Analysis
-
max time kernel
152s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01-10-2022 23:39
Behavioral task
behavioral1
Sample
3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe
Resource
win7-20220812-en
General
-
Target
3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe
-
Size
251KB
-
MD5
7311b5a44dfce7fb05fbb7a9af3f9e40
-
SHA1
6580b99ed6ce5ec2257aa7c81cdbe135257807a4
-
SHA256
3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b
-
SHA512
05a6f5b5af3c409da7c3b435bfaa519f7aad7362d48b2152ae6a5e0d5f5e0c1f5f37655a41afa47dda771ed1865efb22f2a585702aa498c9a8ebacaa789ded03
-
SSDEEP
6144:NcNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37dh:NcW7KEZlPzCy37n
Malware Config
Extracted
darkcomet
Guest16
hnoo17.no-ip.biz:81
DC_MUTEX-QRJRZ13
-
gencode
iLoJ9nfDEXca
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe -
Modifies security service 2 TTPs 1 IoCs
Processes:
3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe -
Processes:
3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe -
Disables Task Manager via registry modification
-
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 1664 attrib.exe 1640 attrib.exe -
Processes:
resource yara_rule behavioral1/memory/1652-55-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/1652-62-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Processes:
3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exepid process 1652 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exedescription pid process Token: SeIncreaseQuotaPrivilege 1652 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe Token: SeSecurityPrivilege 1652 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe Token: SeTakeOwnershipPrivilege 1652 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe Token: SeLoadDriverPrivilege 1652 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe Token: SeSystemProfilePrivilege 1652 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe Token: SeSystemtimePrivilege 1652 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe Token: SeProfSingleProcessPrivilege 1652 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe Token: SeIncBasePriorityPrivilege 1652 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe Token: SeCreatePagefilePrivilege 1652 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe Token: SeBackupPrivilege 1652 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe Token: SeRestorePrivilege 1652 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe Token: SeShutdownPrivilege 1652 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe Token: SeDebugPrivilege 1652 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe Token: SeSystemEnvironmentPrivilege 1652 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe Token: SeChangeNotifyPrivilege 1652 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe Token: SeRemoteShutdownPrivilege 1652 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe Token: SeUndockPrivilege 1652 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe Token: SeManageVolumePrivilege 1652 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe Token: SeImpersonatePrivilege 1652 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe Token: SeCreateGlobalPrivilege 1652 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe Token: 33 1652 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe Token: 34 1652 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe Token: 35 1652 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exepid process 1652 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe -
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.execmd.execmd.exedescription pid process target process PID 1652 wrote to memory of 1816 1652 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe cmd.exe PID 1652 wrote to memory of 1816 1652 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe cmd.exe PID 1652 wrote to memory of 1816 1652 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe cmd.exe PID 1652 wrote to memory of 1816 1652 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe cmd.exe PID 1652 wrote to memory of 1580 1652 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe cmd.exe PID 1652 wrote to memory of 1580 1652 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe cmd.exe PID 1652 wrote to memory of 1580 1652 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe cmd.exe PID 1652 wrote to memory of 1580 1652 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe cmd.exe PID 1652 wrote to memory of 1584 1652 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe notepad.exe PID 1652 wrote to memory of 1584 1652 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe notepad.exe PID 1652 wrote to memory of 1584 1652 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe notepad.exe PID 1652 wrote to memory of 1584 1652 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe notepad.exe PID 1816 wrote to memory of 1664 1816 cmd.exe attrib.exe PID 1816 wrote to memory of 1664 1816 cmd.exe attrib.exe PID 1816 wrote to memory of 1664 1816 cmd.exe attrib.exe PID 1816 wrote to memory of 1664 1816 cmd.exe attrib.exe PID 1652 wrote to memory of 1584 1652 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe notepad.exe PID 1652 wrote to memory of 1584 1652 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe notepad.exe PID 1652 wrote to memory of 1584 1652 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe notepad.exe PID 1652 wrote to memory of 1584 1652 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe notepad.exe PID 1652 wrote to memory of 1584 1652 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe notepad.exe PID 1652 wrote to memory of 1584 1652 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe notepad.exe PID 1652 wrote to memory of 1584 1652 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe notepad.exe PID 1652 wrote to memory of 1584 1652 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe notepad.exe PID 1652 wrote to memory of 1584 1652 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe notepad.exe PID 1652 wrote to memory of 1584 1652 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe notepad.exe PID 1652 wrote to memory of 1584 1652 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe notepad.exe PID 1652 wrote to memory of 1584 1652 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe notepad.exe PID 1652 wrote to memory of 1584 1652 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe notepad.exe PID 1652 wrote to memory of 1584 1652 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe notepad.exe PID 1652 wrote to memory of 1584 1652 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe notepad.exe PID 1652 wrote to memory of 1584 1652 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe notepad.exe PID 1652 wrote to memory of 1584 1652 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe notepad.exe PID 1652 wrote to memory of 1584 1652 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe notepad.exe PID 1652 wrote to memory of 1584 1652 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe notepad.exe PID 1580 wrote to memory of 1640 1580 cmd.exe attrib.exe PID 1580 wrote to memory of 1640 1580 cmd.exe attrib.exe PID 1580 wrote to memory of 1640 1580 cmd.exe attrib.exe PID 1580 wrote to memory of 1640 1580 cmd.exe attrib.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern 3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 1664 attrib.exe 1640 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe"C:\Users\Admin\AppData\Local\Temp\3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe"1⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Windows security modification
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\3bcd710396553dce718e179868b397a4659bce918f796ceadce61822d7f01c4b.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1580-57-0x0000000000000000-mapping.dmp
-
memory/1584-58-0x0000000000000000-mapping.dmp
-
memory/1640-60-0x0000000000000000-mapping.dmp
-
memory/1652-54-0x0000000076041000-0x0000000076043000-memory.dmpFilesize
8KB
-
memory/1652-55-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1652-62-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1664-59-0x0000000000000000-mapping.dmp
-
memory/1816-56-0x0000000000000000-mapping.dmp