Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
19-11-2022 09:27
Behavioral task
behavioral1
Sample
7a39658c3e764db49a93f8246dc600cdd6dfe5472b376ea1f0f50f378c4d5cba.exe
Resource
win7-20220812-en
General
-
Target
7a39658c3e764db49a93f8246dc600cdd6dfe5472b376ea1f0f50f378c4d5cba.exe
-
Size
756KB
-
MD5
530c49bd38b31f7858a2ae6735defa70
-
SHA1
56c222a587fc3c14fc64bd249da8499b9172954a
-
SHA256
7a39658c3e764db49a93f8246dc600cdd6dfe5472b376ea1f0f50f378c4d5cba
-
SHA512
6d8558e9afad76308823d8d1fd6a81beb35ef4d3b717dee5d1a4f3e629f7cafdc6eafcc3bc9a385d8e4ed5098cb4f52a664a2301f03589573f4007787ae33f2b
-
SSDEEP
12288:K9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/h0:GZ1xuVVjfFoynPaVBUR8f+kN10EBW
Malware Config
Extracted
darkcomet
Hacker
leave1.no-ip.biz:1604
leave1.no-ip.biz:25565
DC_MUTEX-SF1AS3Y
-
InstallPath
Adobe.exe
-
gencode
v3wr0fYZFSSx
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
explorer
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
7a39658c3e764db49a93f8246dc600cdd6dfe5472b376ea1f0f50f378c4d5cba.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\Adobe.exe" 7a39658c3e764db49a93f8246dc600cdd6dfe5472b376ea1f0f50f378c4d5cba.exe -
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
Adobe.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile Adobe.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" Adobe.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" Adobe.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
Adobe.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Adobe.exe -
Executes dropped EXE 1 IoCs
Processes:
Adobe.exepid process 872 Adobe.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 1360 attrib.exe 1416 attrib.exe -
Loads dropped DLL 2 IoCs
Processes:
7a39658c3e764db49a93f8246dc600cdd6dfe5472b376ea1f0f50f378c4d5cba.exepid process 1460 7a39658c3e764db49a93f8246dc600cdd6dfe5472b376ea1f0f50f378c4d5cba.exe 1460 7a39658c3e764db49a93f8246dc600cdd6dfe5472b376ea1f0f50f378c4d5cba.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
7a39658c3e764db49a93f8246dc600cdd6dfe5472b376ea1f0f50f378c4d5cba.exeAdobe.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Adobe.exe" 7a39658c3e764db49a93f8246dc600cdd6dfe5472b376ea1f0f50f378c4d5cba.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Adobe.exe" Adobe.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Adobe.exepid process 872 Adobe.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
7a39658c3e764db49a93f8246dc600cdd6dfe5472b376ea1f0f50f378c4d5cba.exeAdobe.exedescription pid process Token: SeIncreaseQuotaPrivilege 1460 7a39658c3e764db49a93f8246dc600cdd6dfe5472b376ea1f0f50f378c4d5cba.exe Token: SeSecurityPrivilege 1460 7a39658c3e764db49a93f8246dc600cdd6dfe5472b376ea1f0f50f378c4d5cba.exe Token: SeTakeOwnershipPrivilege 1460 7a39658c3e764db49a93f8246dc600cdd6dfe5472b376ea1f0f50f378c4d5cba.exe Token: SeLoadDriverPrivilege 1460 7a39658c3e764db49a93f8246dc600cdd6dfe5472b376ea1f0f50f378c4d5cba.exe Token: SeSystemProfilePrivilege 1460 7a39658c3e764db49a93f8246dc600cdd6dfe5472b376ea1f0f50f378c4d5cba.exe Token: SeSystemtimePrivilege 1460 7a39658c3e764db49a93f8246dc600cdd6dfe5472b376ea1f0f50f378c4d5cba.exe Token: SeProfSingleProcessPrivilege 1460 7a39658c3e764db49a93f8246dc600cdd6dfe5472b376ea1f0f50f378c4d5cba.exe Token: SeIncBasePriorityPrivilege 1460 7a39658c3e764db49a93f8246dc600cdd6dfe5472b376ea1f0f50f378c4d5cba.exe Token: SeCreatePagefilePrivilege 1460 7a39658c3e764db49a93f8246dc600cdd6dfe5472b376ea1f0f50f378c4d5cba.exe Token: SeBackupPrivilege 1460 7a39658c3e764db49a93f8246dc600cdd6dfe5472b376ea1f0f50f378c4d5cba.exe Token: SeRestorePrivilege 1460 7a39658c3e764db49a93f8246dc600cdd6dfe5472b376ea1f0f50f378c4d5cba.exe Token: SeShutdownPrivilege 1460 7a39658c3e764db49a93f8246dc600cdd6dfe5472b376ea1f0f50f378c4d5cba.exe Token: SeDebugPrivilege 1460 7a39658c3e764db49a93f8246dc600cdd6dfe5472b376ea1f0f50f378c4d5cba.exe Token: SeSystemEnvironmentPrivilege 1460 7a39658c3e764db49a93f8246dc600cdd6dfe5472b376ea1f0f50f378c4d5cba.exe Token: SeChangeNotifyPrivilege 1460 7a39658c3e764db49a93f8246dc600cdd6dfe5472b376ea1f0f50f378c4d5cba.exe Token: SeRemoteShutdownPrivilege 1460 7a39658c3e764db49a93f8246dc600cdd6dfe5472b376ea1f0f50f378c4d5cba.exe Token: SeUndockPrivilege 1460 7a39658c3e764db49a93f8246dc600cdd6dfe5472b376ea1f0f50f378c4d5cba.exe Token: SeManageVolumePrivilege 1460 7a39658c3e764db49a93f8246dc600cdd6dfe5472b376ea1f0f50f378c4d5cba.exe Token: SeImpersonatePrivilege 1460 7a39658c3e764db49a93f8246dc600cdd6dfe5472b376ea1f0f50f378c4d5cba.exe Token: SeCreateGlobalPrivilege 1460 7a39658c3e764db49a93f8246dc600cdd6dfe5472b376ea1f0f50f378c4d5cba.exe Token: 33 1460 7a39658c3e764db49a93f8246dc600cdd6dfe5472b376ea1f0f50f378c4d5cba.exe Token: 34 1460 7a39658c3e764db49a93f8246dc600cdd6dfe5472b376ea1f0f50f378c4d5cba.exe Token: 35 1460 7a39658c3e764db49a93f8246dc600cdd6dfe5472b376ea1f0f50f378c4d5cba.exe Token: SeIncreaseQuotaPrivilege 872 Adobe.exe Token: SeSecurityPrivilege 872 Adobe.exe Token: SeTakeOwnershipPrivilege 872 Adobe.exe Token: SeLoadDriverPrivilege 872 Adobe.exe Token: SeSystemProfilePrivilege 872 Adobe.exe Token: SeSystemtimePrivilege 872 Adobe.exe Token: SeProfSingleProcessPrivilege 872 Adobe.exe Token: SeIncBasePriorityPrivilege 872 Adobe.exe Token: SeCreatePagefilePrivilege 872 Adobe.exe Token: SeBackupPrivilege 872 Adobe.exe Token: SeRestorePrivilege 872 Adobe.exe Token: SeShutdownPrivilege 872 Adobe.exe Token: SeDebugPrivilege 872 Adobe.exe Token: SeSystemEnvironmentPrivilege 872 Adobe.exe Token: SeChangeNotifyPrivilege 872 Adobe.exe Token: SeRemoteShutdownPrivilege 872 Adobe.exe Token: SeUndockPrivilege 872 Adobe.exe Token: SeManageVolumePrivilege 872 Adobe.exe Token: SeImpersonatePrivilege 872 Adobe.exe Token: SeCreateGlobalPrivilege 872 Adobe.exe Token: 33 872 Adobe.exe Token: 34 872 Adobe.exe Token: 35 872 Adobe.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Adobe.exepid process 872 Adobe.exe -
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
7a39658c3e764db49a93f8246dc600cdd6dfe5472b376ea1f0f50f378c4d5cba.execmd.execmd.exeAdobe.exedescription pid process target process PID 1460 wrote to memory of 1312 1460 7a39658c3e764db49a93f8246dc600cdd6dfe5472b376ea1f0f50f378c4d5cba.exe cmd.exe PID 1460 wrote to memory of 1312 1460 7a39658c3e764db49a93f8246dc600cdd6dfe5472b376ea1f0f50f378c4d5cba.exe cmd.exe PID 1460 wrote to memory of 1312 1460 7a39658c3e764db49a93f8246dc600cdd6dfe5472b376ea1f0f50f378c4d5cba.exe cmd.exe PID 1460 wrote to memory of 1312 1460 7a39658c3e764db49a93f8246dc600cdd6dfe5472b376ea1f0f50f378c4d5cba.exe cmd.exe PID 1460 wrote to memory of 1780 1460 7a39658c3e764db49a93f8246dc600cdd6dfe5472b376ea1f0f50f378c4d5cba.exe cmd.exe PID 1460 wrote to memory of 1780 1460 7a39658c3e764db49a93f8246dc600cdd6dfe5472b376ea1f0f50f378c4d5cba.exe cmd.exe PID 1460 wrote to memory of 1780 1460 7a39658c3e764db49a93f8246dc600cdd6dfe5472b376ea1f0f50f378c4d5cba.exe cmd.exe PID 1460 wrote to memory of 1780 1460 7a39658c3e764db49a93f8246dc600cdd6dfe5472b376ea1f0f50f378c4d5cba.exe cmd.exe PID 1312 wrote to memory of 1360 1312 cmd.exe attrib.exe PID 1312 wrote to memory of 1360 1312 cmd.exe attrib.exe PID 1312 wrote to memory of 1360 1312 cmd.exe attrib.exe PID 1312 wrote to memory of 1360 1312 cmd.exe attrib.exe PID 1780 wrote to memory of 1416 1780 cmd.exe attrib.exe PID 1780 wrote to memory of 1416 1780 cmd.exe attrib.exe PID 1780 wrote to memory of 1416 1780 cmd.exe attrib.exe PID 1780 wrote to memory of 1416 1780 cmd.exe attrib.exe PID 1460 wrote to memory of 872 1460 7a39658c3e764db49a93f8246dc600cdd6dfe5472b376ea1f0f50f378c4d5cba.exe Adobe.exe PID 1460 wrote to memory of 872 1460 7a39658c3e764db49a93f8246dc600cdd6dfe5472b376ea1f0f50f378c4d5cba.exe Adobe.exe PID 1460 wrote to memory of 872 1460 7a39658c3e764db49a93f8246dc600cdd6dfe5472b376ea1f0f50f378c4d5cba.exe Adobe.exe PID 1460 wrote to memory of 872 1460 7a39658c3e764db49a93f8246dc600cdd6dfe5472b376ea1f0f50f378c4d5cba.exe Adobe.exe PID 872 wrote to memory of 320 872 Adobe.exe notepad.exe PID 872 wrote to memory of 320 872 Adobe.exe notepad.exe PID 872 wrote to memory of 320 872 Adobe.exe notepad.exe PID 872 wrote to memory of 320 872 Adobe.exe notepad.exe PID 872 wrote to memory of 320 872 Adobe.exe notepad.exe PID 872 wrote to memory of 320 872 Adobe.exe notepad.exe PID 872 wrote to memory of 320 872 Adobe.exe notepad.exe PID 872 wrote to memory of 320 872 Adobe.exe notepad.exe PID 872 wrote to memory of 320 872 Adobe.exe notepad.exe PID 872 wrote to memory of 320 872 Adobe.exe notepad.exe PID 872 wrote to memory of 320 872 Adobe.exe notepad.exe PID 872 wrote to memory of 320 872 Adobe.exe notepad.exe PID 872 wrote to memory of 320 872 Adobe.exe notepad.exe PID 872 wrote to memory of 320 872 Adobe.exe notepad.exe PID 872 wrote to memory of 320 872 Adobe.exe notepad.exe PID 872 wrote to memory of 320 872 Adobe.exe notepad.exe PID 872 wrote to memory of 320 872 Adobe.exe notepad.exe PID 872 wrote to memory of 320 872 Adobe.exe notepad.exe PID 872 wrote to memory of 320 872 Adobe.exe notepad.exe PID 872 wrote to memory of 320 872 Adobe.exe notepad.exe PID 872 wrote to memory of 320 872 Adobe.exe notepad.exe PID 872 wrote to memory of 320 872 Adobe.exe notepad.exe PID 872 wrote to memory of 320 872 Adobe.exe notepad.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
Adobe.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion Adobe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern Adobe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" Adobe.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 1360 attrib.exe 1416 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a39658c3e764db49a93f8246dc600cdd6dfe5472b376ea1f0f50f378c4d5cba.exe"C:\Users\Admin\AppData\Local\Temp\7a39658c3e764db49a93f8246dc600cdd6dfe5472b376ea1f0f50f378c4d5cba.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\7a39658c3e764db49a93f8246dc600cdd6dfe5472b376ea1f0f50f378c4d5cba.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\7a39658c3e764db49a93f8246dc600cdd6dfe5472b376ea1f0f50f378c4d5cba.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Local\Temp\Adobe.exe"C:\Users\Admin\AppData\Local\Temp\Adobe.exe"2⤵
- Modifies firewall policy service
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Adobe.exeFilesize
756KB
MD5530c49bd38b31f7858a2ae6735defa70
SHA156c222a587fc3c14fc64bd249da8499b9172954a
SHA2567a39658c3e764db49a93f8246dc600cdd6dfe5472b376ea1f0f50f378c4d5cba
SHA5126d8558e9afad76308823d8d1fd6a81beb35ef4d3b717dee5d1a4f3e629f7cafdc6eafcc3bc9a385d8e4ed5098cb4f52a664a2301f03589573f4007787ae33f2b
-
C:\Users\Admin\AppData\Local\Temp\Adobe.exeFilesize
756KB
MD5530c49bd38b31f7858a2ae6735defa70
SHA156c222a587fc3c14fc64bd249da8499b9172954a
SHA2567a39658c3e764db49a93f8246dc600cdd6dfe5472b376ea1f0f50f378c4d5cba
SHA5126d8558e9afad76308823d8d1fd6a81beb35ef4d3b717dee5d1a4f3e629f7cafdc6eafcc3bc9a385d8e4ed5098cb4f52a664a2301f03589573f4007787ae33f2b
-
\Users\Admin\AppData\Local\Temp\Adobe.exeFilesize
756KB
MD5530c49bd38b31f7858a2ae6735defa70
SHA156c222a587fc3c14fc64bd249da8499b9172954a
SHA2567a39658c3e764db49a93f8246dc600cdd6dfe5472b376ea1f0f50f378c4d5cba
SHA5126d8558e9afad76308823d8d1fd6a81beb35ef4d3b717dee5d1a4f3e629f7cafdc6eafcc3bc9a385d8e4ed5098cb4f52a664a2301f03589573f4007787ae33f2b
-
\Users\Admin\AppData\Local\Temp\Adobe.exeFilesize
756KB
MD5530c49bd38b31f7858a2ae6735defa70
SHA156c222a587fc3c14fc64bd249da8499b9172954a
SHA2567a39658c3e764db49a93f8246dc600cdd6dfe5472b376ea1f0f50f378c4d5cba
SHA5126d8558e9afad76308823d8d1fd6a81beb35ef4d3b717dee5d1a4f3e629f7cafdc6eafcc3bc9a385d8e4ed5098cb4f52a664a2301f03589573f4007787ae33f2b
-
memory/320-65-0x0000000000000000-mapping.dmp
-
memory/872-61-0x0000000000000000-mapping.dmp
-
memory/1312-55-0x0000000000000000-mapping.dmp
-
memory/1360-57-0x0000000000000000-mapping.dmp
-
memory/1416-58-0x0000000000000000-mapping.dmp
-
memory/1460-54-0x0000000075831000-0x0000000075833000-memory.dmpFilesize
8KB
-
memory/1780-56-0x0000000000000000-mapping.dmp