Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

5

JaffaCakes...9a.exe

windows7-x64

10

JaffaCakes...9a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_80eff0b933dbc5e3bb3a6f562a72299a

  • Size

    1.1MB

  • Sample

    250320-c2bcrsvmz4

  • MD5

    80eff0b933dbc5e3bb3a6f562a72299a

  • SHA1

    f67e224bb4e099969605988aa8d7fada6ccb6661

  • SHA256

    9db2cf1fbaab9fe3fefe30f813c5d436733a6869ef149be578a2eeb13fd0bf47

  • SHA512

    6214802075cc18c9612ddff992b7b5481b4b08a8db32eca66652d68026a01dbb0f69af43434d09fd1b03bf2f6387d4a9be5aff1000b95277e0b36a4a53fafca9

  • SSDEEP

    24576:XQ4Fe0pxx5cyLzoy4z5LPrMcs5dmYOYFQn1s97QJv8wBr:X/nzbL0zzJsKJS1QJv8wBr

Score
10/10
darkcometguest16_mindiscoverypersistencerattrojanupx

Malware Config

Extracted

Family

darkcomet

Botnet

Guest16_min

C2

192.168.1.103:1604

Mutex

DCMIN_MUTEX-TBC4EQ2

Attributes
  • InstallPath

    DCSCMIN\IMDCSC.exe

  • gencode

    iaKuyMwB6ZkU

  • install

    true

  • offline_keylogger

    true

  • persistence

    false

  • reg_key

    DarkComet RAT

rc4.plain

Targets

    • Target

      JaffaCakes118_80eff0b933dbc5e3bb3a6f562a72299a

    • Size

      1.1MB

    • MD5

      80eff0b933dbc5e3bb3a6f562a72299a

    • SHA1

      f67e224bb4e099969605988aa8d7fada6ccb6661

    • SHA256

      9db2cf1fbaab9fe3fefe30f813c5d436733a6869ef149be578a2eeb13fd0bf47

    • SHA512

      6214802075cc18c9612ddff992b7b5481b4b08a8db32eca66652d68026a01dbb0f69af43434d09fd1b03bf2f6387d4a9be5aff1000b95277e0b36a4a53fafca9

    • SSDEEP

      24576:XQ4Fe0pxx5cyLzoy4z5LPrMcs5dmYOYFQn1s97QJv8wBr:X/nzbL0zzJsKJS1QJv8wBr

    Score
    10/10
    darkcometguest16_mindiscoverypersistencerattrojanupx

    • Darkcomet

      DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

      trojanratdarkcomet

    • Darkcomet family

      darkcomet

    • Modifies WinLogon for persistence

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks