Analysis
-
max time kernel
165s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02-10-2022 15:17
Static task
static1
Behavioral task
behavioral1
Sample
b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exe
Resource
win7-20220812-en
General
-
Target
b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exe
-
Size
236KB
-
MD5
4b710b5bd28868d214cda1d833f31540
-
SHA1
07dae9211259c29e71c6d60861c835f8d394c53f
-
SHA256
b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49
-
SHA512
e051e9c3a76eadcce7d3b6e7912ae8c237e7f910a23092d1d4b9f500d38d000142ff16437458d8d56e3f5fc466e68a6f4a90ad4325ec362d4d8f33ba6ecc11b8
-
SSDEEP
6144:h2FlTbH2NlvjzQXioDEctIV2zg7vbbmsf+e:h2FRbWNiioDbtO2zg7vbbbWe
Malware Config
Extracted
darkcomet
Zombie
y29kzv93yxjfnta5.no-ip.org:10
code_war_509
-
gencode
ZwamCGdDepco
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exedescription pid process Token: SeIncreaseQuotaPrivilege 976 b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exe Token: SeSecurityPrivilege 976 b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exe Token: SeTakeOwnershipPrivilege 976 b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exe Token: SeLoadDriverPrivilege 976 b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exe Token: SeSystemProfilePrivilege 976 b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exe Token: SeSystemtimePrivilege 976 b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exe Token: SeProfSingleProcessPrivilege 976 b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exe Token: SeIncBasePriorityPrivilege 976 b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exe Token: SeCreatePagefilePrivilege 976 b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exe Token: SeBackupPrivilege 976 b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exe Token: SeRestorePrivilege 976 b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exe Token: SeShutdownPrivilege 976 b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exe Token: SeDebugPrivilege 976 b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exe Token: SeSystemEnvironmentPrivilege 976 b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exe Token: SeChangeNotifyPrivilege 976 b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exe Token: SeRemoteShutdownPrivilege 976 b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exe Token: SeUndockPrivilege 976 b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exe Token: SeManageVolumePrivilege 976 b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exe Token: SeImpersonatePrivilege 976 b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exe Token: SeCreateGlobalPrivilege 976 b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exe Token: 33 976 b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exe Token: 34 976 b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exe Token: 35 976 b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exepid process 976 b4be38b3664ef15f0af7f2950d67f98d3d0df24e2b8c773234f57e8643b18f49.exe