Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
21-10-2022 19:50
Behavioral task
behavioral1
Sample
834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe
Resource
win7-20220812-en
General
-
Target
834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe
-
Size
784KB
-
MD5
1e769d83c8b2f427d92fb7c22795b600
-
SHA1
69c5993f9bac73d99ad5d0034847d05bd7fe03db
-
SHA256
834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f
-
SHA512
4207f0b7947e52bd300664f407f301ba7d54c66333c5452cda471e130f72279ac5abdd352856641566b9c7895c7c507b52024a644ccfc57cc049878ab24690f9
-
SSDEEP
12288:q9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/h3FDBEZOzl:mZ1xuVVjfFoynPaVBUR8f+kN10EB1zl
Malware Config
Extracted
darkcomet
1111
volam2.no-ip.org:1111
DC_MUTEX-GURH78B
-
InstallPath
explorer.exe
-
gencode
trPYVnD2QJGW
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\explorer.exe" 834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe -
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" explorer.exe -
Modifies security service 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" explorer.exe -
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" explorer.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" explorer.exe -
Executes dropped EXE 1 IoCs
Processes:
explorer.exepid process 1900 explorer.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 224 attrib.exe 216 attrib.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe -
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exeexplorer.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\explorer.exe" 834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\explorer.exe" explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 1900 explorer.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exeexplorer.exedescription pid process Token: SeIncreaseQuotaPrivilege 3720 834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe Token: SeSecurityPrivilege 3720 834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe Token: SeTakeOwnershipPrivilege 3720 834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe Token: SeLoadDriverPrivilege 3720 834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe Token: SeSystemProfilePrivilege 3720 834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe Token: SeSystemtimePrivilege 3720 834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe Token: SeProfSingleProcessPrivilege 3720 834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe Token: SeIncBasePriorityPrivilege 3720 834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe Token: SeCreatePagefilePrivilege 3720 834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe Token: SeBackupPrivilege 3720 834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe Token: SeRestorePrivilege 3720 834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe Token: SeShutdownPrivilege 3720 834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe Token: SeDebugPrivilege 3720 834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe Token: SeSystemEnvironmentPrivilege 3720 834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe Token: SeChangeNotifyPrivilege 3720 834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe Token: SeRemoteShutdownPrivilege 3720 834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe Token: SeUndockPrivilege 3720 834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe Token: SeManageVolumePrivilege 3720 834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe Token: SeImpersonatePrivilege 3720 834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe Token: SeCreateGlobalPrivilege 3720 834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe Token: 33 3720 834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe Token: 34 3720 834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe Token: 35 3720 834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe Token: 36 3720 834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe Token: SeIncreaseQuotaPrivilege 1900 explorer.exe Token: SeSecurityPrivilege 1900 explorer.exe Token: SeTakeOwnershipPrivilege 1900 explorer.exe Token: SeLoadDriverPrivilege 1900 explorer.exe Token: SeSystemProfilePrivilege 1900 explorer.exe Token: SeSystemtimePrivilege 1900 explorer.exe Token: SeProfSingleProcessPrivilege 1900 explorer.exe Token: SeIncBasePriorityPrivilege 1900 explorer.exe Token: SeCreatePagefilePrivilege 1900 explorer.exe Token: SeBackupPrivilege 1900 explorer.exe Token: SeRestorePrivilege 1900 explorer.exe Token: SeShutdownPrivilege 1900 explorer.exe Token: SeDebugPrivilege 1900 explorer.exe Token: SeSystemEnvironmentPrivilege 1900 explorer.exe Token: SeChangeNotifyPrivilege 1900 explorer.exe Token: SeRemoteShutdownPrivilege 1900 explorer.exe Token: SeUndockPrivilege 1900 explorer.exe Token: SeManageVolumePrivilege 1900 explorer.exe Token: SeImpersonatePrivilege 1900 explorer.exe Token: SeCreateGlobalPrivilege 1900 explorer.exe Token: 33 1900 explorer.exe Token: 34 1900 explorer.exe Token: 35 1900 explorer.exe Token: 36 1900 explorer.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
explorer.exepid process 1900 explorer.exe -
Suspicious use of WriteProcessMemory 54 IoCs
Processes:
834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.execmd.execmd.exeexplorer.exedescription pid process target process PID 3720 wrote to memory of 1636 3720 834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe cmd.exe PID 3720 wrote to memory of 1636 3720 834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe cmd.exe PID 3720 wrote to memory of 1636 3720 834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe cmd.exe PID 3720 wrote to memory of 632 3720 834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe cmd.exe PID 3720 wrote to memory of 632 3720 834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe cmd.exe PID 3720 wrote to memory of 632 3720 834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe cmd.exe PID 3720 wrote to memory of 4184 3720 834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe notepad.exe PID 3720 wrote to memory of 4184 3720 834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe notepad.exe PID 3720 wrote to memory of 4184 3720 834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe notepad.exe PID 3720 wrote to memory of 4184 3720 834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe notepad.exe PID 3720 wrote to memory of 4184 3720 834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe notepad.exe PID 3720 wrote to memory of 4184 3720 834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe notepad.exe PID 3720 wrote to memory of 4184 3720 834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe notepad.exe PID 3720 wrote to memory of 4184 3720 834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe notepad.exe PID 3720 wrote to memory of 4184 3720 834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe notepad.exe PID 3720 wrote to memory of 4184 3720 834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe notepad.exe PID 3720 wrote to memory of 4184 3720 834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe notepad.exe PID 3720 wrote to memory of 4184 3720 834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe notepad.exe PID 3720 wrote to memory of 4184 3720 834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe notepad.exe PID 3720 wrote to memory of 4184 3720 834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe notepad.exe PID 3720 wrote to memory of 4184 3720 834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe notepad.exe PID 3720 wrote to memory of 4184 3720 834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe notepad.exe PID 3720 wrote to memory of 4184 3720 834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe notepad.exe PID 632 wrote to memory of 216 632 cmd.exe attrib.exe PID 632 wrote to memory of 216 632 cmd.exe attrib.exe PID 632 wrote to memory of 216 632 cmd.exe attrib.exe PID 1636 wrote to memory of 224 1636 cmd.exe attrib.exe PID 1636 wrote to memory of 224 1636 cmd.exe attrib.exe PID 1636 wrote to memory of 224 1636 cmd.exe attrib.exe PID 3720 wrote to memory of 1900 3720 834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe explorer.exe PID 3720 wrote to memory of 1900 3720 834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe explorer.exe PID 3720 wrote to memory of 1900 3720 834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe explorer.exe PID 1900 wrote to memory of 2012 1900 explorer.exe notepad.exe PID 1900 wrote to memory of 2012 1900 explorer.exe notepad.exe PID 1900 wrote to memory of 2012 1900 explorer.exe notepad.exe PID 1900 wrote to memory of 2012 1900 explorer.exe notepad.exe PID 1900 wrote to memory of 2012 1900 explorer.exe notepad.exe PID 1900 wrote to memory of 2012 1900 explorer.exe notepad.exe PID 1900 wrote to memory of 2012 1900 explorer.exe notepad.exe PID 1900 wrote to memory of 2012 1900 explorer.exe notepad.exe PID 1900 wrote to memory of 2012 1900 explorer.exe notepad.exe PID 1900 wrote to memory of 2012 1900 explorer.exe notepad.exe PID 1900 wrote to memory of 2012 1900 explorer.exe notepad.exe PID 1900 wrote to memory of 2012 1900 explorer.exe notepad.exe PID 1900 wrote to memory of 2012 1900 explorer.exe notepad.exe PID 1900 wrote to memory of 2012 1900 explorer.exe notepad.exe PID 1900 wrote to memory of 2012 1900 explorer.exe notepad.exe PID 1900 wrote to memory of 2012 1900 explorer.exe notepad.exe PID 1900 wrote to memory of 2012 1900 explorer.exe notepad.exe PID 1900 wrote to memory of 2012 1900 explorer.exe notepad.exe PID 1900 wrote to memory of 2012 1900 explorer.exe notepad.exe PID 1900 wrote to memory of 2012 1900 explorer.exe notepad.exe PID 1900 wrote to memory of 2012 1900 explorer.exe notepad.exe PID 1900 wrote to memory of 2012 1900 explorer.exe notepad.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" explorer.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 224 attrib.exe 216 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe"C:\Users\Admin\AppData\Local\Temp\834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
-
C:\ProgramData\Microsoft\Windows\Start Menu\explorer.exe"C:\ProgramData\Microsoft\Windows\Start Menu\explorer.exe"2⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\explorer.exeFilesize
784KB
MD51e769d83c8b2f427d92fb7c22795b600
SHA169c5993f9bac73d99ad5d0034847d05bd7fe03db
SHA256834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f
SHA5124207f0b7947e52bd300664f407f301ba7d54c66333c5452cda471e130f72279ac5abdd352856641566b9c7895c7c507b52024a644ccfc57cc049878ab24690f9
-
C:\ProgramData\Microsoft\Windows\Start Menu\explorer.exeFilesize
784KB
MD51e769d83c8b2f427d92fb7c22795b600
SHA169c5993f9bac73d99ad5d0034847d05bd7fe03db
SHA256834300555398c6d73c9beda0d6235d9bdc7a973a2162074e87f3c77884efef6f
SHA5124207f0b7947e52bd300664f407f301ba7d54c66333c5452cda471e130f72279ac5abdd352856641566b9c7895c7c507b52024a644ccfc57cc049878ab24690f9
-
memory/216-135-0x0000000000000000-mapping.dmp
-
memory/224-136-0x0000000000000000-mapping.dmp
-
memory/632-133-0x0000000000000000-mapping.dmp
-
memory/1636-132-0x0000000000000000-mapping.dmp
-
memory/1900-137-0x0000000000000000-mapping.dmp
-
memory/2012-140-0x0000000000000000-mapping.dmp
-
memory/4184-134-0x0000000000000000-mapping.dmp