivilege 2828 vbc.exe Token: SeProfSingleProcessPrivilege 2828 vbc.exe Token: SeIncBasePriorityPrivilege 2828 vbc.exe Token: SeCreatePagefilePrivilege 2828 vbc.exe Token: SeBackupPrivilege 2828 vbc.exe Token: SeRestorePrivilege 2828 vbc.exe Token: SeShutdownPrivilege 2828 vbc.exe Token: SeDebugPrivilege 2828 vbc.exe Token: SeSystemEnvironmentPrivilege 2828 vbc.exe Token: SeChangeNotifyPrivilege 2828 vbc.exe Token: SeRemoteShutdownPrivilege 2828 vbc.exe Token: SeUndockPrivilege 2828 vbc.exe Token: SeManageVolumePrivilege 2828 vbc.exe Token: SeImpersonatePrivilege 2828 vbc.exe Token: SeCreateGlobalPrivilege 2828 vbc.exe Token: 33 2828 vbc.exe Token: 34 2828 vbc.exe Token: 35 2828 vbc.exe Token: SeDebugPrivilege 2072 vbc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2900 vbc.exe -
Suspicious use of WriteProcessMemory 58 IoCs
description pid Process procid_target PID 2780 wrote to memory of 2856 2780 JaffaCakes118_092362ef67e69075208c724ae99293e7.exe 30 PID 2780 wrote to memory of 2856 2780 JaffaCakes118_092362ef67e69075208c724ae99293e7.exe 30 PID 2780 wrote to memory of 2856 2780 JaffaCakes118_092362ef67e69075208c724ae99293e7.exe 30 PID 2780 wrote to memory of 2856 2780 JaffaCakes118_092362ef67e69075208c724ae99293e7.exe 30 PID 2780 wrote to memory of 2828 2780 JaffaCakes118_092362ef67e69075208c724ae99293e7.exe 31 PID 2780 wrote to memory of 2828 2780 JaffaCakes118_092362ef67e69075208c724ae99293e7.exe 31 PID 2780 wrote to memory of 2828 2780 JaffaCakes118_092362ef67e69075208c724ae99293e7.exe 31 PID 2780 wrote to memory of 2828 2780 JaffaCakes118_092362ef67e69075208c724ae99293e7.exe 31 PID 2780 wrote to memory of 2828 2780 JaffaCakes118_092362ef67e69075208c724ae99293e7.exe 31 PID 2780 wrote to memory of 2828 2780 JaffaCakes118_092362ef67e69075208c724ae99293e7.exe 31 PID 2780 wrote to memory of 2828 2780 JaffaCakes118_092362ef67e69075208c724ae99293e7.exe 31 PID 2780 wrote to memory of 2828 2780 JaffaCakes118_092362ef67e69075208c724ae99293e7.exe 31 PID 2780 wrote to memory of 1856 2780 JaffaCakes118_092362ef67e69075208c724ae99293e7.exe 32 PID 2780 wrote to memory of 1856 2780 JaffaCakes118_092362ef67e69075208c724ae99293e7.exe 32 PID 2780 wrote to memory of 1856 2780 JaffaCakes118_092362ef67e69075208c724ae99293e7.exe 32 PID 2780 wrote to memory of 1856 2780 JaffaCakes118_092362ef67e69075208c724ae99293e7.exe 32 PID 2780 wrote to memory of 2900 2780 JaffaCakes118_092362ef67e69075208c724ae99293e7.exe 33 PID 2780 wrote to memory of 2900 2780 JaffaCakes118_092362ef67e69075208c724ae99293e7.exe 33 PID 2780 wrote to memory of 2900 2780 JaffaCakes118_092362ef67e69075208c724ae99293e7.exe 33 PID 2780 wrote to memory of 2900 2780 JaffaCakes118_092362ef67e69075208c724ae99293e7.exe 33 PID 2780 wrote to memory of 2900 2780 JaffaCakes118_092362ef67e69075208c724ae99293e7.exe 33 PID 2780 wrote to memory of 2900 2780 JaffaCakes118_092362ef67e69075208c724ae99293e7.exe 33 PID 2780 wrote to memory of 2900 2780 JaffaCakes118_092362ef67e69075208c724ae99293e7.exe 33 PID 2780 wrote to memory of 2900 2780 JaffaCakes118_092362ef67e69075208c724ae99293e7.exe 33 PID 2828 wrote to memory of 2644 2828 vbc.exe 34 PID 2828 wrote to memory of 2644 2828 vbc.exe 34 PID 2828 wrote to memory of 2644 2828 vbc.exe 34 PID 2828 wrote to memory of 2644 2828 vbc.exe 34 PID 2900 wrote to memory of 2940 2900 vbc.exe 36 PID 2900 wrote to memory of 2940 2900 vbc.exe 36 PID 2900 wrote to memory of 2940 2900 vbc.exe 36 PID 2900 wrote to memory of 2940 2900 vbc.exe 36 PID 2900 wrote to memory of 2940 2900 vbc.exe 36 PID 2900 wrote to memory of 2940 2900 vbc.exe 36 PID 2900 wrote to memory of 2940 2900 vbc.exe 36 PID 2900 wrote to memory of 2940 2900 vbc.exe 36 PID 2900 wrote to memory of 2940 2900 vbc.exe 36 PID 2900 wrote to memory of 2940 2900 vbc.exe 36 PID 2900 wrote to memory of 2940 2900 vbc.exe 36 PID 2900 wrote to memory of 2940 2900 vbc.exe 36 PID 2940 wrote to memory of 2552 2940 vbc.exe 37 PID 2940 wrote to memory of 2552 2940 vbc.exe 37 PID 2940 wrote to memory of 2552 2940 vbc.exe 37 PID 2940 wrote to memory of 2552 2940 vbc.exe 37 PID 2940 wrote to memory of 2552 2940 vbc.exe 37 PID 2940 wrote to memory of 2552 2940 vbc.exe 37 PID 2940 wrote to memory of 2072 2940 vbc.exe 38 PID 2940 wrote to memory of 2072 2940 vbc.exe 38 PID 2940 wrote to memory of 2072 2940 vbc.exe 38 PID 2940 wrote to memory of 2072 2940 vbc.exe 38 PID 2940 wrote to memory of 2072 2940 vbc.exe 38 PID 2940 wrote to memory of 2072 2940 vbc.exe 38 PID 2940 wrote to memory of 3032 2940 vbc.exe 39 PID 2940 wrote to memory of 3032 2940 vbc.exe 39 PID 2940 wrote to memory of 3032 2940 vbc.exe 39 PID 2940 wrote to memory of 3032 2940 vbc.exe 39 PID 2940 wrote to memory of 3032 2940 vbc.exe 39 PID 2940 wrote to memory of 3032 2940 vbc.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_092362ef67e69075208c724ae99293e7.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_092362ef67e69075208c724ae99293e7.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe2⤵PID:2856
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe2⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\SysWOW64\MSDCSC\sysdate.exe"C:\Windows\system32\MSDCSC\sysdate.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2644
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe2⤵PID:1856
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /scomma C:\Users\Admin\AppData\Local\Temp\data.dmp4⤵
- System Location Discovery: System Language Discovery
PID:2552
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /scomma C:\Users\Admin\AppData\Local\Temp\data1.dmp4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2072
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /scomma C:\Users\Admin\AppData\Local\Temp\data2.dmp4⤵
- Accesses Microsoft Outlook accounts
- System Location Discovery: System Language Discovery
PID:3032
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98