Analysis
-
max time kernel
152s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2022, 06:54
Static task
static1
Behavioral task
behavioral1
Sample
b8f05bdec04bebe6126154938cd87d951e746fb7a4dd09dcb0cd75ed78422073.exe
Resource
win7-20220812-en
General
-
Target
b8f05bdec04bebe6126154938cd87d951e746fb7a4dd09dcb0cd75ed78422073.exe
-
Size
682KB
-
MD5
7d44e02e83f4c7367c575f9fa4cfb3cf
-
SHA1
058aa4c6d63ed55f59aba0587a7161b2efaccd34
-
SHA256
b8f05bdec04bebe6126154938cd87d951e746fb7a4dd09dcb0cd75ed78422073
-
SHA512
df249b9ea0d2a2414ef9ee6263f0cd0cd80388f008e6fa32521ee805158f1ee0a69a96888fe12b3a6a557927a0a2eacfbc0a953140ced1c105d4b82cadd353c9
-
SSDEEP
12288:0w/x3O7fSxVybnfjVD7Mf0/lm82dy9toTY7W2Hng7ysHklSV:rHybfjVvFdv2s9toMWuMhH7V
Malware Config
Extracted
darkcomet
Guest16
joker0.tzo.net:80
DC_MUTEX-QFKNWHP
-
gencode
EfQU94g4omFU
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile b8f05bdec04bebe6126154938cd87d951e746fb7a4dd09dcb0cd75ed78422073.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" b8f05bdec04bebe6126154938cd87d951e746fb7a4dd09dcb0cd75ed78422073.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" b8f05bdec04bebe6126154938cd87d951e746fb7a4dd09dcb0cd75ed78422073.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" b8f05bdec04bebe6126154938cd87d951e746fb7a4dd09dcb0cd75ed78422073.exe -
Disables Task Manager via registry modification
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1684 b8f05bdec04bebe6126154938cd87d951e746fb7a4dd09dcb0cd75ed78422073.exe Token: SeSecurityPrivilege 1684 b8f05bdec04bebe6126154938cd87d951e746fb7a4dd09dcb0cd75ed78422073.exe Token: SeTakeOwnershipPrivilege 1684 b8f05bdec04bebe6126154938cd87d951e746fb7a4dd09dcb0cd75ed78422073.exe Token: SeLoadDriverPrivilege 1684 b8f05bdec04bebe6126154938cd87d951e746fb7a4dd09dcb0cd75ed78422073.exe Token: SeSystemProfilePrivilege 1684 b8f05bdec04bebe6126154938cd87d951e746fb7a4dd09dcb0cd75ed78422073.exe Token: SeSystemtimePrivilege 1684 b8f05bdec04bebe6126154938cd87d951e746fb7a4dd09dcb0cd75ed78422073.exe Token: SeProfSingleProcessPrivilege 1684 b8f05bdec04bebe6126154938cd87d951e746fb7a4dd09dcb0cd75ed78422073.exe Token: SeIncBasePriorityPrivilege 1684 b8f05bdec04bebe6126154938cd87d951e746fb7a4dd09dcb0cd75ed78422073.exe Token: SeCreatePagefilePrivilege 1684 b8f05bdec04bebe6126154938cd87d951e746fb7a4dd09dcb0cd75ed78422073.exe Token: SeBackupPrivilege 1684 b8f05bdec04bebe6126154938cd87d951e746fb7a4dd09dcb0cd75ed78422073.exe Token: SeRestorePrivilege 1684 b8f05bdec04bebe6126154938cd87d951e746fb7a4dd09dcb0cd75ed78422073.exe Token: SeShutdownPrivilege 1684 b8f05bdec04bebe6126154938cd87d951e746fb7a4dd09dcb0cd75ed78422073.exe Token: SeDebugPrivilege 1684 b8f05bdec04bebe6126154938cd87d951e746fb7a4dd09dcb0cd75ed78422073.exe Token: SeSystemEnvironmentPrivilege 1684 b8f05bdec04bebe6126154938cd87d951e746fb7a4dd09dcb0cd75ed78422073.exe Token: SeChangeNotifyPrivilege 1684 b8f05bdec04bebe6126154938cd87d951e746fb7a4dd09dcb0cd75ed78422073.exe Token: SeRemoteShutdownPrivilege 1684 b8f05bdec04bebe6126154938cd87d951e746fb7a4dd09dcb0cd75ed78422073.exe Token: SeUndockPrivilege 1684 b8f05bdec04bebe6126154938cd87d951e746fb7a4dd09dcb0cd75ed78422073.exe Token: SeManageVolumePrivilege 1684 b8f05bdec04bebe6126154938cd87d951e746fb7a4dd09dcb0cd75ed78422073.exe Token: SeImpersonatePrivilege 1684 b8f05bdec04bebe6126154938cd87d951e746fb7a4dd09dcb0cd75ed78422073.exe Token: SeCreateGlobalPrivilege 1684 b8f05bdec04bebe6126154938cd87d951e746fb7a4dd09dcb0cd75ed78422073.exe Token: 33 1684 b8f05bdec04bebe6126154938cd87d951e746fb7a4dd09dcb0cd75ed78422073.exe Token: 34 1684 b8f05bdec04bebe6126154938cd87d951e746fb7a4dd09dcb0cd75ed78422073.exe Token: 35 1684 b8f05bdec04bebe6126154938cd87d951e746fb7a4dd09dcb0cd75ed78422073.exe Token: 36 1684 b8f05bdec04bebe6126154938cd87d951e746fb7a4dd09dcb0cd75ed78422073.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1684 b8f05bdec04bebe6126154938cd87d951e746fb7a4dd09dcb0cd75ed78422073.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8f05bdec04bebe6126154938cd87d951e746fb7a4dd09dcb0cd75ed78422073.exe"C:\Users\Admin\AppData\Local\Temp\b8f05bdec04bebe6126154938cd87d951e746fb7a4dd09dcb0cd75ed78422073.exe"1⤵
- Modifies firewall policy service
- Disables RegEdit via registry modification
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1684