Analysis
-
max time kernel
150s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
01-10-2022 23:37
Behavioral task
behavioral1
Sample
7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe
Resource
win7-20220901-en
General
-
Target
7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe
-
Size
658KB
-
MD5
6d2af3af93fbb8e1fd8cbfde6fb810c0
-
SHA1
aa0574609abf1acd8a7e27396548f32e6aac52d7
-
SHA256
7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224
-
SHA512
08feaec307d69c4ef91b91a50c54a0dd8ffde4e12e48681565d7999e82c9d9ceb155ca853d34ffe9a8a8f76c8f5aa9e92c534a476cceb5de060fd08de434e354
-
SSDEEP
12288:+9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hM:KZ1xuVVjfFoynPaVBUR8f+kN10EBe
Malware Config
Extracted
darkcomet
Hacked
127.0.0.1:1996
EXMDUUZQTE
-
InstallPath
IntelUpdate\Intel.exe
-
gencode
gvuUE7r66tTs
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
IntelUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\IntelUpdate\\Intel.exe" 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe -
Executes dropped EXE 1 IoCs
Processes:
Intel.exepid process 580 Intel.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 684 attrib.exe 316 attrib.exe -
Deletes itself 1 IoCs
Processes:
notepad.exepid process 1704 notepad.exe -
Loads dropped DLL 2 IoCs
Processes:
7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exepid process 1416 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe 1416 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\IntelUpdate = "C:\\Windows\\IntelUpdate\\Intel.exe" 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe -
Drops file in Windows directory 3 IoCs
Processes:
7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exedescription ioc process File created C:\Windows\IntelUpdate\Intel.exe 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe File opened for modification C:\Windows\IntelUpdate\Intel.exe 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe File opened for modification C:\Windows\IntelUpdate\ 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Intel.exepid process 580 Intel.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exeIntel.exedescription pid process Token: SeIncreaseQuotaPrivilege 1416 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe Token: SeSecurityPrivilege 1416 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe Token: SeTakeOwnershipPrivilege 1416 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe Token: SeLoadDriverPrivilege 1416 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe Token: SeSystemProfilePrivilege 1416 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe Token: SeSystemtimePrivilege 1416 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe Token: SeProfSingleProcessPrivilege 1416 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe Token: SeIncBasePriorityPrivilege 1416 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe Token: SeCreatePagefilePrivilege 1416 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe Token: SeBackupPrivilege 1416 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe Token: SeRestorePrivilege 1416 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe Token: SeShutdownPrivilege 1416 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe Token: SeDebugPrivilege 1416 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe Token: SeSystemEnvironmentPrivilege 1416 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe Token: SeChangeNotifyPrivilege 1416 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe Token: SeRemoteShutdownPrivilege 1416 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe Token: SeUndockPrivilege 1416 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe Token: SeManageVolumePrivilege 1416 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe Token: SeImpersonatePrivilege 1416 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe Token: SeCreateGlobalPrivilege 1416 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe Token: 33 1416 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe Token: 34 1416 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe Token: 35 1416 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe Token: SeIncreaseQuotaPrivilege 580 Intel.exe Token: SeSecurityPrivilege 580 Intel.exe Token: SeTakeOwnershipPrivilege 580 Intel.exe Token: SeLoadDriverPrivilege 580 Intel.exe Token: SeSystemProfilePrivilege 580 Intel.exe Token: SeSystemtimePrivilege 580 Intel.exe Token: SeProfSingleProcessPrivilege 580 Intel.exe Token: SeIncBasePriorityPrivilege 580 Intel.exe Token: SeCreatePagefilePrivilege 580 Intel.exe Token: SeBackupPrivilege 580 Intel.exe Token: SeRestorePrivilege 580 Intel.exe Token: SeShutdownPrivilege 580 Intel.exe Token: SeDebugPrivilege 580 Intel.exe Token: SeSystemEnvironmentPrivilege 580 Intel.exe Token: SeChangeNotifyPrivilege 580 Intel.exe Token: SeRemoteShutdownPrivilege 580 Intel.exe Token: SeUndockPrivilege 580 Intel.exe Token: SeManageVolumePrivilege 580 Intel.exe Token: SeImpersonatePrivilege 580 Intel.exe Token: SeCreateGlobalPrivilege 580 Intel.exe Token: 33 580 Intel.exe Token: 34 580 Intel.exe Token: 35 580 Intel.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Intel.exepid process 580 Intel.exe -
Suspicious use of WriteProcessMemory 61 IoCs
Processes:
7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.execmd.execmd.exeIntel.exedescription pid process target process PID 1416 wrote to memory of 1788 1416 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe cmd.exe PID 1416 wrote to memory of 1788 1416 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe cmd.exe PID 1416 wrote to memory of 1788 1416 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe cmd.exe PID 1416 wrote to memory of 1788 1416 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe cmd.exe PID 1416 wrote to memory of 2032 1416 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe cmd.exe PID 1416 wrote to memory of 2032 1416 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe cmd.exe PID 1416 wrote to memory of 2032 1416 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe cmd.exe PID 1416 wrote to memory of 2032 1416 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe cmd.exe PID 1416 wrote to memory of 1704 1416 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe notepad.exe PID 1416 wrote to memory of 1704 1416 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe notepad.exe PID 1416 wrote to memory of 1704 1416 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe notepad.exe PID 1416 wrote to memory of 1704 1416 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe notepad.exe PID 1416 wrote to memory of 1704 1416 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe notepad.exe PID 1416 wrote to memory of 1704 1416 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe notepad.exe PID 1416 wrote to memory of 1704 1416 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe notepad.exe PID 1416 wrote to memory of 1704 1416 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe notepad.exe PID 1416 wrote to memory of 1704 1416 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe notepad.exe PID 1416 wrote to memory of 1704 1416 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe notepad.exe PID 1416 wrote to memory of 1704 1416 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe notepad.exe PID 1416 wrote to memory of 1704 1416 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe notepad.exe PID 1416 wrote to memory of 1704 1416 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe notepad.exe PID 1416 wrote to memory of 1704 1416 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe notepad.exe PID 1416 wrote to memory of 1704 1416 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe notepad.exe PID 1416 wrote to memory of 1704 1416 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe notepad.exe PID 1416 wrote to memory of 1704 1416 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe notepad.exe PID 1416 wrote to memory of 1704 1416 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe notepad.exe PID 1788 wrote to memory of 316 1788 cmd.exe attrib.exe PID 1788 wrote to memory of 316 1788 cmd.exe attrib.exe PID 1788 wrote to memory of 316 1788 cmd.exe attrib.exe PID 1788 wrote to memory of 316 1788 cmd.exe attrib.exe PID 2032 wrote to memory of 684 2032 cmd.exe attrib.exe PID 2032 wrote to memory of 684 2032 cmd.exe attrib.exe PID 2032 wrote to memory of 684 2032 cmd.exe attrib.exe PID 2032 wrote to memory of 684 2032 cmd.exe attrib.exe PID 1416 wrote to memory of 580 1416 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe Intel.exe PID 1416 wrote to memory of 580 1416 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe Intel.exe PID 1416 wrote to memory of 580 1416 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe Intel.exe PID 1416 wrote to memory of 580 1416 7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe Intel.exe PID 580 wrote to memory of 1776 580 Intel.exe notepad.exe PID 580 wrote to memory of 1776 580 Intel.exe notepad.exe PID 580 wrote to memory of 1776 580 Intel.exe notepad.exe PID 580 wrote to memory of 1776 580 Intel.exe notepad.exe PID 580 wrote to memory of 1776 580 Intel.exe notepad.exe PID 580 wrote to memory of 1776 580 Intel.exe notepad.exe PID 580 wrote to memory of 1776 580 Intel.exe notepad.exe PID 580 wrote to memory of 1776 580 Intel.exe notepad.exe PID 580 wrote to memory of 1776 580 Intel.exe notepad.exe PID 580 wrote to memory of 1776 580 Intel.exe notepad.exe PID 580 wrote to memory of 1776 580 Intel.exe notepad.exe PID 580 wrote to memory of 1776 580 Intel.exe notepad.exe PID 580 wrote to memory of 1776 580 Intel.exe notepad.exe PID 580 wrote to memory of 1776 580 Intel.exe notepad.exe PID 580 wrote to memory of 1776 580 Intel.exe notepad.exe PID 580 wrote to memory of 1776 580 Intel.exe notepad.exe PID 580 wrote to memory of 1776 580 Intel.exe notepad.exe PID 580 wrote to memory of 1776 580 Intel.exe notepad.exe PID 580 wrote to memory of 1776 580 Intel.exe notepad.exe PID 580 wrote to memory of 1776 580 Intel.exe notepad.exe PID 580 wrote to memory of 1776 580 Intel.exe notepad.exe PID 580 wrote to memory of 1776 580 Intel.exe notepad.exe PID 580 wrote to memory of 1776 580 Intel.exe notepad.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 316 attrib.exe 684 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe"C:\Users\Admin\AppData\Local\Temp\7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\7d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Deletes itself
-
C:\Windows\IntelUpdate\Intel.exe"C:\Windows\IntelUpdate\Intel.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\IntelUpdate\Intel.exeFilesize
658KB
MD56d2af3af93fbb8e1fd8cbfde6fb810c0
SHA1aa0574609abf1acd8a7e27396548f32e6aac52d7
SHA2567d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224
SHA51208feaec307d69c4ef91b91a50c54a0dd8ffde4e12e48681565d7999e82c9d9ceb155ca853d34ffe9a8a8f76c8f5aa9e92c534a476cceb5de060fd08de434e354
-
C:\Windows\IntelUpdate\Intel.exeFilesize
658KB
MD56d2af3af93fbb8e1fd8cbfde6fb810c0
SHA1aa0574609abf1acd8a7e27396548f32e6aac52d7
SHA2567d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224
SHA51208feaec307d69c4ef91b91a50c54a0dd8ffde4e12e48681565d7999e82c9d9ceb155ca853d34ffe9a8a8f76c8f5aa9e92c534a476cceb5de060fd08de434e354
-
\Windows\IntelUpdate\Intel.exeFilesize
658KB
MD56d2af3af93fbb8e1fd8cbfde6fb810c0
SHA1aa0574609abf1acd8a7e27396548f32e6aac52d7
SHA2567d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224
SHA51208feaec307d69c4ef91b91a50c54a0dd8ffde4e12e48681565d7999e82c9d9ceb155ca853d34ffe9a8a8f76c8f5aa9e92c534a476cceb5de060fd08de434e354
-
\Windows\IntelUpdate\Intel.exeFilesize
658KB
MD56d2af3af93fbb8e1fd8cbfde6fb810c0
SHA1aa0574609abf1acd8a7e27396548f32e6aac52d7
SHA2567d434574ff84cb293111d4ba1b953faa36eb49d8a257539e80b755e3f8fc3224
SHA51208feaec307d69c4ef91b91a50c54a0dd8ffde4e12e48681565d7999e82c9d9ceb155ca853d34ffe9a8a8f76c8f5aa9e92c534a476cceb5de060fd08de434e354
-
memory/316-58-0x0000000000000000-mapping.dmp
-
memory/580-63-0x0000000000000000-mapping.dmp
-
memory/684-60-0x0000000000000000-mapping.dmp
-
memory/1416-54-0x0000000074DC1000-0x0000000074DC3000-memory.dmpFilesize
8KB
-
memory/1704-57-0x0000000000000000-mapping.dmp
-
memory/1776-67-0x0000000000000000-mapping.dmp
-
memory/1788-55-0x0000000000000000-mapping.dmp
-
memory/2032-56-0x0000000000000000-mapping.dmp