Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
20/02/2025, 02:37
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_092362ef67e69075208c724ae99293e7.exe
Resource
win7-20250207-en
Behavioral task
behavioral2
Sample
JaffaCakes118_092362ef67e69075208c724ae99293e7.exe
Resource
win10v2004-20250217-en
General
-
Target
JaffaCakes118_092362ef67e69075208c724ae99293e7.exe
-
Size
1.8MB
-
MD5
092362ef67e69075208c724ae99293e7
-
SHA1
5461580bd10ff1f995793c66033d12b53bf56f85
-
SHA256
1076ec5e878c8e71d9430d078799dd0a4d775ad2a23120e38cd8bb93b37e4d70
-
SHA512
53bd7ade262e421d1726ad79c636919507750ba9b0b7dc34cc7778165cc4fbd474cfb2dd4851f5d5ffc17bb69e53ac0ee557af22818fbb4cf220100974bf38f1
-
SSDEEP
24576:MMWFK6ZlLOZ2j9cRTPSqANPah6ZFaBLOPZVKTsSxK7:coa9uSqAVa1Cs/K
Malware Config
Extracted
darkcomet
Opfer
panzaknacka.hopto.org:1337
MAC-7UVFFZ6
-
InstallPath
MSDCSC\sysdate.exe
-
gencode
5KLmF0Xbpz15
-
install
true
-
offline_keylogger
true
-
password
l0rn
-
persistence
false
-
reg_key
sysdate.exe
Signatures
-
Darkcomet family
-
ISR Stealer
ISR Stealer is a modified version of Hackhound Stealer written in visual basic.
-
ISR Stealer payload 3 IoCs
resource yara_rule behavioral2/memory/3000-6-0x0000000000400000-0x0000000000470000-memory.dmp family_isrstealer behavioral2/memory/3000-9-0x0000000000400000-0x0000000000470000-memory.dmp family_isrstealer behavioral2/memory/3000-56-0x0000000000400000-0x0000000000470000-memory.dmp family_isrstealer -
Isrstealer family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\sysdate.exe" vbc.exe -
Detected Nirsoft tools 9 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule behavioral2/memory/552-23-0x0000000000400000-0x0000000000454000-memory.dmp Nirsoft behavioral2/memory/552-25-0x0000000000400000-0x0000000000454000-memory.dmp Nirsoft behavioral2/memory/1092-35-0x0000000000400000-0x0000000000426000-memory.dmp Nirsoft behavioral2/memory/552-42-0x0000000000400000-0x0000000000454000-memory.dmp Nirsoft behavioral2/memory/2512-47-0x0000000000400000-0x000000000041F000-memory.dmp Nirsoft behavioral2/memory/1092-40-0x0000000000400000-0x0000000000426000-memory.dmp Nirsoft behavioral2/memory/552-34-0x0000000000400000-0x0000000000454000-memory.dmp Nirsoft behavioral2/memory/2512-33-0x0000000000400000-0x000000000041F000-memory.dmp Nirsoft behavioral2/memory/2512-32-0x0000000000400000-0x000000000041F000-memory.dmp Nirsoft -
NirSoft MailPassView 3 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral2/memory/2512-47-0x0000000000400000-0x000000000041F000-memory.dmp MailPassView behavioral2/memory/2512-33-0x0000000000400000-0x000000000041F000-memory.dmp MailPassView behavioral2/memory/2512-32-0x0000000000400000-0x000000000041F000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 4 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral2/memory/552-23-0x0000000000400000-0x0000000000454000-memory.dmp WebBrowserPassView behavioral2/memory/552-25-0x0000000000400000-0x0000000000454000-memory.dmp WebBrowserPassView behavioral2/memory/552-42-0x0000000000400000-0x0000000000454000-memory.dmp WebBrowserPassView behavioral2/memory/552-34-0x0000000000400000-0x0000000000454000-memory.dmp WebBrowserPassView -
Executes dropped EXE 1 IoCs
pid Process 3612 sysdate.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysdate.exe = "C:\\Windows\\system32\\MSDCSC\\sysdate.exe" vbc.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\MSDCSC\sysdate.exe vbc.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\ vbc.exe File created C:\Windows\SysWOW64\MSDCSC\sysdate.exe vbc.exe -
Suspicious use of SetThreadContext 6 IoCs
description pid Process procid_target PID 4840 set thread context of 1808 4840 JaffaCakes118_092362ef67e69075208c724ae99293e7.exe 87 PID 4840 set thread context of 3000 4840 JaffaCakes118_092362ef67e69075208c724ae99293e7.exe 89 PID 3000 set thread context of 4064 3000 vbc.exe 90 PID 4064 set thread context of 552 4064 vbc.exe 91 PID 4064 set thread context of 1092 4064 vbc.exe 92 PID 4064 set thread context of 2512 4064 vbc.exe 93 -
resource yara_rule behavioral2/memory/1808-3-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/1808-5-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/1092-28-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/1092-35-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/2512-47-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/1092-40-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/2512-33-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/2512-32-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/2512-29-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/2512-31-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/1092-26-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral2/memory/1808-19-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/1808-13-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/1808-12-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/1808-10-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/1808-60-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_092362ef67e69075208c724ae99293e7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysdate.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3000 vbc.exe 3000 vbc.exe 3000 vbc.exe 3000 vbc.exe 3000 vbc.exe 3000 vbc.exe 3000 vbc.exe 3000 vbc.exe 1092 vbc.exe 1092 vbc.exe -
Suspicious use of AdjustPrivilegeToken 25 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1808 vbc.exe Token: SeSecurityPrivilege 1808 vbc.exe Token: SeTakeOwnershipPrivilege 1808 vbc.exe Token: SeLoadDriverPrivilege 1808 vbc.exe Token: SeSystemProfilePrivilege 1808 vbc.exe Token: SeSystemtimePrivilege 1808 vbc.exe Token: SeProfSingleProcessPrivilege 1808 vbc.exe Token: SeIncBasePriorityPrivilege 1808 vbc.exe Token: SeCreatePagefilePrivilege 1808 vbc.exe Token: SeBackupPrivilege 1808 vbc.exe Token: SeRestorePrivilege 1808 vbc.exe Token: SeShutdownPrivilege 1808 vbc.exe Token: SeDebugPrivilege 1808 vbc.exe Token: SeSystemEnvironmentPrivilege 1808 vbc.exe Token: SeChangeNotifyPrivilege 1808 vbc.exe Token: SeRemoteShutdownPrivilege 1808 vbc.exe Token: SeUndockPrivilege 1808 vbc.exe Token: SeManageVolumePrivilege 1808 vbc.exe Token: SeImpersonatePrivilege 1808 vbc.exe Token: SeCreateGlobalPrivilege 1808 vbc.exe Token: 33 1808 vbc.exe Token: 34 1808 vbc.exe Token: 35 1808 vbc.exe Token: 36 1808 vbc.exe Token: SeDebugPrivilege 1092 vbc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3000 vbc.exe -
Suspicious use of WriteProcessMemory 53 IoCs
description pid Process procid_target PID 4840 wrote to memory of 3608 4840 JaffaCakes118_092362ef67e69075208c724ae99293e7.exe 86 PID 4840 wrote to memory of 3608 4840 JaffaCakes118_092362ef67e69075208c724ae99293e7.exe 86 PID 4840 wrote to memory of 3608 4840 JaffaCakes118_092362ef67e69075208c724ae99293e7.exe 86 PID 4840 wrote to memory of 1808 4840 JaffaCakes118_092362ef67e69075208c724ae99293e7.exe 87 PID 4840 wrote to memory of 1808 4840 JaffaCakes118_092362ef67e69075208c724ae99293e7.exe 87 PID 4840 wrote to memory of 1808 4840 JaffaCakes118_092362ef67e69075208c724ae99293e7.exe 87 PID 4840 wrote to memory of 1808 4840 JaffaCakes118_092362ef67e69075208c724ae99293e7.exe 87 PID 4840 wrote to memory of 1808 4840 JaffaCakes118_092362ef67e69075208c724ae99293e7.exe 87 PID 4840 wrote to memory of 1808 4840 JaffaCakes118_092362ef67e69075208c724ae99293e7.exe 87 PID 4840 wrote to memory of 1808 4840 JaffaCakes118_092362ef67e69075208c724ae99293e7.exe 87 PID 4840 wrote to memory of 1808 4840 JaffaCakes118_092362ef67e69075208c724ae99293e7.exe 87 PID 4840 wrote to memory of 1956 4840 JaffaCakes118_092362ef67e69075208c724ae99293e7.exe 88 PID 4840 wrote to memory of 1956 4840 JaffaCakes118_092362ef67e69075208c724ae99293e7.exe 88 PID 4840 wrote to memory of 1956 4840 JaffaCakes118_092362ef67e69075208c724ae99293e7.exe 88 PID 4840 wrote to memory of 3000 4840 JaffaCakes118_092362ef67e69075208c724ae99293e7.exe 89 PID 4840 wrote to memory of 3000 4840 JaffaCakes118_092362ef67e69075208c724ae99293e7.exe 89 PID 4840 wrote to memory of 3000 4840 JaffaCakes118_092362ef67e69075208c724ae99293e7.exe 89 PID 4840 wrote to memory of 3000 4840 JaffaCakes118_092362ef67e69075208c724ae99293e7.exe 89 PID 4840 wrote to memory of 3000 4840 JaffaCakes118_092362ef67e69075208c724ae99293e7.exe 89 PID 4840 wrote to memory of 3000 4840 JaffaCakes118_092362ef67e69075208c724ae99293e7.exe 89 PID 4840 wrote to memory of 3000 4840 JaffaCakes118_092362ef67e69075208c724ae99293e7.exe 89 PID 4840 wrote to memory of 3000 4840 JaffaCakes118_092362ef67e69075208c724ae99293e7.exe 89 PID 3000 wrote to memory of 4064 3000 vbc.exe 90 PID 3000 wrote to memory of 4064 3000 vbc.exe 90 PID 3000 wrote to memory of 4064 3000 vbc.exe 90 PID 3000 wrote to memory of 4064 3000 vbc.exe 90 PID 3000 wrote to memory of 4064 3000 vbc.exe 90 PID 3000 wrote to memory of 4064 3000 vbc.exe 90 PID 3000 wrote to memory of 4064 3000 vbc.exe 90 PID 3000 wrote to memory of 4064 3000 vbc.exe 90 PID 3000 wrote to memory of 4064 3000 vbc.exe 90 PID 3000 wrote to memory of 4064 3000 vbc.exe 90 PID 3000 wrote to memory of 4064 3000 vbc.exe 90 PID 3000 wrote to memory of 4064 3000 vbc.exe 90 PID 3000 wrote to memory of 4064 3000 vbc.exe 90 PID 4064 wrote to memory of 552 4064 vbc.exe 91 PID 4064 wrote to memory of 552 4064 vbc.exe 91 PID 4064 wrote to memory of 552 4064 vbc.exe 91 PID 4064 wrote to memory of 552 4064 vbc.exe 91 PID 4064 wrote to memory of 552 4064 vbc.exe 91 PID 4064 wrote to memory of 1092 4064 vbc.exe 92 PID 4064 wrote to memory of 1092 4064 vbc.exe 92 PID 4064 wrote to memory of 1092 4064 vbc.exe 92 PID 4064 wrote to memory of 1092 4064 vbc.exe 92 PID 4064 wrote to memory of 1092 4064 vbc.exe 92 PID 4064 wrote to memory of 2512 4064 vbc.exe 93 PID 4064 wrote to memory of 2512 4064 vbc.exe 93 PID 4064 wrote to memory of 2512 4064 vbc.exe 93 PID 4064 wrote to memory of 2512 4064 vbc.exe 93 PID 4064 wrote to memory of 2512 4064 vbc.exe 93 PID 1808 wrote to memory of 3612 1808 vbc.exe 95 PID 1808 wrote to memory of 3612 1808 vbc.exe 95 PID 1808 wrote to memory of 3612 1808 vbc.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_092362ef67e69075208c724ae99293e7.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_092362ef67e69075208c724ae99293e7.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe2⤵PID:3608
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe2⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\SysWOW64\MSDCSC\sysdate.exe"C:\Windows\system32\MSDCSC\sysdate.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3612
-
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe2⤵PID:1956
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /scomma C:\Users\Admin\AppData\Local\Temp\data.dmp4⤵
- System Location Discovery: System Language Discovery
PID:552
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /scomma C:\Users\Admin\AppData\Local\Temp\data1.dmp4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1092
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /scomma C:\Users\Admin\AppData\Local\Temp\data2.dmp4⤵
- Accesses Microsoft Outlook accounts
- System Location Discovery: System Language Discovery
PID:2512
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34