Analysis
-
max time kernel
155s -
max time network
168s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
01-10-2022 23:49
Behavioral task
behavioral1
Sample
b761254c3627c7839e7dd94cb339699af7c8bd1f6400535afeb86b20190ee0d1.exe
Resource
win7-20220901-en
General
-
Target
b761254c3627c7839e7dd94cb339699af7c8bd1f6400535afeb86b20190ee0d1.exe
-
Size
690KB
-
MD5
93087bd40c4e1550f856510c08a5f332
-
SHA1
41349653394e7c8e332b082dce0ded7c61d3a69c
-
SHA256
b761254c3627c7839e7dd94cb339699af7c8bd1f6400535afeb86b20190ee0d1
-
SHA512
2c61b745340e9b88d48467f175e3fc4a810b2adf4ee486adec200963ffb579841ead96c8edde0c311cdb979f8639836b63f1bfc1b2d47a07846636ff4964ca7b
-
SSDEEP
12288:Z9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hqs:jZ1xuVVjfFoynPaVBUR8f+kN10EBx
Malware Config
Extracted
darkcomet
Guest16
203.192.205.71:80
DC_MUTEX-8HQU40W
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
s8dkdk5qgUVM
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
b761254c3627c7839e7dd94cb339699af7c8bd1f6400535afeb86b20190ee0d1.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" b761254c3627c7839e7dd94cb339699af7c8bd1f6400535afeb86b20190ee0d1.exe -
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
msdcsc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" msdcsc.exe -
Modifies security service 2 TTPs 1 IoCs
Processes:
msdcsc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" msdcsc.exe -
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
msdcsc.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" msdcsc.exe -
Disables Task Manager via registry modification
-
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 1104 msdcsc.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 4704 attrib.exe 2504 attrib.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
b761254c3627c7839e7dd94cb339699af7c8bd1f6400535afeb86b20190ee0d1.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation b761254c3627c7839e7dd94cb339699af7c8bd1f6400535afeb86b20190ee0d1.exe -
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
b761254c3627c7839e7dd94cb339699af7c8bd1f6400535afeb86b20190ee0d1.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" b761254c3627c7839e7dd94cb339699af7c8bd1f6400535afeb86b20190ee0d1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
b761254c3627c7839e7dd94cb339699af7c8bd1f6400535afeb86b20190ee0d1.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ b761254c3627c7839e7dd94cb339699af7c8bd1f6400535afeb86b20190ee0d1.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
msdcsc.exepid process 1104 msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
b761254c3627c7839e7dd94cb339699af7c8bd1f6400535afeb86b20190ee0d1.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 4928 b761254c3627c7839e7dd94cb339699af7c8bd1f6400535afeb86b20190ee0d1.exe Token: SeSecurityPrivilege 4928 b761254c3627c7839e7dd94cb339699af7c8bd1f6400535afeb86b20190ee0d1.exe Token: SeTakeOwnershipPrivilege 4928 b761254c3627c7839e7dd94cb339699af7c8bd1f6400535afeb86b20190ee0d1.exe Token: SeLoadDriverPrivilege 4928 b761254c3627c7839e7dd94cb339699af7c8bd1f6400535afeb86b20190ee0d1.exe Token: SeSystemProfilePrivilege 4928 b761254c3627c7839e7dd94cb339699af7c8bd1f6400535afeb86b20190ee0d1.exe Token: SeSystemtimePrivilege 4928 b761254c3627c7839e7dd94cb339699af7c8bd1f6400535afeb86b20190ee0d1.exe Token: SeProfSingleProcessPrivilege 4928 b761254c3627c7839e7dd94cb339699af7c8bd1f6400535afeb86b20190ee0d1.exe Token: SeIncBasePriorityPrivilege 4928 b761254c3627c7839e7dd94cb339699af7c8bd1f6400535afeb86b20190ee0d1.exe Token: SeCreatePagefilePrivilege 4928 b761254c3627c7839e7dd94cb339699af7c8bd1f6400535afeb86b20190ee0d1.exe Token: SeBackupPrivilege 4928 b761254c3627c7839e7dd94cb339699af7c8bd1f6400535afeb86b20190ee0d1.exe Token: SeRestorePrivilege 4928 b761254c3627c7839e7dd94cb339699af7c8bd1f6400535afeb86b20190ee0d1.exe Token: SeShutdownPrivilege 4928 b761254c3627c7839e7dd94cb339699af7c8bd1f6400535afeb86b20190ee0d1.exe Token: SeDebugPrivilege 4928 b761254c3627c7839e7dd94cb339699af7c8bd1f6400535afeb86b20190ee0d1.exe Token: SeSystemEnvironmentPrivilege 4928 b761254c3627c7839e7dd94cb339699af7c8bd1f6400535afeb86b20190ee0d1.exe Token: SeChangeNotifyPrivilege 4928 b761254c3627c7839e7dd94cb339699af7c8bd1f6400535afeb86b20190ee0d1.exe Token: SeRemoteShutdownPrivilege 4928 b761254c3627c7839e7dd94cb339699af7c8bd1f6400535afeb86b20190ee0d1.exe Token: SeUndockPrivilege 4928 b761254c3627c7839e7dd94cb339699af7c8bd1f6400535afeb86b20190ee0d1.exe Token: SeManageVolumePrivilege 4928 b761254c3627c7839e7dd94cb339699af7c8bd1f6400535afeb86b20190ee0d1.exe Token: SeImpersonatePrivilege 4928 b761254c3627c7839e7dd94cb339699af7c8bd1f6400535afeb86b20190ee0d1.exe Token: SeCreateGlobalPrivilege 4928 b761254c3627c7839e7dd94cb339699af7c8bd1f6400535afeb86b20190ee0d1.exe Token: 33 4928 b761254c3627c7839e7dd94cb339699af7c8bd1f6400535afeb86b20190ee0d1.exe Token: 34 4928 b761254c3627c7839e7dd94cb339699af7c8bd1f6400535afeb86b20190ee0d1.exe Token: 35 4928 b761254c3627c7839e7dd94cb339699af7c8bd1f6400535afeb86b20190ee0d1.exe Token: 36 4928 b761254c3627c7839e7dd94cb339699af7c8bd1f6400535afeb86b20190ee0d1.exe Token: SeIncreaseQuotaPrivilege 1104 msdcsc.exe Token: SeSecurityPrivilege 1104 msdcsc.exe Token: SeTakeOwnershipPrivilege 1104 msdcsc.exe Token: SeLoadDriverPrivilege 1104 msdcsc.exe Token: SeSystemProfilePrivilege 1104 msdcsc.exe Token: SeSystemtimePrivilege 1104 msdcsc.exe Token: SeProfSingleProcessPrivilege 1104 msdcsc.exe Token: SeIncBasePriorityPrivilege 1104 msdcsc.exe Token: SeCreatePagefilePrivilege 1104 msdcsc.exe Token: SeBackupPrivilege 1104 msdcsc.exe Token: SeRestorePrivilege 1104 msdcsc.exe Token: SeShutdownPrivilege 1104 msdcsc.exe Token: SeDebugPrivilege 1104 msdcsc.exe Token: SeSystemEnvironmentPrivilege 1104 msdcsc.exe Token: SeChangeNotifyPrivilege 1104 msdcsc.exe Token: SeRemoteShutdownPrivilege 1104 msdcsc.exe Token: SeUndockPrivilege 1104 msdcsc.exe Token: SeManageVolumePrivilege 1104 msdcsc.exe Token: SeImpersonatePrivilege 1104 msdcsc.exe Token: SeCreateGlobalPrivilege 1104 msdcsc.exe Token: 33 1104 msdcsc.exe Token: 34 1104 msdcsc.exe Token: 35 1104 msdcsc.exe Token: 36 1104 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
msdcsc.exepid process 1104 msdcsc.exe -
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
b761254c3627c7839e7dd94cb339699af7c8bd1f6400535afeb86b20190ee0d1.execmd.execmd.exemsdcsc.exedescription pid process target process PID 4928 wrote to memory of 1968 4928 b761254c3627c7839e7dd94cb339699af7c8bd1f6400535afeb86b20190ee0d1.exe cmd.exe PID 4928 wrote to memory of 1968 4928 b761254c3627c7839e7dd94cb339699af7c8bd1f6400535afeb86b20190ee0d1.exe cmd.exe PID 4928 wrote to memory of 1968 4928 b761254c3627c7839e7dd94cb339699af7c8bd1f6400535afeb86b20190ee0d1.exe cmd.exe PID 4928 wrote to memory of 644 4928 b761254c3627c7839e7dd94cb339699af7c8bd1f6400535afeb86b20190ee0d1.exe cmd.exe PID 4928 wrote to memory of 644 4928 b761254c3627c7839e7dd94cb339699af7c8bd1f6400535afeb86b20190ee0d1.exe cmd.exe PID 4928 wrote to memory of 644 4928 b761254c3627c7839e7dd94cb339699af7c8bd1f6400535afeb86b20190ee0d1.exe cmd.exe PID 1968 wrote to memory of 4704 1968 cmd.exe attrib.exe PID 1968 wrote to memory of 4704 1968 cmd.exe attrib.exe PID 1968 wrote to memory of 4704 1968 cmd.exe attrib.exe PID 644 wrote to memory of 2504 644 cmd.exe attrib.exe PID 644 wrote to memory of 2504 644 cmd.exe attrib.exe PID 644 wrote to memory of 2504 644 cmd.exe attrib.exe PID 4928 wrote to memory of 1104 4928 b761254c3627c7839e7dd94cb339699af7c8bd1f6400535afeb86b20190ee0d1.exe msdcsc.exe PID 4928 wrote to memory of 1104 4928 b761254c3627c7839e7dd94cb339699af7c8bd1f6400535afeb86b20190ee0d1.exe msdcsc.exe PID 4928 wrote to memory of 1104 4928 b761254c3627c7839e7dd94cb339699af7c8bd1f6400535afeb86b20190ee0d1.exe msdcsc.exe PID 1104 wrote to memory of 100 1104 msdcsc.exe notepad.exe PID 1104 wrote to memory of 100 1104 msdcsc.exe notepad.exe PID 1104 wrote to memory of 100 1104 msdcsc.exe notepad.exe PID 1104 wrote to memory of 100 1104 msdcsc.exe notepad.exe PID 1104 wrote to memory of 100 1104 msdcsc.exe notepad.exe PID 1104 wrote to memory of 100 1104 msdcsc.exe notepad.exe PID 1104 wrote to memory of 100 1104 msdcsc.exe notepad.exe PID 1104 wrote to memory of 100 1104 msdcsc.exe notepad.exe PID 1104 wrote to memory of 100 1104 msdcsc.exe notepad.exe PID 1104 wrote to memory of 100 1104 msdcsc.exe notepad.exe PID 1104 wrote to memory of 100 1104 msdcsc.exe notepad.exe PID 1104 wrote to memory of 100 1104 msdcsc.exe notepad.exe PID 1104 wrote to memory of 100 1104 msdcsc.exe notepad.exe PID 1104 wrote to memory of 100 1104 msdcsc.exe notepad.exe PID 1104 wrote to memory of 100 1104 msdcsc.exe notepad.exe PID 1104 wrote to memory of 100 1104 msdcsc.exe notepad.exe PID 1104 wrote to memory of 100 1104 msdcsc.exe notepad.exe PID 1104 wrote to memory of 100 1104 msdcsc.exe notepad.exe PID 1104 wrote to memory of 100 1104 msdcsc.exe notepad.exe PID 1104 wrote to memory of 100 1104 msdcsc.exe notepad.exe PID 1104 wrote to memory of 100 1104 msdcsc.exe notepad.exe PID 1104 wrote to memory of 100 1104 msdcsc.exe notepad.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
msdcsc.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" msdcsc.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 4704 attrib.exe 2504 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b761254c3627c7839e7dd94cb339699af7c8bd1f6400535afeb86b20190ee0d1.exe"C:\Users\Admin\AppData\Local\Temp\b761254c3627c7839e7dd94cb339699af7c8bd1f6400535afeb86b20190ee0d1.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\b761254c3627c7839e7dd94cb339699af7c8bd1f6400535afeb86b20190ee0d1.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\b761254c3627c7839e7dd94cb339699af7c8bd1f6400535afeb86b20190ee0d1.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
690KB
MD593087bd40c4e1550f856510c08a5f332
SHA141349653394e7c8e332b082dce0ded7c61d3a69c
SHA256b761254c3627c7839e7dd94cb339699af7c8bd1f6400535afeb86b20190ee0d1
SHA5122c61b745340e9b88d48467f175e3fc4a810b2adf4ee486adec200963ffb579841ead96c8edde0c311cdb979f8639836b63f1bfc1b2d47a07846636ff4964ca7b
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
690KB
MD593087bd40c4e1550f856510c08a5f332
SHA141349653394e7c8e332b082dce0ded7c61d3a69c
SHA256b761254c3627c7839e7dd94cb339699af7c8bd1f6400535afeb86b20190ee0d1
SHA5122c61b745340e9b88d48467f175e3fc4a810b2adf4ee486adec200963ffb579841ead96c8edde0c311cdb979f8639836b63f1bfc1b2d47a07846636ff4964ca7b
-
memory/100-139-0x0000000000000000-mapping.dmp
-
memory/644-133-0x0000000000000000-mapping.dmp
-
memory/1104-136-0x0000000000000000-mapping.dmp
-
memory/1968-132-0x0000000000000000-mapping.dmp
-
memory/2504-135-0x0000000000000000-mapping.dmp
-
memory/4704-134-0x0000000000000000-mapping.dmp