Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/10/2022, 09:18

General

  • Target

    5033b6023262057f028bc8f1863e1568b77c3748c58d0a2dfc752167605f522e.exe

  • Size

    681KB

  • MD5

    4e0811569886759752e02fe7cb9d2a90

  • SHA1

    b7d1288f56c430e1e65b5034c938b38a986f228a

  • SHA256

    5033b6023262057f028bc8f1863e1568b77c3748c58d0a2dfc752167605f522e

  • SHA512

    b9c7ab963b07d1416d5f119c52a8c2577157b7a780d73678e54aa871ac67f42f81a2f3d0af88568e1b3395d2609d5a0fb628b85c1ba40a88e70aa9f0445a763e

  • SSDEEP

    12288:r9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hD:lZ1xuVVjfFoynPaVBUR8f+kN10EBB

Malware Config

Extracted

Family

darkcomet

Botnet

jaja

C2

darkcomet9912.no-ip.biz:80

darkcomet9912.no-ip.biz:82

darkcomet9912.no-ip.biz:10048

81.190.65.57:10048

81.190.65.57:82

81.190.65.57:80

Mutex

DC_MUTEX-E9RCJ06

Attributes
  • InstallPath

    MSDCSC\msdcsc.exe

  • gencode

    1ue7ZRVqVhWU

  • install

    true

  • offline_keylogger

    true

  • persistence

    true

  • reg_key

    Update

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies firewall policy service 2 TTPs 3 IoCs
  • Disables RegEdit via registry modification 1 IoCs
  • Disables Task Manager via registry modification
  • Executes dropped EXE 1 IoCs
  • Sets file to hidden 1 TTPs 2 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5033b6023262057f028bc8f1863e1568b77c3748c58d0a2dfc752167605f522e.exe
    "C:\Users\Admin\AppData\Local\Temp\5033b6023262057f028bc8f1863e1568b77c3748c58d0a2dfc752167605f522e.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3064
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\5033b6023262057f028bc8f1863e1568b77c3748c58d0a2dfc752167605f522e.exe" +s +h
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1292
      • C:\Windows\SysWOW64\attrib.exe
        attrib "C:\Users\Admin\AppData\Local\Temp\5033b6023262057f028bc8f1863e1568b77c3748c58d0a2dfc752167605f522e.exe" +s +h
        3⤵
        • Sets file to hidden
        • Views/modifies file attributes
        PID:4656
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3668
      • C:\Windows\SysWOW64\attrib.exe
        attrib "C:\Users\Admin\AppData\Local\Temp" +s +h
        3⤵
        • Sets file to hidden
        • Views/modifies file attributes
        PID:2292
    • C:\Windows\SysWOW64\notepad.exe
      notepad
      2⤵
        PID:392
      • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
        "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
        2⤵
        • Modifies firewall policy service
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2704
        • C:\Windows\SysWOW64\notepad.exe
          notepad
          3⤵
            PID:1060

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe

        Filesize

        681KB

        MD5

        4e0811569886759752e02fe7cb9d2a90

        SHA1

        b7d1288f56c430e1e65b5034c938b38a986f228a

        SHA256

        5033b6023262057f028bc8f1863e1568b77c3748c58d0a2dfc752167605f522e

        SHA512

        b9c7ab963b07d1416d5f119c52a8c2577157b7a780d73678e54aa871ac67f42f81a2f3d0af88568e1b3395d2609d5a0fb628b85c1ba40a88e70aa9f0445a763e

      • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe

        Filesize

        681KB

        MD5

        4e0811569886759752e02fe7cb9d2a90

        SHA1

        b7d1288f56c430e1e65b5034c938b38a986f228a

        SHA256

        5033b6023262057f028bc8f1863e1568b77c3748c58d0a2dfc752167605f522e

        SHA512

        b9c7ab963b07d1416d5f119c52a8c2577157b7a780d73678e54aa871ac67f42f81a2f3d0af88568e1b3395d2609d5a0fb628b85c1ba40a88e70aa9f0445a763e