Analysis
- max time kernel
153s - max time network
175s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
14/10/2022, 10:07
Static task
static1
Behavioral task
behavioral1
Sample
83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe
Resource
win7-20220812-en
windows7-x64
15 signatures
150 seconds
General
- Target 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe
- Size 896KB
- Sample221014-l549paaeg6
- SHA256 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13
- MD5 465cd7d12a6d172b5e63fb3d73dfeeee
- SHA1 2c2e806aee3159acfd50060c4480967dc4ea9ef9
- SHA512 5eee4992caf7c3405f93b86ab5fadd2dcdaa59d2360f4cfe43a1d64c5241b978ec7d0205a68ab0f7f6cc2084226ec4b695e711608a10b585daccb792ad6b3977
- SSDEEP 24576:9m22dzbkoGp0bfLpE5/MccfwuwpnrgQaL:02ikCwnJ
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
darkcomet
Botnet
-
Guest16
C2
-
r3dz80.no-ip.biz:1604
Mutex
-
DC_MUTEX-BLY4NYD
Attributes
-
InstallPath
MSC\mscsc.exe
-
gencode
CpD5oSVX2oqz
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
pdate
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\MSC\\mscsc.exe" 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe - Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile mscsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" mscsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" mscsc.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" mscsc.exe - Disables Task Manager via registry modification
- Executes dropped EXE 2 IoCs
pid Process 3144 mscsc.exe 4412 mscsc.exe - Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 3648 attrib.exe 3620 attrib.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pdate = "C:\\Users\\Admin\\AppData\\Roaming\\MSC\\mscsc.exe" 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 5016 set thread context of 5084 5016 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe 82 PID 3144 set thread context of 4412 3144 mscsc.exe 90 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4412 mscsc.exe - Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 5084 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe Token: SeSecurityPrivilege 5084 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe Token: SeTakeOwnershipPrivilege 5084 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe Token: SeLoadDriverPrivilege 5084 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe Token: SeSystemProfilePrivilege 5084 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe Token: SeSystemtimePrivilege 5084 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe Token: SeProfSingleProcessPrivilege 5084 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe Token: SeIncBasePriorityPrivilege 5084 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe Token: SeCreatePagefilePrivilege 5084 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe Token: SeBackupPrivilege 5084 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe Token: SeRestorePrivilege 5084 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe Token: SeShutdownPrivilege 5084 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe Token: SeDebugPrivilege 5084 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe Token: SeSystemEnvironmentPrivilege 5084 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe Token: SeChangeNotifyPrivilege 5084 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe Token: SeRemoteShutdownPrivilege 5084 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe Token: SeUndockPrivilege 5084 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe Token: SeManageVolumePrivilege 5084 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe Token: SeImpersonatePrivilege 5084 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe Token: SeCreateGlobalPrivilege 5084 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe Token: 33 5084 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe Token: 34 5084 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe Token: 35 5084 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe Token: 36 5084 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe Token: SeIncreaseQuotaPrivilege 4412 mscsc.exe Token: SeSecurityPrivilege 4412 mscsc.exe Token: SeTakeOwnershipPrivilege 4412 mscsc.exe Token: SeLoadDriverPrivilege 4412 mscsc.exe Token: SeSystemProfilePrivilege 4412 mscsc.exe Token: SeSystemtimePrivilege 4412 mscsc.exe Token: SeProfSingleProcessPrivilege 4412 mscsc.exe Token: SeIncBasePriorityPrivilege 4412 mscsc.exe Token: SeCreatePagefilePrivilege 4412 mscsc.exe Token: SeBackupPrivilege 4412 mscsc.exe Token: SeRestorePrivilege 4412 mscsc.exe Token: SeShutdownPrivilege 4412 mscsc.exe Token: SeDebugPrivilege 4412 mscsc.exe Token: SeSystemEnvironmentPrivilege 4412 mscsc.exe Token: SeChangeNotifyPrivilege 4412 mscsc.exe Token: SeRemoteShutdownPrivilege 4412 mscsc.exe Token: SeUndockPrivilege 4412 mscsc.exe Token: SeManageVolumePrivilege 4412 mscsc.exe Token: SeImpersonatePrivilege 4412 mscsc.exe Token: SeCreateGlobalPrivilege 4412 mscsc.exe Token: 33 4412 mscsc.exe Token: 34 4412 mscsc.exe Token: 35 4412 mscsc.exe Token: 36 4412 mscsc.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 5016 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe 3144 mscsc.exe 4412 mscsc.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5016 wrote to memory of 5084 5016 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe 82 PID 5016 wrote to memory of 5084 5016 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe 82 PID 5016 wrote to memory of 5084 5016 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe 82 PID 5016 wrote to memory of 5084 5016 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe 82 PID 5016 wrote to memory of 5084 5016 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe 82 PID 5016 wrote to memory of 5084 5016 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe 82 PID 5016 wrote to memory of 5084 5016 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe 82 PID 5016 wrote to memory of 5084 5016 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe 82 PID 5016 wrote to memory of 5084 5016 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe 82 PID 5016 wrote to memory of 5084 5016 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe 82 PID 5016 wrote to memory of 5084 5016 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe 82 PID 5016 wrote to memory of 5084 5016 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe 82 PID 5016 wrote to memory of 5084 5016 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe 82 PID 5016 wrote to memory of 5084 5016 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe 82 PID 5084 wrote to memory of 1476 5084 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe 83 PID 5084 wrote to memory of 1476 5084 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe 83 PID 5084 wrote to memory of 1476 5084 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe 83 PID 5084 wrote to memory of 2704 5084 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe 85 PID 5084 wrote to memory of 2704 5084 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe 85 PID 5084 wrote to memory of 2704 5084 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe 85 PID 1476 wrote to memory of 3648 1476 cmd.exe 87 PID 1476 wrote to memory of 3648 1476 cmd.exe 87 PID 1476 wrote to memory of 3648 1476 cmd.exe 87 PID 2704 wrote to memory of 3620 2704 cmd.exe 88 PID 2704 wrote to memory of 3620 2704 cmd.exe 88 PID 2704 wrote to memory of 3620 2704 cmd.exe 88 PID 5084 wrote to memory of 3144 5084 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe 89 PID 5084 wrote to memory of 3144 5084 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe 89 PID 5084 wrote to memory of 3144 5084 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe 89 PID 3144 wrote to memory of 4412 3144 mscsc.exe 90 PID 3144 wrote to memory of 4412 3144 mscsc.exe 90 PID 3144 wrote to memory of 4412 3144 mscsc.exe 90 PID 3144 wrote to memory of 4412 3144 mscsc.exe 90 PID 3144 wrote to memory of 4412 3144 mscsc.exe 90 PID 3144 wrote to memory of 4412 3144 mscsc.exe 90 PID 3144 wrote to memory of 4412 3144 mscsc.exe 90 PID 3144 wrote to memory of 4412 3144 mscsc.exe 90 PID 3144 wrote to memory of 4412 3144 mscsc.exe 90 PID 3144 wrote to memory of 4412 3144 mscsc.exe 90 PID 3144 wrote to memory of 4412 3144 mscsc.exe 90 PID 3144 wrote to memory of 4412 3144 mscsc.exe 90 PID 3144 wrote to memory of 4412 3144 mscsc.exe 90 PID 3144 wrote to memory of 4412 3144 mscsc.exe 90 PID 4412 wrote to memory of 4380 4412 mscsc.exe 93 PID 4412 wrote to memory of 4380 4412 mscsc.exe 93 PID 4412 wrote to memory of 4380 4412 mscsc.exe 93 PID 4412 wrote to memory of 4380 4412 mscsc.exe 93 PID 4412 wrote to memory of 4380 4412 mscsc.exe 93 PID 4412 wrote to memory of 4380 4412 mscsc.exe 93 PID 4412 wrote to memory of 4380 4412 mscsc.exe 93 PID 4412 wrote to memory of 4380 4412 mscsc.exe 93 PID 4412 wrote to memory of 4380 4412 mscsc.exe 93 PID 4412 wrote to memory of 4380 4412 mscsc.exe 93 PID 4412 wrote to memory of 4380 4412 mscsc.exe 93 PID 4412 wrote to memory of 4380 4412 mscsc.exe 93 PID 4412 wrote to memory of 4380 4412 mscsc.exe 93 PID 4412 wrote to memory of 4380 4412 mscsc.exe 93 PID 4412 wrote to memory of 4380 4412 mscsc.exe 93 PID 4412 wrote to memory of 4380 4412 mscsc.exe 93 PID 4412 wrote to memory of 4380 4412 mscsc.exe 93 PID 4412 wrote to memory of 4380 4412 mscsc.exe 93 PID 4412 wrote to memory of 4380 4412 mscsc.exe 93 PID 4412 wrote to memory of 4380 4412 mscsc.exe 93 PID 4412 wrote to memory of 4380 4412 mscsc.exe 93 - Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 3648 attrib.exe 3620 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe"C:\Users\Admin\AppData\Local\Temp\83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe"C:\Users\Admin\AppData\Local\Temp\83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe"2⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe" +s +h3⤵
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13.exe" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:3648
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:3620
-
-
-
C:\Users\Admin\AppData\Roaming\MSC\mscsc.exe"C:\Users\Admin\AppData\Roaming\MSC\mscsc.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Roaming\MSC\mscsc.exe"C:\Users\Admin\AppData\Roaming\MSC\mscsc.exe"4⤵
- Modifies firewall policy service
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Windows\SysWOW64\notepad.exenotepad5⤵PID:4380
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\MSC\mscsc.exe
- Size 896KB
- SHA256 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13
- MD5 465cd7d12a6d172b5e63fb3d73dfeeee
- SHA1 2c2e806aee3159acfd50060c4480967dc4ea9ef9
- SHA512 5eee4992caf7c3405f93b86ab5fadd2dcdaa59d2360f4cfe43a1d64c5241b978ec7d0205a68ab0f7f6cc2084226ec4b695e711608a10b585daccb792ad6b3977
- SSDEEP 24576:9m22dzbkoGp0bfLpE5/MccfwuwpnrgQaL:02ikCwnJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\MSC\mscsc.exe
- Size 896KB
- SHA256 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13
- MD5 465cd7d12a6d172b5e63fb3d73dfeeee
- SHA1 2c2e806aee3159acfd50060c4480967dc4ea9ef9
- SHA512 5eee4992caf7c3405f93b86ab5fadd2dcdaa59d2360f4cfe43a1d64c5241b978ec7d0205a68ab0f7f6cc2084226ec4b695e711608a10b585daccb792ad6b3977
- SSDEEP 24576:9m22dzbkoGp0bfLpE5/MccfwuwpnrgQaL:02ikCwnJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\MSC\mscsc.exe
- Size 896KB
- SHA256 83a7f5dff75191313645cf4b5826b8f5e70cfae04b9cdc37f12ee94dfa714c13
- MD5 465cd7d12a6d172b5e63fb3d73dfeeee
- SHA1 2c2e806aee3159acfd50060c4480967dc4ea9ef9
- SHA512 5eee4992caf7c3405f93b86ab5fadd2dcdaa59d2360f4cfe43a1d64c5241b978ec7d0205a68ab0f7f6cc2084226ec4b695e711608a10b585daccb792ad6b3977
- SSDEEP 24576:9m22dzbkoGp0bfLpE5/MccfwuwpnrgQaL:02ikCwnJ
- MD5 SHA1 SHA512 SSDEEP