Analysis
-
max time kernel
152s -
max time network
43s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
30-07-2022 20:29
Behavioral task
behavioral1
Sample
61aa788c92173825ed5c7898d6b475fb7263851324dd2e0051ef6691a42466dc.exe
Resource
win7-20220715-en
General
-
Target
61aa788c92173825ed5c7898d6b475fb7263851324dd2e0051ef6691a42466dc.exe
-
Size
658KB
-
MD5
674f4d8ef4964657adf1aa84d1a4bd22
-
SHA1
fd837d847f4840edb6cc1218f1ea59a7813bfc96
-
SHA256
61aa788c92173825ed5c7898d6b475fb7263851324dd2e0051ef6691a42466dc
-
SHA512
eea4f665c5233d8ecfaecf3fbc59b52d9a5dc62b8ce4d2c17c261d53d75841756df27a1f1ae96d63bcade4bd6213599d92f975d5df809b7669a47ca4a7126d84
Malware Config
Extracted
darkcomet
Guest16
cometka321.ddns.net:1604
DC_MUTEX-JZ5G2G4
-
InstallPath
Windows\msdcsc.exe
-
gencode
TjzE59HsqfK5
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
WindowsUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
61aa788c92173825ed5c7898d6b475fb7263851324dd2e0051ef6691a42466dc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\Windows\\msdcsc.exe" 61aa788c92173825ed5c7898d6b475fb7263851324dd2e0051ef6691a42466dc.exe -
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
msdcsc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" msdcsc.exe -
Modifies security service 2 TTPs 1 IoCs
Processes:
msdcsc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" msdcsc.exe -
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
msdcsc.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" msdcsc.exe -
Disables Task Manager via registry modification
-
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 1700 msdcsc.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 1496 attrib.exe 1600 attrib.exe -
Loads dropped DLL 2 IoCs
Processes:
61aa788c92173825ed5c7898d6b475fb7263851324dd2e0051ef6691a42466dc.exepid process 1464 61aa788c92173825ed5c7898d6b475fb7263851324dd2e0051ef6691a42466dc.exe 1464 61aa788c92173825ed5c7898d6b475fb7263851324dd2e0051ef6691a42466dc.exe -
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
61aa788c92173825ed5c7898d6b475fb7263851324dd2e0051ef6691a42466dc.exemsdcsc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Windows\\msdcsc.exe" 61aa788c92173825ed5c7898d6b475fb7263851324dd2e0051ef6691a42466dc.exe Set value (str) \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Windows\\msdcsc.exe" msdcsc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
msdcsc.exepid process 1700 msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
61aa788c92173825ed5c7898d6b475fb7263851324dd2e0051ef6691a42466dc.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 1464 61aa788c92173825ed5c7898d6b475fb7263851324dd2e0051ef6691a42466dc.exe Token: SeSecurityPrivilege 1464 61aa788c92173825ed5c7898d6b475fb7263851324dd2e0051ef6691a42466dc.exe Token: SeTakeOwnershipPrivilege 1464 61aa788c92173825ed5c7898d6b475fb7263851324dd2e0051ef6691a42466dc.exe Token: SeLoadDriverPrivilege 1464 61aa788c92173825ed5c7898d6b475fb7263851324dd2e0051ef6691a42466dc.exe Token: SeSystemProfilePrivilege 1464 61aa788c92173825ed5c7898d6b475fb7263851324dd2e0051ef6691a42466dc.exe Token: SeSystemtimePrivilege 1464 61aa788c92173825ed5c7898d6b475fb7263851324dd2e0051ef6691a42466dc.exe Token: SeProfSingleProcessPrivilege 1464 61aa788c92173825ed5c7898d6b475fb7263851324dd2e0051ef6691a42466dc.exe Token: SeIncBasePriorityPrivilege 1464 61aa788c92173825ed5c7898d6b475fb7263851324dd2e0051ef6691a42466dc.exe Token: SeCreatePagefilePrivilege 1464 61aa788c92173825ed5c7898d6b475fb7263851324dd2e0051ef6691a42466dc.exe Token: SeBackupPrivilege 1464 61aa788c92173825ed5c7898d6b475fb7263851324dd2e0051ef6691a42466dc.exe Token: SeRestorePrivilege 1464 61aa788c92173825ed5c7898d6b475fb7263851324dd2e0051ef6691a42466dc.exe Token: SeShutdownPrivilege 1464 61aa788c92173825ed5c7898d6b475fb7263851324dd2e0051ef6691a42466dc.exe Token: SeDebugPrivilege 1464 61aa788c92173825ed5c7898d6b475fb7263851324dd2e0051ef6691a42466dc.exe Token: SeSystemEnvironmentPrivilege 1464 61aa788c92173825ed5c7898d6b475fb7263851324dd2e0051ef6691a42466dc.exe Token: SeChangeNotifyPrivilege 1464 61aa788c92173825ed5c7898d6b475fb7263851324dd2e0051ef6691a42466dc.exe Token: SeRemoteShutdownPrivilege 1464 61aa788c92173825ed5c7898d6b475fb7263851324dd2e0051ef6691a42466dc.exe Token: SeUndockPrivilege 1464 61aa788c92173825ed5c7898d6b475fb7263851324dd2e0051ef6691a42466dc.exe Token: SeManageVolumePrivilege 1464 61aa788c92173825ed5c7898d6b475fb7263851324dd2e0051ef6691a42466dc.exe Token: SeImpersonatePrivilege 1464 61aa788c92173825ed5c7898d6b475fb7263851324dd2e0051ef6691a42466dc.exe Token: SeCreateGlobalPrivilege 1464 61aa788c92173825ed5c7898d6b475fb7263851324dd2e0051ef6691a42466dc.exe Token: 33 1464 61aa788c92173825ed5c7898d6b475fb7263851324dd2e0051ef6691a42466dc.exe Token: 34 1464 61aa788c92173825ed5c7898d6b475fb7263851324dd2e0051ef6691a42466dc.exe Token: 35 1464 61aa788c92173825ed5c7898d6b475fb7263851324dd2e0051ef6691a42466dc.exe Token: SeIncreaseQuotaPrivilege 1700 msdcsc.exe Token: SeSecurityPrivilege 1700 msdcsc.exe Token: SeTakeOwnershipPrivilege 1700 msdcsc.exe Token: SeLoadDriverPrivilege 1700 msdcsc.exe Token: SeSystemProfilePrivilege 1700 msdcsc.exe Token: SeSystemtimePrivilege 1700 msdcsc.exe Token: SeProfSingleProcessPrivilege 1700 msdcsc.exe Token: SeIncBasePriorityPrivilege 1700 msdcsc.exe Token: SeCreatePagefilePrivilege 1700 msdcsc.exe Token: SeBackupPrivilege 1700 msdcsc.exe Token: SeRestorePrivilege 1700 msdcsc.exe Token: SeShutdownPrivilege 1700 msdcsc.exe Token: SeDebugPrivilege 1700 msdcsc.exe Token: SeSystemEnvironmentPrivilege 1700 msdcsc.exe Token: SeChangeNotifyPrivilege 1700 msdcsc.exe Token: SeRemoteShutdownPrivilege 1700 msdcsc.exe Token: SeUndockPrivilege 1700 msdcsc.exe Token: SeManageVolumePrivilege 1700 msdcsc.exe Token: SeImpersonatePrivilege 1700 msdcsc.exe Token: SeCreateGlobalPrivilege 1700 msdcsc.exe Token: 33 1700 msdcsc.exe Token: 34 1700 msdcsc.exe Token: 35 1700 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
msdcsc.exepid process 1700 msdcsc.exe -
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
61aa788c92173825ed5c7898d6b475fb7263851324dd2e0051ef6691a42466dc.execmd.execmd.exemsdcsc.exedescription pid process target process PID 1464 wrote to memory of 1888 1464 61aa788c92173825ed5c7898d6b475fb7263851324dd2e0051ef6691a42466dc.exe cmd.exe PID 1464 wrote to memory of 1888 1464 61aa788c92173825ed5c7898d6b475fb7263851324dd2e0051ef6691a42466dc.exe cmd.exe PID 1464 wrote to memory of 1888 1464 61aa788c92173825ed5c7898d6b475fb7263851324dd2e0051ef6691a42466dc.exe cmd.exe PID 1464 wrote to memory of 1888 1464 61aa788c92173825ed5c7898d6b475fb7263851324dd2e0051ef6691a42466dc.exe cmd.exe PID 1464 wrote to memory of 1876 1464 61aa788c92173825ed5c7898d6b475fb7263851324dd2e0051ef6691a42466dc.exe cmd.exe PID 1464 wrote to memory of 1876 1464 61aa788c92173825ed5c7898d6b475fb7263851324dd2e0051ef6691a42466dc.exe cmd.exe PID 1464 wrote to memory of 1876 1464 61aa788c92173825ed5c7898d6b475fb7263851324dd2e0051ef6691a42466dc.exe cmd.exe PID 1464 wrote to memory of 1876 1464 61aa788c92173825ed5c7898d6b475fb7263851324dd2e0051ef6691a42466dc.exe cmd.exe PID 1888 wrote to memory of 1600 1888 cmd.exe attrib.exe PID 1888 wrote to memory of 1600 1888 cmd.exe attrib.exe PID 1888 wrote to memory of 1600 1888 cmd.exe attrib.exe PID 1888 wrote to memory of 1600 1888 cmd.exe attrib.exe PID 1876 wrote to memory of 1496 1876 cmd.exe attrib.exe PID 1876 wrote to memory of 1496 1876 cmd.exe attrib.exe PID 1876 wrote to memory of 1496 1876 cmd.exe attrib.exe PID 1876 wrote to memory of 1496 1876 cmd.exe attrib.exe PID 1464 wrote to memory of 1700 1464 61aa788c92173825ed5c7898d6b475fb7263851324dd2e0051ef6691a42466dc.exe msdcsc.exe PID 1464 wrote to memory of 1700 1464 61aa788c92173825ed5c7898d6b475fb7263851324dd2e0051ef6691a42466dc.exe msdcsc.exe PID 1464 wrote to memory of 1700 1464 61aa788c92173825ed5c7898d6b475fb7263851324dd2e0051ef6691a42466dc.exe msdcsc.exe PID 1464 wrote to memory of 1700 1464 61aa788c92173825ed5c7898d6b475fb7263851324dd2e0051ef6691a42466dc.exe msdcsc.exe PID 1700 wrote to memory of 1692 1700 msdcsc.exe notepad.exe PID 1700 wrote to memory of 1692 1700 msdcsc.exe notepad.exe PID 1700 wrote to memory of 1692 1700 msdcsc.exe notepad.exe PID 1700 wrote to memory of 1692 1700 msdcsc.exe notepad.exe PID 1700 wrote to memory of 1692 1700 msdcsc.exe notepad.exe PID 1700 wrote to memory of 1692 1700 msdcsc.exe notepad.exe PID 1700 wrote to memory of 1692 1700 msdcsc.exe notepad.exe PID 1700 wrote to memory of 1692 1700 msdcsc.exe notepad.exe PID 1700 wrote to memory of 1692 1700 msdcsc.exe notepad.exe PID 1700 wrote to memory of 1692 1700 msdcsc.exe notepad.exe PID 1700 wrote to memory of 1692 1700 msdcsc.exe notepad.exe PID 1700 wrote to memory of 1692 1700 msdcsc.exe notepad.exe PID 1700 wrote to memory of 1692 1700 msdcsc.exe notepad.exe PID 1700 wrote to memory of 1692 1700 msdcsc.exe notepad.exe PID 1700 wrote to memory of 1692 1700 msdcsc.exe notepad.exe PID 1700 wrote to memory of 1692 1700 msdcsc.exe notepad.exe PID 1700 wrote to memory of 1692 1700 msdcsc.exe notepad.exe PID 1700 wrote to memory of 1692 1700 msdcsc.exe notepad.exe PID 1700 wrote to memory of 1692 1700 msdcsc.exe notepad.exe PID 1700 wrote to memory of 1692 1700 msdcsc.exe notepad.exe PID 1700 wrote to memory of 1692 1700 msdcsc.exe notepad.exe PID 1700 wrote to memory of 1692 1700 msdcsc.exe notepad.exe PID 1700 wrote to memory of 1692 1700 msdcsc.exe notepad.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
msdcsc.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" msdcsc.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 1496 attrib.exe 1600 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\61aa788c92173825ed5c7898d6b475fb7263851324dd2e0051ef6691a42466dc.exe"C:\Users\Admin\AppData\Local\Temp\61aa788c92173825ed5c7898d6b475fb7263851324dd2e0051ef6691a42466dc.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\61aa788c92173825ed5c7898d6b475fb7263851324dd2e0051ef6691a42466dc.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\61aa788c92173825ed5c7898d6b475fb7263851324dd2e0051ef6691a42466dc.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\Windows\msdcsc.exe"C:\Users\Admin\AppData\Local\Temp\Windows\msdcsc.exe"2⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Windows\msdcsc.exeFilesize
658KB
MD5674f4d8ef4964657adf1aa84d1a4bd22
SHA1fd837d847f4840edb6cc1218f1ea59a7813bfc96
SHA25661aa788c92173825ed5c7898d6b475fb7263851324dd2e0051ef6691a42466dc
SHA512eea4f665c5233d8ecfaecf3fbc59b52d9a5dc62b8ce4d2c17c261d53d75841756df27a1f1ae96d63bcade4bd6213599d92f975d5df809b7669a47ca4a7126d84
-
C:\Users\Admin\AppData\Local\Temp\Windows\msdcsc.exeFilesize
658KB
MD5674f4d8ef4964657adf1aa84d1a4bd22
SHA1fd837d847f4840edb6cc1218f1ea59a7813bfc96
SHA25661aa788c92173825ed5c7898d6b475fb7263851324dd2e0051ef6691a42466dc
SHA512eea4f665c5233d8ecfaecf3fbc59b52d9a5dc62b8ce4d2c17c261d53d75841756df27a1f1ae96d63bcade4bd6213599d92f975d5df809b7669a47ca4a7126d84
-
\Users\Admin\AppData\Local\Temp\Windows\msdcsc.exeFilesize
658KB
MD5674f4d8ef4964657adf1aa84d1a4bd22
SHA1fd837d847f4840edb6cc1218f1ea59a7813bfc96
SHA25661aa788c92173825ed5c7898d6b475fb7263851324dd2e0051ef6691a42466dc
SHA512eea4f665c5233d8ecfaecf3fbc59b52d9a5dc62b8ce4d2c17c261d53d75841756df27a1f1ae96d63bcade4bd6213599d92f975d5df809b7669a47ca4a7126d84
-
\Users\Admin\AppData\Local\Temp\Windows\msdcsc.exeFilesize
658KB
MD5674f4d8ef4964657adf1aa84d1a4bd22
SHA1fd837d847f4840edb6cc1218f1ea59a7813bfc96
SHA25661aa788c92173825ed5c7898d6b475fb7263851324dd2e0051ef6691a42466dc
SHA512eea4f665c5233d8ecfaecf3fbc59b52d9a5dc62b8ce4d2c17c261d53d75841756df27a1f1ae96d63bcade4bd6213599d92f975d5df809b7669a47ca4a7126d84
-
memory/1464-54-0x0000000075021000-0x0000000075023000-memory.dmpFilesize
8KB
-
memory/1496-58-0x0000000000000000-mapping.dmp
-
memory/1600-57-0x0000000000000000-mapping.dmp
-
memory/1692-65-0x0000000000000000-mapping.dmp
-
memory/1700-61-0x0000000000000000-mapping.dmp
-
memory/1876-56-0x0000000000000000-mapping.dmp
-
memory/1888-55-0x0000000000000000-mapping.dmp