Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

JaffaCakes...d3.exe

windows7-x64

10

JaffaCakes...d3.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    104s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250313-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/03/2025, 11:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_83073e64b798c4629d7cd8acf906c5d3.exe

  • Size

    1.0MB

  • MD5

    83073e64b798c4629d7cd8acf906c5d3

  • SHA1

    d7a23fb969406082bb9bc1e9189ddcc64393b1d7

  • SHA256

    99f3cb3501eae1a22f94ada32f602a5f26ebe99f2ece30fad519fefaff9a5ba6

  • SHA512

    daf9c705711cbb7387291c9f7f2ca9a76625d52b1fe331bd8653fbaff1094e231761eb75cdbbaa52b6b23cfd4df0d527173737c67b2cc4a7cd40f9ca06ac3300

  • SSDEEP

    6144:M/yyfrX737v/vD3LPrXTYzvLvDnrnzij3b/7UOjvH/r3bn7f7fTfzHz/rnLkrvR5:PK

Score
10/10
darkcometdark ratdiscoverypersistencerattrojanupx

Malware Config

Extracted

Family

darkcomet

Botnet

DARK RAT

C2

wio.no-ip.biz:1604

Mutex

DC_MUTEX-F4QA1SB

Attributes
  • InstallPath

    Windupdt\winupdate.exe

  • gencode

    *�Q7*pU+TFBT

  • install

    true

  • offline_keylogger

    true

  • persistence

    false

  • reg_key

    winupdater

rc4.plain

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet
  • Darkcomet family
    darkcomet
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of SetThreadContext 3 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_83073e64b798c4629d7cd8acf906c5d3.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_83073e64b798c4629d7cd8acf906c5d3.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3920
    • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_83073e64b798c4629d7cd8acf906c5d3.exe
      C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_83073e64b798c4629d7cd8acf906c5d3.exe
      2⤵
      • Modifies WinLogon for persistence
      • Checks BIOS information in registry
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5284
      • C:\Windows\SysWOW64\explorer.exe
        "C:\Windows\SysWOW64\explorer.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5812
        • C:\Windows\SysWOW64\explorer.exe
          C:\Windows\SysWOW64\explorer.exe
          4⤵
            PID:5276
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 5276 -s 80
              5⤵
              • Program crash
              PID:4704
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5276 -ip 5276
      1⤵
        PID:4468

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/5284-2-0x0000000000400000-0x00000000004B5000-memory.dmp

        Filesize

        724KB

        Download

      • memory/5284-4-0x0000000000400000-0x00000000004B5000-memory.dmp

        Filesize

        724KB

        Download

      • memory/5284-5-0x0000000000400000-0x00000000004B5000-memory.dmp

        Filesize

        724KB

        Download

      • memory/5284-6-0x0000000000400000-0x00000000004B5000-memory.dmp

        Filesize

        724KB

        Download

      • memory/5284-8-0x0000000000400000-0x00000000004B5000-memory.dmp

        Filesize

        724KB

        Download

      • memory/5284-9-0x0000000000400000-0x00000000004B5000-memory.dmp

        Filesize

        724KB

        Download

      • memory/5284-7-0x0000000000400000-0x00000000004B5000-memory.dmp

        Filesize

        724KB

        Download

      • memory/5284-14-0x0000000000400000-0x00000000004B5000-memory.dmp

        Filesize

        724KB

        Download

      • memory/5812-12-0x0000000000400000-0x0000000000506000-memory.dmp

        Filesize

        1.0MB

        Download

      • memory/5812-15-0x0000000000400000-0x0000000000506000-memory.dmp

        Filesize

        1.0MB

        Download

      • memory/5812-21-0x0000000000400000-0x0000000000506000-memory.dmp

        Filesize

        1.0MB

        Download