Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
05/02/2025, 07:19
250205-h5lwkaxndj 1007/10/2022, 19:32
221007-x8zddsdeap 1001/10/2022, 23:37
221001-3mgjcadden 10Analysis
-
max time kernel
155s -
max time network
190s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01/10/2022, 23:37
Behavioral task
behavioral1
Sample
c879c4891a1eba5c4f3a1bf38e3ed8d530ce67721cab3b26547ff50190b55ede.exe
Resource
win7-20220812-en
windows7-x64
19 signatures
150 seconds
General
-
Target
c879c4891a1eba5c4f3a1bf38e3ed8d530ce67721cab3b26547ff50190b55ede.exe
-
Size
658KB
-
MD5
01f80684f9ebae1fc31a67e9fc6b4eb8
-
SHA1
cd0a5f3d1b66fe80c07a99815c9fb15605c8198c
-
SHA256
c879c4891a1eba5c4f3a1bf38e3ed8d530ce67721cab3b26547ff50190b55ede
-
SHA512
c68b087676e11e210aceaabbefa18122d109b3c383ee25a635a327c6d477a9d73637ab49093a02b1756d65291a105601130196f8dbec832940cf0103bb28a721
-
SSDEEP
12288:+9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hS:KZ1xuVVjfFoynPaVBUR8f+kN10EB8
Malware Config
Extracted
Family
darkcomet
Botnet
Guest16
C2
idkwhat1235.no-ip.biz:6000
Mutex
DC_MUTEX-8JHYGAC
Attributes
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
2bi6GSkz4SLb
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" c879c4891a1eba5c4f3a1bf38e3ed8d530ce67721cab3b26547ff50190b55ede.exe -
Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" msdcsc.exe -
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" msdcsc.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" msdcsc.exe -
Disables Task Manager via registry modification
-
Executes dropped EXE 1 IoCs
pid Process 2360 msdcsc.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 2220 attrib.exe 5052 attrib.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation c879c4891a1eba5c4f3a1bf38e3ed8d530ce67721cab3b26547ff50190b55ede.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" c879c4891a1eba5c4f3a1bf38e3ed8d530ce67721cab3b26547ff50190b55ede.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ c879c4891a1eba5c4f3a1bf38e3ed8d530ce67721cab3b26547ff50190b55ede.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2360 msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1648 c879c4891a1eba5c4f3a1bf38e3ed8d530ce67721cab3b26547ff50190b55ede.exe Token: SeSecurityPrivilege 1648 c879c4891a1eba5c4f3a1bf38e3ed8d530ce67721cab3b26547ff50190b55ede.exe Token: SeTakeOwnershipPrivilege 1648 c879c4891a1eba5c4f3a1bf38e3ed8d530ce67721cab3b26547ff50190b55ede.exe Token: SeLoadDriverPrivilege 1648 c879c4891a1eba5c4f3a1bf38e3ed8d530ce67721cab3b26547ff50190b55ede.exe Token: SeSystemProfilePrivilege 1648 c879c4891a1eba5c4f3a1bf38e3ed8d530ce67721cab3b26547ff50190b55ede.exe Token: SeSystemtimePrivilege 1648 c879c4891a1eba5c4f3a1bf38e3ed8d530ce67721cab3b26547ff50190b55ede.exe Token: SeProfSingleProcessPrivilege 1648 c879c4891a1eba5c4f3a1bf38e3ed8d530ce67721cab3b26547ff50190b55ede.exe Token: SeIncBasePriorityPrivilege 1648 c879c4891a1eba5c4f3a1bf38e3ed8d530ce67721cab3b26547ff50190b55ede.exe Token: SeCreatePagefilePrivilege 1648 c879c4891a1eba5c4f3a1bf38e3ed8d530ce67721cab3b26547ff50190b55ede.exe Token: SeBackupPrivilege 1648 c879c4891a1eba5c4f3a1bf38e3ed8d530ce67721cab3b26547ff50190b55ede.exe Token: SeRestorePrivilege 1648 c879c4891a1eba5c4f3a1bf38e3ed8d530ce67721cab3b26547ff50190b55ede.exe Token: SeShutdownPrivilege 1648 c879c4891a1eba5c4f3a1bf38e3ed8d530ce67721cab3b26547ff50190b55ede.exe Token: SeDebugPrivilege 1648 c879c4891a1eba5c4f3a1bf38e3ed8d530ce67721cab3b26547ff50190b55ede.exe Token: SeSystemEnvironmentPrivilege 1648 c879c4891a1eba5c4f3a1bf38e3ed8d530ce67721cab3b26547ff50190b55ede.exe Token: SeChangeNotifyPrivilege 1648 c879c4891a1eba5c4f3a1bf38e3ed8d530ce67721cab3b26547ff50190b55ede.exe Token: SeRemoteShutdownPrivilege 1648 c879c4891a1eba5c4f3a1bf38e3ed8d530ce67721cab3b26547ff50190b55ede.exe Token: SeUndockPrivilege 1648 c879c4891a1eba5c4f3a1bf38e3ed8d530ce67721cab3b26547ff50190b55ede.exe Token: SeManageVolumePrivilege 1648 c879c4891a1eba5c4f3a1bf38e3ed8d530ce67721cab3b26547ff50190b55ede.exe Token: SeImpersonatePrivilege 1648 c879c4891a1eba5c4f3a1bf38e3ed8d530ce67721cab3b26547ff50190b55ede.exe Token: SeCreateGlobalPrivilege 1648 c879c4891a1eba5c4f3a1bf38e3ed8d530ce67721cab3b26547ff50190b55ede.exe Token: 33 1648 c879c4891a1eba5c4f3a1bf38e3ed8d530ce67721cab3b26547ff50190b55ede.exe Token: 34 1648 c879c4891a1eba5c4f3a1bf38e3ed8d530ce67721cab3b26547ff50190b55ede.exe Token: 35 1648 c879c4891a1eba5c4f3a1bf38e3ed8d530ce67721cab3b26547ff50190b55ede.exe Token: 36 1648 c879c4891a1eba5c4f3a1bf38e3ed8d530ce67721cab3b26547ff50190b55ede.exe Token: SeIncreaseQuotaPrivilege 2360 msdcsc.exe Token: SeSecurityPrivilege 2360 msdcsc.exe Token: SeTakeOwnershipPrivilege 2360 msdcsc.exe Token: SeLoadDriverPrivilege 2360 msdcsc.exe Token: SeSystemProfilePrivilege 2360 msdcsc.exe Token: SeSystemtimePrivilege 2360 msdcsc.exe Token: SeProfSingleProcessPrivilege 2360 msdcsc.exe Token: SeIncBasePriorityPrivilege 2360 msdcsc.exe Token: SeCreatePagefilePrivilege 2360 msdcsc.exe Token: SeBackupPrivilege 2360 msdcsc.exe Token: SeRestorePrivilege 2360 msdcsc.exe Token: SeShutdownPrivilege 2360 msdcsc.exe Token: SeDebugPrivilege 2360 msdcsc.exe Token: SeSystemEnvironmentPrivilege 2360 msdcsc.exe Token: SeChangeNotifyPrivilege 2360 msdcsc.exe Token: SeRemoteShutdownPrivilege 2360 msdcsc.exe Token: SeUndockPrivilege 2360 msdcsc.exe Token: SeManageVolumePrivilege 2360 msdcsc.exe Token: SeImpersonatePrivilege 2360 msdcsc.exe Token: SeCreateGlobalPrivilege 2360 msdcsc.exe Token: 33 2360 msdcsc.exe Token: 34 2360 msdcsc.exe Token: 35 2360 msdcsc.exe Token: 36 2360 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2360 msdcsc.exe -
Suspicious use of WriteProcessMemory 37 IoCs
description pid Process procid_target PID 1648 wrote to memory of 2232 1648 c879c4891a1eba5c4f3a1bf38e3ed8d530ce67721cab3b26547ff50190b55ede.exe 80 PID 1648 wrote to memory of 2232 1648 c879c4891a1eba5c4f3a1bf38e3ed8d530ce67721cab3b26547ff50190b55ede.exe 80 PID 1648 wrote to memory of 2232 1648 c879c4891a1eba5c4f3a1bf38e3ed8d530ce67721cab3b26547ff50190b55ede.exe 80 PID 1648 wrote to memory of 4860 1648 c879c4891a1eba5c4f3a1bf38e3ed8d530ce67721cab3b26547ff50190b55ede.exe 82 PID 1648 wrote to memory of 4860 1648 c879c4891a1eba5c4f3a1bf38e3ed8d530ce67721cab3b26547ff50190b55ede.exe 82 PID 1648 wrote to memory of 4860 1648 c879c4891a1eba5c4f3a1bf38e3ed8d530ce67721cab3b26547ff50190b55ede.exe 82 PID 4860 wrote to memory of 5052 4860 cmd.exe 85 PID 4860 wrote to memory of 5052 4860 cmd.exe 85 PID 4860 wrote to memory of 5052 4860 cmd.exe 85 PID 2232 wrote to memory of 2220 2232 cmd.exe 84 PID 2232 wrote to memory of 2220 2232 cmd.exe 84 PID 2232 wrote to memory of 2220 2232 cmd.exe 84 PID 1648 wrote to memory of 2360 1648 c879c4891a1eba5c4f3a1bf38e3ed8d530ce67721cab3b26547ff50190b55ede.exe 88 PID 1648 wrote to memory of 2360 1648 c879c4891a1eba5c4f3a1bf38e3ed8d530ce67721cab3b26547ff50190b55ede.exe 88 PID 1648 wrote to memory of 2360 1648 c879c4891a1eba5c4f3a1bf38e3ed8d530ce67721cab3b26547ff50190b55ede.exe 88 PID 2360 wrote to memory of 648 2360 msdcsc.exe 89 PID 2360 wrote to memory of 648 2360 msdcsc.exe 89 PID 2360 wrote to memory of 648 2360 msdcsc.exe 89 PID 2360 wrote to memory of 648 2360 msdcsc.exe 89 PID 2360 wrote to memory of 648 2360 msdcsc.exe 89 PID 2360 wrote to memory of 648 2360 msdcsc.exe 89 PID 2360 wrote to memory of 648 2360 msdcsc.exe 89 PID 2360 wrote to memory of 648 2360 msdcsc.exe 89 PID 2360 wrote to memory of 648 2360 msdcsc.exe 89 PID 2360 wrote to memory of 648 2360 msdcsc.exe 89 PID 2360 wrote to memory of 648 2360 msdcsc.exe 89 PID 2360 wrote to memory of 648 2360 msdcsc.exe 89 PID 2360 wrote to memory of 648 2360 msdcsc.exe 89 PID 2360 wrote to memory of 648 2360 msdcsc.exe 89 PID 2360 wrote to memory of 648 2360 msdcsc.exe 89 PID 2360 wrote to memory of 648 2360 msdcsc.exe 89 PID 2360 wrote to memory of 648 2360 msdcsc.exe 89 PID 2360 wrote to memory of 648 2360 msdcsc.exe 89 PID 2360 wrote to memory of 648 2360 msdcsc.exe 89 PID 2360 wrote to memory of 648 2360 msdcsc.exe 89 PID 2360 wrote to memory of 648 2360 msdcsc.exe 89 PID 2360 wrote to memory of 648 2360 msdcsc.exe 89 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" msdcsc.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 2220 attrib.exe 5052 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c879c4891a1eba5c4f3a1bf38e3ed8d530ce67721cab3b26547ff50190b55ede.exe"C:\Users\Admin\AppData\Local\Temp\c879c4891a1eba5c4f3a1bf38e3ed8d530ce67721cab3b26547ff50190b55ede.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\c879c4891a1eba5c4f3a1bf38e3ed8d530ce67721cab3b26547ff50190b55ede.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\c879c4891a1eba5c4f3a1bf38e3ed8d530ce67721cab3b26547ff50190b55ede.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2220
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:5052
-
-
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2360 -
C:\Windows\SysWOW64\notepad.exenotepad3⤵PID:648
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
658KB
MD501f80684f9ebae1fc31a67e9fc6b4eb8
SHA1cd0a5f3d1b66fe80c07a99815c9fb15605c8198c
SHA256c879c4891a1eba5c4f3a1bf38e3ed8d530ce67721cab3b26547ff50190b55ede
SHA512c68b087676e11e210aceaabbefa18122d109b3c383ee25a635a327c6d477a9d73637ab49093a02b1756d65291a105601130196f8dbec832940cf0103bb28a721
-
Filesize
658KB
MD501f80684f9ebae1fc31a67e9fc6b4eb8
SHA1cd0a5f3d1b66fe80c07a99815c9fb15605c8198c
SHA256c879c4891a1eba5c4f3a1bf38e3ed8d530ce67721cab3b26547ff50190b55ede
SHA512c68b087676e11e210aceaabbefa18122d109b3c383ee25a635a327c6d477a9d73637ab49093a02b1756d65291a105601130196f8dbec832940cf0103bb28a721