Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
25-07-2022 00:14
Behavioral task
behavioral1
Sample
6c42d09cb956bcc92031f99ab79065c318985fa063ae5eacc07ddbbbe34652f7.exe
Resource
win7-20220718-en
General
-
Target
6c42d09cb956bcc92031f99ab79065c318985fa063ae5eacc07ddbbbe34652f7.exe
-
Size
756KB
-
MD5
fc31e56ab0b5fc0cf54c77018ac02c4f
-
SHA1
960431fb7697fb10d517a0a1eba6e674c2634886
-
SHA256
6c42d09cb956bcc92031f99ab79065c318985fa063ae5eacc07ddbbbe34652f7
-
SHA512
5a78bd769845247154949a3074883920a2ce7eeaff2588ead01054739aba114e5aad9b1571d863dbdb8c0b8cab5df452c30ba3992d1ca95ef578c9a880c139ae
Malware Config
Extracted
darkcomet
Guest16
39.48.14.238:1604
DC_MUTEX-2888LM2
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
WpcmlJsqmTWl
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
6c42d09cb956bcc92031f99ab79065c318985fa063ae5eacc07ddbbbe34652f7.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 6c42d09cb956bcc92031f99ab79065c318985fa063ae5eacc07ddbbbe34652f7.exe -
Modifies security service 2 TTPs 1 IoCs
Processes:
msdcsc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" msdcsc.exe -
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 1812 msdcsc.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 816 attrib.exe 1808 attrib.exe -
Loads dropped DLL 2 IoCs
Processes:
6c42d09cb956bcc92031f99ab79065c318985fa063ae5eacc07ddbbbe34652f7.exepid process 2036 6c42d09cb956bcc92031f99ab79065c318985fa063ae5eacc07ddbbbe34652f7.exe 2036 6c42d09cb956bcc92031f99ab79065c318985fa063ae5eacc07ddbbbe34652f7.exe -
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
6c42d09cb956bcc92031f99ab79065c318985fa063ae5eacc07ddbbbe34652f7.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 6c42d09cb956bcc92031f99ab79065c318985fa063ae5eacc07ddbbbe34652f7.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
msdcsc.exepid process 1812 msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
6c42d09cb956bcc92031f99ab79065c318985fa063ae5eacc07ddbbbe34652f7.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 2036 6c42d09cb956bcc92031f99ab79065c318985fa063ae5eacc07ddbbbe34652f7.exe Token: SeSecurityPrivilege 2036 6c42d09cb956bcc92031f99ab79065c318985fa063ae5eacc07ddbbbe34652f7.exe Token: SeTakeOwnershipPrivilege 2036 6c42d09cb956bcc92031f99ab79065c318985fa063ae5eacc07ddbbbe34652f7.exe Token: SeLoadDriverPrivilege 2036 6c42d09cb956bcc92031f99ab79065c318985fa063ae5eacc07ddbbbe34652f7.exe Token: SeSystemProfilePrivilege 2036 6c42d09cb956bcc92031f99ab79065c318985fa063ae5eacc07ddbbbe34652f7.exe Token: SeSystemtimePrivilege 2036 6c42d09cb956bcc92031f99ab79065c318985fa063ae5eacc07ddbbbe34652f7.exe Token: SeProfSingleProcessPrivilege 2036 6c42d09cb956bcc92031f99ab79065c318985fa063ae5eacc07ddbbbe34652f7.exe Token: SeIncBasePriorityPrivilege 2036 6c42d09cb956bcc92031f99ab79065c318985fa063ae5eacc07ddbbbe34652f7.exe Token: SeCreatePagefilePrivilege 2036 6c42d09cb956bcc92031f99ab79065c318985fa063ae5eacc07ddbbbe34652f7.exe Token: SeBackupPrivilege 2036 6c42d09cb956bcc92031f99ab79065c318985fa063ae5eacc07ddbbbe34652f7.exe Token: SeRestorePrivilege 2036 6c42d09cb956bcc92031f99ab79065c318985fa063ae5eacc07ddbbbe34652f7.exe Token: SeShutdownPrivilege 2036 6c42d09cb956bcc92031f99ab79065c318985fa063ae5eacc07ddbbbe34652f7.exe Token: SeDebugPrivilege 2036 6c42d09cb956bcc92031f99ab79065c318985fa063ae5eacc07ddbbbe34652f7.exe Token: SeSystemEnvironmentPrivilege 2036 6c42d09cb956bcc92031f99ab79065c318985fa063ae5eacc07ddbbbe34652f7.exe Token: SeChangeNotifyPrivilege 2036 6c42d09cb956bcc92031f99ab79065c318985fa063ae5eacc07ddbbbe34652f7.exe Token: SeRemoteShutdownPrivilege 2036 6c42d09cb956bcc92031f99ab79065c318985fa063ae5eacc07ddbbbe34652f7.exe Token: SeUndockPrivilege 2036 6c42d09cb956bcc92031f99ab79065c318985fa063ae5eacc07ddbbbe34652f7.exe Token: SeManageVolumePrivilege 2036 6c42d09cb956bcc92031f99ab79065c318985fa063ae5eacc07ddbbbe34652f7.exe Token: SeImpersonatePrivilege 2036 6c42d09cb956bcc92031f99ab79065c318985fa063ae5eacc07ddbbbe34652f7.exe Token: SeCreateGlobalPrivilege 2036 6c42d09cb956bcc92031f99ab79065c318985fa063ae5eacc07ddbbbe34652f7.exe Token: 33 2036 6c42d09cb956bcc92031f99ab79065c318985fa063ae5eacc07ddbbbe34652f7.exe Token: 34 2036 6c42d09cb956bcc92031f99ab79065c318985fa063ae5eacc07ddbbbe34652f7.exe Token: 35 2036 6c42d09cb956bcc92031f99ab79065c318985fa063ae5eacc07ddbbbe34652f7.exe Token: SeIncreaseQuotaPrivilege 1812 msdcsc.exe Token: SeSecurityPrivilege 1812 msdcsc.exe Token: SeTakeOwnershipPrivilege 1812 msdcsc.exe Token: SeLoadDriverPrivilege 1812 msdcsc.exe Token: SeSystemProfilePrivilege 1812 msdcsc.exe Token: SeSystemtimePrivilege 1812 msdcsc.exe Token: SeProfSingleProcessPrivilege 1812 msdcsc.exe Token: SeIncBasePriorityPrivilege 1812 msdcsc.exe Token: SeCreatePagefilePrivilege 1812 msdcsc.exe Token: SeBackupPrivilege 1812 msdcsc.exe Token: SeRestorePrivilege 1812 msdcsc.exe Token: SeShutdownPrivilege 1812 msdcsc.exe Token: SeDebugPrivilege 1812 msdcsc.exe Token: SeSystemEnvironmentPrivilege 1812 msdcsc.exe Token: SeChangeNotifyPrivilege 1812 msdcsc.exe Token: SeRemoteShutdownPrivilege 1812 msdcsc.exe Token: SeUndockPrivilege 1812 msdcsc.exe Token: SeManageVolumePrivilege 1812 msdcsc.exe Token: SeImpersonatePrivilege 1812 msdcsc.exe Token: SeCreateGlobalPrivilege 1812 msdcsc.exe Token: 33 1812 msdcsc.exe Token: 34 1812 msdcsc.exe Token: 35 1812 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
msdcsc.exepid process 1812 msdcsc.exe -
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
6c42d09cb956bcc92031f99ab79065c318985fa063ae5eacc07ddbbbe34652f7.execmd.execmd.exemsdcsc.exedescription pid process target process PID 2036 wrote to memory of 1968 2036 6c42d09cb956bcc92031f99ab79065c318985fa063ae5eacc07ddbbbe34652f7.exe cmd.exe PID 2036 wrote to memory of 1968 2036 6c42d09cb956bcc92031f99ab79065c318985fa063ae5eacc07ddbbbe34652f7.exe cmd.exe PID 2036 wrote to memory of 1968 2036 6c42d09cb956bcc92031f99ab79065c318985fa063ae5eacc07ddbbbe34652f7.exe cmd.exe PID 2036 wrote to memory of 1968 2036 6c42d09cb956bcc92031f99ab79065c318985fa063ae5eacc07ddbbbe34652f7.exe cmd.exe PID 2036 wrote to memory of 1936 2036 6c42d09cb956bcc92031f99ab79065c318985fa063ae5eacc07ddbbbe34652f7.exe cmd.exe PID 2036 wrote to memory of 1936 2036 6c42d09cb956bcc92031f99ab79065c318985fa063ae5eacc07ddbbbe34652f7.exe cmd.exe PID 2036 wrote to memory of 1936 2036 6c42d09cb956bcc92031f99ab79065c318985fa063ae5eacc07ddbbbe34652f7.exe cmd.exe PID 2036 wrote to memory of 1936 2036 6c42d09cb956bcc92031f99ab79065c318985fa063ae5eacc07ddbbbe34652f7.exe cmd.exe PID 1968 wrote to memory of 816 1968 cmd.exe attrib.exe PID 1968 wrote to memory of 816 1968 cmd.exe attrib.exe PID 1968 wrote to memory of 816 1968 cmd.exe attrib.exe PID 1968 wrote to memory of 816 1968 cmd.exe attrib.exe PID 1936 wrote to memory of 1808 1936 cmd.exe attrib.exe PID 1936 wrote to memory of 1808 1936 cmd.exe attrib.exe PID 1936 wrote to memory of 1808 1936 cmd.exe attrib.exe PID 1936 wrote to memory of 1808 1936 cmd.exe attrib.exe PID 2036 wrote to memory of 1812 2036 6c42d09cb956bcc92031f99ab79065c318985fa063ae5eacc07ddbbbe34652f7.exe msdcsc.exe PID 2036 wrote to memory of 1812 2036 6c42d09cb956bcc92031f99ab79065c318985fa063ae5eacc07ddbbbe34652f7.exe msdcsc.exe PID 2036 wrote to memory of 1812 2036 6c42d09cb956bcc92031f99ab79065c318985fa063ae5eacc07ddbbbe34652f7.exe msdcsc.exe PID 2036 wrote to memory of 1812 2036 6c42d09cb956bcc92031f99ab79065c318985fa063ae5eacc07ddbbbe34652f7.exe msdcsc.exe PID 1812 wrote to memory of 1252 1812 msdcsc.exe notepad.exe PID 1812 wrote to memory of 1252 1812 msdcsc.exe notepad.exe PID 1812 wrote to memory of 1252 1812 msdcsc.exe notepad.exe PID 1812 wrote to memory of 1252 1812 msdcsc.exe notepad.exe PID 1812 wrote to memory of 1252 1812 msdcsc.exe notepad.exe PID 1812 wrote to memory of 1252 1812 msdcsc.exe notepad.exe PID 1812 wrote to memory of 1252 1812 msdcsc.exe notepad.exe PID 1812 wrote to memory of 1252 1812 msdcsc.exe notepad.exe PID 1812 wrote to memory of 1252 1812 msdcsc.exe notepad.exe PID 1812 wrote to memory of 1252 1812 msdcsc.exe notepad.exe PID 1812 wrote to memory of 1252 1812 msdcsc.exe notepad.exe PID 1812 wrote to memory of 1252 1812 msdcsc.exe notepad.exe PID 1812 wrote to memory of 1252 1812 msdcsc.exe notepad.exe PID 1812 wrote to memory of 1252 1812 msdcsc.exe notepad.exe PID 1812 wrote to memory of 1252 1812 msdcsc.exe notepad.exe PID 1812 wrote to memory of 1252 1812 msdcsc.exe notepad.exe PID 1812 wrote to memory of 1252 1812 msdcsc.exe notepad.exe PID 1812 wrote to memory of 1252 1812 msdcsc.exe notepad.exe PID 1812 wrote to memory of 1252 1812 msdcsc.exe notepad.exe PID 1812 wrote to memory of 1252 1812 msdcsc.exe notepad.exe PID 1812 wrote to memory of 1252 1812 msdcsc.exe notepad.exe PID 1812 wrote to memory of 1252 1812 msdcsc.exe notepad.exe PID 1812 wrote to memory of 1252 1812 msdcsc.exe notepad.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern msdcsc.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 816 attrib.exe 1808 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c42d09cb956bcc92031f99ab79065c318985fa063ae5eacc07ddbbbe34652f7.exe"C:\Users\Admin\AppData\Local\Temp\6c42d09cb956bcc92031f99ab79065c318985fa063ae5eacc07ddbbbe34652f7.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\6c42d09cb956bcc92031f99ab79065c318985fa063ae5eacc07ddbbbe34652f7.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\6c42d09cb956bcc92031f99ab79065c318985fa063ae5eacc07ddbbbe34652f7.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Modifies security service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
756KB
MD5fc31e56ab0b5fc0cf54c77018ac02c4f
SHA1960431fb7697fb10d517a0a1eba6e674c2634886
SHA2566c42d09cb956bcc92031f99ab79065c318985fa063ae5eacc07ddbbbe34652f7
SHA5125a78bd769845247154949a3074883920a2ce7eeaff2588ead01054739aba114e5aad9b1571d863dbdb8c0b8cab5df452c30ba3992d1ca95ef578c9a880c139ae
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
756KB
MD5fc31e56ab0b5fc0cf54c77018ac02c4f
SHA1960431fb7697fb10d517a0a1eba6e674c2634886
SHA2566c42d09cb956bcc92031f99ab79065c318985fa063ae5eacc07ddbbbe34652f7
SHA5125a78bd769845247154949a3074883920a2ce7eeaff2588ead01054739aba114e5aad9b1571d863dbdb8c0b8cab5df452c30ba3992d1ca95ef578c9a880c139ae
-
\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
756KB
MD5fc31e56ab0b5fc0cf54c77018ac02c4f
SHA1960431fb7697fb10d517a0a1eba6e674c2634886
SHA2566c42d09cb956bcc92031f99ab79065c318985fa063ae5eacc07ddbbbe34652f7
SHA5125a78bd769845247154949a3074883920a2ce7eeaff2588ead01054739aba114e5aad9b1571d863dbdb8c0b8cab5df452c30ba3992d1ca95ef578c9a880c139ae
-
\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
756KB
MD5fc31e56ab0b5fc0cf54c77018ac02c4f
SHA1960431fb7697fb10d517a0a1eba6e674c2634886
SHA2566c42d09cb956bcc92031f99ab79065c318985fa063ae5eacc07ddbbbe34652f7
SHA5125a78bd769845247154949a3074883920a2ce7eeaff2588ead01054739aba114e5aad9b1571d863dbdb8c0b8cab5df452c30ba3992d1ca95ef578c9a880c139ae
-
memory/816-57-0x0000000000000000-mapping.dmp
-
memory/1252-65-0x0000000000000000-mapping.dmp
-
memory/1808-58-0x0000000000000000-mapping.dmp
-
memory/1812-61-0x0000000000000000-mapping.dmp
-
memory/1936-56-0x0000000000000000-mapping.dmp
-
memory/1968-55-0x0000000000000000-mapping.dmp
-
memory/2036-54-0x0000000075D51000-0x0000000075D53000-memory.dmpFilesize
8KB