Analysis
-
max time kernel
151s -
max time network
165s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
20/10/2022, 09:53
Behavioral task
behavioral1
Sample
5b91f5cb294f987aeeb2f60fbaf7a59b637ac9190b68d838de46dd56ee13c0ec.exe
Resource
win7-20220812-en
windows7-x64
21 signatures
150 seconds
General
-
Target
5b91f5cb294f987aeeb2f60fbaf7a59b637ac9190b68d838de46dd56ee13c0ec.exe
-
Size
854KB
-
MD5
4c8396f8db1a485dc0b93651d8f7dbd0
-
SHA1
ed5b2b872399519287c2a33f54ecd31337116711
-
SHA256
5b91f5cb294f987aeeb2f60fbaf7a59b637ac9190b68d838de46dd56ee13c0ec
-
SHA512
3d690b7664d6bb5d9c0c5fe17a02cd7450d717065e11a67cf4e13ffc5e3a0fe2a9836db48dfe8562eb83731c002f5fdc7882c9f1d73484da04496db9ce4f7f99
-
SSDEEP
24576:OZ1xuVVjfFoynPaVBUR8f+kN10EBKACG9egjT+:uQDgok30B7ojT+
Malware Config
Extracted
Family
darkcomet
Botnet
Guest16
C2
badzo.no-ip.org:80
Mutex
DC_MUTEX-82MKNGT
Attributes
-
InstallPath
system32\wuapp.exe
-
gencode
Gr6dTPRj3EsY
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
Microsoft Windows Update
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Gr6dTPRj3EsY\\wuapp.exe" 5b91f5cb294f987aeeb2f60fbaf7a59b637ac9190b68d838de46dd56ee13c0ec.exe -
Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile wuapp.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" wuapp.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" wuapp.exe -
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" wuapp.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" wuapp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" wuapp.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" wuapp.exe -
Disables Task Manager via registry modification
-
Executes dropped EXE 1 IoCs
pid Process 1152 wuapp.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 1460 attrib.exe 1464 attrib.exe -
Loads dropped DLL 2 IoCs
pid Process 1080 5b91f5cb294f987aeeb2f60fbaf7a59b637ac9190b68d838de46dd56ee13c0ec.exe 1080 5b91f5cb294f987aeeb2f60fbaf7a59b637ac9190b68d838de46dd56ee13c0ec.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" wuapp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" wuapp.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Update = "C:\\Windows\\system32\\Gr6dTPRj3EsY\\wuapp.exe" 5b91f5cb294f987aeeb2f60fbaf7a59b637ac9190b68d838de46dd56ee13c0ec.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\wuapp.exe 5b91f5cb294f987aeeb2f60fbaf7a59b637ac9190b68d838de46dd56ee13c0ec.exe File created C:\Windows\SysWOW64\Gr6dTPRj3EsY\wuapp.exe 5b91f5cb294f987aeeb2f60fbaf7a59b637ac9190b68d838de46dd56ee13c0ec.exe File opened for modification C:\Windows\SysWOW64\Gr6dTPRj3EsY\wuapp.exe 5b91f5cb294f987aeeb2f60fbaf7a59b637ac9190b68d838de46dd56ee13c0ec.exe File opened for modification C:\Windows\SysWOW64\Gr6dTPRj3EsY\ 5b91f5cb294f987aeeb2f60fbaf7a59b637ac9190b68d838de46dd56ee13c0ec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1152 wuapp.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1080 5b91f5cb294f987aeeb2f60fbaf7a59b637ac9190b68d838de46dd56ee13c0ec.exe Token: SeSecurityPrivilege 1080 5b91f5cb294f987aeeb2f60fbaf7a59b637ac9190b68d838de46dd56ee13c0ec.exe Token: SeTakeOwnershipPrivilege 1080 5b91f5cb294f987aeeb2f60fbaf7a59b637ac9190b68d838de46dd56ee13c0ec.exe Token: SeLoadDriverPrivilege 1080 5b91f5cb294f987aeeb2f60fbaf7a59b637ac9190b68d838de46dd56ee13c0ec.exe Token: SeSystemProfilePrivilege 1080 5b91f5cb294f987aeeb2f60fbaf7a59b637ac9190b68d838de46dd56ee13c0ec.exe Token: SeSystemtimePrivilege 1080 5b91f5cb294f987aeeb2f60fbaf7a59b637ac9190b68d838de46dd56ee13c0ec.exe Token: SeProfSingleProcessPrivilege 1080 5b91f5cb294f987aeeb2f60fbaf7a59b637ac9190b68d838de46dd56ee13c0ec.exe Token: SeIncBasePriorityPrivilege 1080 5b91f5cb294f987aeeb2f60fbaf7a59b637ac9190b68d838de46dd56ee13c0ec.exe Token: SeCreatePagefilePrivilege 1080 5b91f5cb294f987aeeb2f60fbaf7a59b637ac9190b68d838de46dd56ee13c0ec.exe Token: SeBackupPrivilege 1080 5b91f5cb294f987aeeb2f60fbaf7a59b637ac9190b68d838de46dd56ee13c0ec.exe Token: SeRestorePrivilege 1080 5b91f5cb294f987aeeb2f60fbaf7a59b637ac9190b68d838de46dd56ee13c0ec.exe Token: SeShutdownPrivilege 1080 5b91f5cb294f987aeeb2f60fbaf7a59b637ac9190b68d838de46dd56ee13c0ec.exe Token: SeDebugPrivilege 1080 5b91f5cb294f987aeeb2f60fbaf7a59b637ac9190b68d838de46dd56ee13c0ec.exe Token: SeSystemEnvironmentPrivilege 1080 5b91f5cb294f987aeeb2f60fbaf7a59b637ac9190b68d838de46dd56ee13c0ec.exe Token: SeChangeNotifyPrivilege 1080 5b91f5cb294f987aeeb2f60fbaf7a59b637ac9190b68d838de46dd56ee13c0ec.exe Token: SeRemoteShutdownPrivilege 1080 5b91f5cb294f987aeeb2f60fbaf7a59b637ac9190b68d838de46dd56ee13c0ec.exe Token: SeUndockPrivilege 1080 5b91f5cb294f987aeeb2f60fbaf7a59b637ac9190b68d838de46dd56ee13c0ec.exe Token: SeManageVolumePrivilege 1080 5b91f5cb294f987aeeb2f60fbaf7a59b637ac9190b68d838de46dd56ee13c0ec.exe Token: SeImpersonatePrivilege 1080 5b91f5cb294f987aeeb2f60fbaf7a59b637ac9190b68d838de46dd56ee13c0ec.exe Token: SeCreateGlobalPrivilege 1080 5b91f5cb294f987aeeb2f60fbaf7a59b637ac9190b68d838de46dd56ee13c0ec.exe Token: 33 1080 5b91f5cb294f987aeeb2f60fbaf7a59b637ac9190b68d838de46dd56ee13c0ec.exe Token: 34 1080 5b91f5cb294f987aeeb2f60fbaf7a59b637ac9190b68d838de46dd56ee13c0ec.exe Token: 35 1080 5b91f5cb294f987aeeb2f60fbaf7a59b637ac9190b68d838de46dd56ee13c0ec.exe Token: SeIncreaseQuotaPrivilege 1152 wuapp.exe Token: SeSecurityPrivilege 1152 wuapp.exe Token: SeTakeOwnershipPrivilege 1152 wuapp.exe Token: SeLoadDriverPrivilege 1152 wuapp.exe Token: SeSystemProfilePrivilege 1152 wuapp.exe Token: SeSystemtimePrivilege 1152 wuapp.exe Token: SeProfSingleProcessPrivilege 1152 wuapp.exe Token: SeIncBasePriorityPrivilege 1152 wuapp.exe Token: SeCreatePagefilePrivilege 1152 wuapp.exe Token: SeBackupPrivilege 1152 wuapp.exe Token: SeRestorePrivilege 1152 wuapp.exe Token: SeShutdownPrivilege 1152 wuapp.exe Token: SeDebugPrivilege 1152 wuapp.exe Token: SeSystemEnvironmentPrivilege 1152 wuapp.exe Token: SeChangeNotifyPrivilege 1152 wuapp.exe Token: SeRemoteShutdownPrivilege 1152 wuapp.exe Token: SeUndockPrivilege 1152 wuapp.exe Token: SeManageVolumePrivilege 1152 wuapp.exe Token: SeImpersonatePrivilege 1152 wuapp.exe Token: SeCreateGlobalPrivilege 1152 wuapp.exe Token: 33 1152 wuapp.exe Token: 34 1152 wuapp.exe Token: 35 1152 wuapp.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1144 DllHost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1152 wuapp.exe -
Suspicious use of WriteProcessMemory 43 IoCs
description pid Process procid_target PID 1080 wrote to memory of 976 1080 5b91f5cb294f987aeeb2f60fbaf7a59b637ac9190b68d838de46dd56ee13c0ec.exe 28 PID 1080 wrote to memory of 976 1080 5b91f5cb294f987aeeb2f60fbaf7a59b637ac9190b68d838de46dd56ee13c0ec.exe 28 PID 1080 wrote to memory of 976 1080 5b91f5cb294f987aeeb2f60fbaf7a59b637ac9190b68d838de46dd56ee13c0ec.exe 28 PID 1080 wrote to memory of 976 1080 5b91f5cb294f987aeeb2f60fbaf7a59b637ac9190b68d838de46dd56ee13c0ec.exe 28 PID 1080 wrote to memory of 932 1080 5b91f5cb294f987aeeb2f60fbaf7a59b637ac9190b68d838de46dd56ee13c0ec.exe 29 PID 1080 wrote to memory of 932 1080 5b91f5cb294f987aeeb2f60fbaf7a59b637ac9190b68d838de46dd56ee13c0ec.exe 29 PID 1080 wrote to memory of 932 1080 5b91f5cb294f987aeeb2f60fbaf7a59b637ac9190b68d838de46dd56ee13c0ec.exe 29 PID 1080 wrote to memory of 932 1080 5b91f5cb294f987aeeb2f60fbaf7a59b637ac9190b68d838de46dd56ee13c0ec.exe 29 PID 932 wrote to memory of 1460 932 cmd.exe 33 PID 932 wrote to memory of 1460 932 cmd.exe 33 PID 932 wrote to memory of 1460 932 cmd.exe 33 PID 932 wrote to memory of 1460 932 cmd.exe 33 PID 976 wrote to memory of 1464 976 cmd.exe 32 PID 976 wrote to memory of 1464 976 cmd.exe 32 PID 976 wrote to memory of 1464 976 cmd.exe 32 PID 976 wrote to memory of 1464 976 cmd.exe 32 PID 1080 wrote to memory of 1152 1080 5b91f5cb294f987aeeb2f60fbaf7a59b637ac9190b68d838de46dd56ee13c0ec.exe 35 PID 1080 wrote to memory of 1152 1080 5b91f5cb294f987aeeb2f60fbaf7a59b637ac9190b68d838de46dd56ee13c0ec.exe 35 PID 1080 wrote to memory of 1152 1080 5b91f5cb294f987aeeb2f60fbaf7a59b637ac9190b68d838de46dd56ee13c0ec.exe 35 PID 1080 wrote to memory of 1152 1080 5b91f5cb294f987aeeb2f60fbaf7a59b637ac9190b68d838de46dd56ee13c0ec.exe 35 PID 1152 wrote to memory of 1644 1152 wuapp.exe 36 PID 1152 wrote to memory of 1644 1152 wuapp.exe 36 PID 1152 wrote to memory of 1644 1152 wuapp.exe 36 PID 1152 wrote to memory of 1644 1152 wuapp.exe 36 PID 1152 wrote to memory of 1644 1152 wuapp.exe 36 PID 1152 wrote to memory of 1644 1152 wuapp.exe 36 PID 1152 wrote to memory of 1644 1152 wuapp.exe 36 PID 1152 wrote to memory of 1644 1152 wuapp.exe 36 PID 1152 wrote to memory of 1644 1152 wuapp.exe 36 PID 1152 wrote to memory of 1644 1152 wuapp.exe 36 PID 1152 wrote to memory of 1644 1152 wuapp.exe 36 PID 1152 wrote to memory of 1644 1152 wuapp.exe 36 PID 1152 wrote to memory of 1644 1152 wuapp.exe 36 PID 1152 wrote to memory of 1644 1152 wuapp.exe 36 PID 1152 wrote to memory of 1644 1152 wuapp.exe 36 PID 1152 wrote to memory of 1644 1152 wuapp.exe 36 PID 1152 wrote to memory of 1644 1152 wuapp.exe 36 PID 1152 wrote to memory of 1644 1152 wuapp.exe 36 PID 1152 wrote to memory of 1644 1152 wuapp.exe 36 PID 1152 wrote to memory of 1644 1152 wuapp.exe 36 PID 1152 wrote to memory of 1644 1152 wuapp.exe 36 PID 1152 wrote to memory of 1644 1152 wuapp.exe 36 PID 1152 wrote to memory of 1644 1152 wuapp.exe 36 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion wuapp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern wuapp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" wuapp.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 1464 attrib.exe 1460 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b91f5cb294f987aeeb2f60fbaf7a59b637ac9190b68d838de46dd56ee13c0ec.exe"C:\Users\Admin\AppData\Local\Temp\5b91f5cb294f987aeeb2f60fbaf7a59b637ac9190b68d838de46dd56ee13c0ec.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\5b91f5cb294f987aeeb2f60fbaf7a59b637ac9190b68d838de46dd56ee13c0ec.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\5b91f5cb294f987aeeb2f60fbaf7a59b637ac9190b68d838de46dd56ee13c0ec.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1464
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1460
-
-
-
C:\Windows\SysWOW64\Gr6dTPRj3EsY\wuapp.exe"C:\Windows\system32\Gr6dTPRj3EsY\wuapp.exe"2⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1152 -
C:\Windows\SysWOW64\notepad.exenotepad3⤵PID:1644
-
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
PID:1144
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
113KB
MD5f5f03b370c669d5a70a059be0cf0d258
SHA1b4c8a8f90fe2a580f87ba3196090b2a85445dda0
SHA256b60eb8e1c771a685bba857e8022e0ab6d2796ad0bd8379ffbd2fa4190e21aa44
SHA512018853b47dfb1805baf4e0efe0f293e626e4e2695e5776b62836157c293ba133814c50f387d748dfa1b2aaf8acb3abb9c9adc0efee37d8cf529c4a0a4ae63a52
-
Filesize
854KB
MD54c8396f8db1a485dc0b93651d8f7dbd0
SHA1ed5b2b872399519287c2a33f54ecd31337116711
SHA2565b91f5cb294f987aeeb2f60fbaf7a59b637ac9190b68d838de46dd56ee13c0ec
SHA5123d690b7664d6bb5d9c0c5fe17a02cd7450d717065e11a67cf4e13ffc5e3a0fe2a9836db48dfe8562eb83731c002f5fdc7882c9f1d73484da04496db9ce4f7f99
-
Filesize
854KB
MD54c8396f8db1a485dc0b93651d8f7dbd0
SHA1ed5b2b872399519287c2a33f54ecd31337116711
SHA2565b91f5cb294f987aeeb2f60fbaf7a59b637ac9190b68d838de46dd56ee13c0ec
SHA5123d690b7664d6bb5d9c0c5fe17a02cd7450d717065e11a67cf4e13ffc5e3a0fe2a9836db48dfe8562eb83731c002f5fdc7882c9f1d73484da04496db9ce4f7f99
-
Filesize
854KB
MD54c8396f8db1a485dc0b93651d8f7dbd0
SHA1ed5b2b872399519287c2a33f54ecd31337116711
SHA2565b91f5cb294f987aeeb2f60fbaf7a59b637ac9190b68d838de46dd56ee13c0ec
SHA5123d690b7664d6bb5d9c0c5fe17a02cd7450d717065e11a67cf4e13ffc5e3a0fe2a9836db48dfe8562eb83731c002f5fdc7882c9f1d73484da04496db9ce4f7f99
-
Filesize
854KB
MD54c8396f8db1a485dc0b93651d8f7dbd0
SHA1ed5b2b872399519287c2a33f54ecd31337116711
SHA2565b91f5cb294f987aeeb2f60fbaf7a59b637ac9190b68d838de46dd56ee13c0ec
SHA5123d690b7664d6bb5d9c0c5fe17a02cd7450d717065e11a67cf4e13ffc5e3a0fe2a9836db48dfe8562eb83731c002f5fdc7882c9f1d73484da04496db9ce4f7f99
