Analysis
-
max time kernel
188s -
max time network
194s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 22:57
Behavioral task
behavioral1
Sample
22aa1e3289e416f53ab651dc468236516d3f005d3066a04f8c47fa9cd2511736.exe
Resource
win7-20220901-en
windows7-x64
15 signatures
150 seconds
General
-
Target
22aa1e3289e416f53ab651dc468236516d3f005d3066a04f8c47fa9cd2511736.exe
-
Size
963KB
-
MD5
0273045ad74e3b76dd75699fec3c80ac
-
SHA1
0b9b216306d63058604a2559b3b85a406691b3b0
-
SHA256
22aa1e3289e416f53ab651dc468236516d3f005d3066a04f8c47fa9cd2511736
-
SHA512
82fe2bbd9c32ff25fd9549ff0b12396097863e12e426198ad62f06bb5d3255cd5b9a441f41ba134bad61bf3a6d51cafd5b263149a7afc001b4e76bb07165fe93
-
SSDEEP
24576:e1Z1xuVVjfFoynPaVBUR8f+kN10EBvSwveU/tVjnFlthy:ePQDgok30C5/thFlthy
Malware Config
Extracted
Family
darkcomet
Botnet
Guest16
C2
68.230.210.107:1604
Mutex
DC_MUTEX-SX36NMQ
Attributes
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
6M4bKZJe7VmY
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" GWUAP.EXE -
Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" msdcsc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" msdcsc.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" msdcsc.exe -
Executes dropped EXE 2 IoCs
pid Process 4344 GWUAP.EXE 1656 msdcsc.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 3456 attrib.exe 4664 attrib.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 22aa1e3289e416f53ab651dc468236516d3f005d3066a04f8c47fa9cd2511736.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation GWUAP.EXE -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" GWUAP.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\MSDCSC\msdcsc.exe GWUAP.EXE File opened for modification C:\Windows\SysWOW64\MSDCSC\msdcsc.exe GWUAP.EXE File opened for modification C:\Windows\SysWOW64\MSDCSC\ GWUAP.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ GWUAP.EXE -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4344 GWUAP.EXE Token: SeSecurityPrivilege 4344 GWUAP.EXE Token: SeTakeOwnershipPrivilege 4344 GWUAP.EXE Token: SeLoadDriverPrivilege 4344 GWUAP.EXE Token: SeSystemProfilePrivilege 4344 GWUAP.EXE Token: SeSystemtimePrivilege 4344 GWUAP.EXE Token: SeProfSingleProcessPrivilege 4344 GWUAP.EXE Token: SeIncBasePriorityPrivilege 4344 GWUAP.EXE Token: SeCreatePagefilePrivilege 4344 GWUAP.EXE Token: SeBackupPrivilege 4344 GWUAP.EXE Token: SeRestorePrivilege 4344 GWUAP.EXE Token: SeShutdownPrivilege 4344 GWUAP.EXE Token: SeDebugPrivilege 4344 GWUAP.EXE Token: SeSystemEnvironmentPrivilege 4344 GWUAP.EXE Token: SeChangeNotifyPrivilege 4344 GWUAP.EXE Token: SeRemoteShutdownPrivilege 4344 GWUAP.EXE Token: SeUndockPrivilege 4344 GWUAP.EXE Token: SeManageVolumePrivilege 4344 GWUAP.EXE Token: SeImpersonatePrivilege 4344 GWUAP.EXE Token: SeCreateGlobalPrivilege 4344 GWUAP.EXE Token: 33 4344 GWUAP.EXE Token: 34 4344 GWUAP.EXE Token: 35 4344 GWUAP.EXE Token: 36 4344 GWUAP.EXE Token: SeIncreaseQuotaPrivilege 1656 msdcsc.exe Token: SeSecurityPrivilege 1656 msdcsc.exe Token: SeTakeOwnershipPrivilege 1656 msdcsc.exe Token: SeLoadDriverPrivilege 1656 msdcsc.exe Token: SeSystemProfilePrivilege 1656 msdcsc.exe Token: SeSystemtimePrivilege 1656 msdcsc.exe Token: SeProfSingleProcessPrivilege 1656 msdcsc.exe Token: SeIncBasePriorityPrivilege 1656 msdcsc.exe Token: SeCreatePagefilePrivilege 1656 msdcsc.exe Token: SeBackupPrivilege 1656 msdcsc.exe Token: SeRestorePrivilege 1656 msdcsc.exe Token: SeShutdownPrivilege 1656 msdcsc.exe Token: SeDebugPrivilege 1656 msdcsc.exe Token: SeSystemEnvironmentPrivilege 1656 msdcsc.exe Token: SeChangeNotifyPrivilege 1656 msdcsc.exe Token: SeRemoteShutdownPrivilege 1656 msdcsc.exe Token: SeUndockPrivilege 1656 msdcsc.exe Token: SeManageVolumePrivilege 1656 msdcsc.exe Token: SeImpersonatePrivilege 1656 msdcsc.exe Token: SeCreateGlobalPrivilege 1656 msdcsc.exe Token: 33 1656 msdcsc.exe Token: 34 1656 msdcsc.exe Token: 35 1656 msdcsc.exe Token: 36 1656 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1656 msdcsc.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 4060 wrote to memory of 4344 4060 22aa1e3289e416f53ab651dc468236516d3f005d3066a04f8c47fa9cd2511736.exe 82 PID 4060 wrote to memory of 4344 4060 22aa1e3289e416f53ab651dc468236516d3f005d3066a04f8c47fa9cd2511736.exe 82 PID 4060 wrote to memory of 4344 4060 22aa1e3289e416f53ab651dc468236516d3f005d3066a04f8c47fa9cd2511736.exe 82 PID 4344 wrote to memory of 5036 4344 GWUAP.EXE 83 PID 4344 wrote to memory of 5036 4344 GWUAP.EXE 83 PID 4344 wrote to memory of 5036 4344 GWUAP.EXE 83 PID 4344 wrote to memory of 3528 4344 GWUAP.EXE 85 PID 4344 wrote to memory of 3528 4344 GWUAP.EXE 85 PID 4344 wrote to memory of 3528 4344 GWUAP.EXE 85 PID 3528 wrote to memory of 3456 3528 cmd.exe 87 PID 3528 wrote to memory of 3456 3528 cmd.exe 87 PID 3528 wrote to memory of 3456 3528 cmd.exe 87 PID 5036 wrote to memory of 4664 5036 cmd.exe 88 PID 5036 wrote to memory of 4664 5036 cmd.exe 88 PID 5036 wrote to memory of 4664 5036 cmd.exe 88 PID 4344 wrote to memory of 1656 4344 GWUAP.EXE 89 PID 4344 wrote to memory of 1656 4344 GWUAP.EXE 89 PID 4344 wrote to memory of 1656 4344 GWUAP.EXE 89 PID 1656 wrote to memory of 1744 1656 msdcsc.exe 90 PID 1656 wrote to memory of 1744 1656 msdcsc.exe 90 PID 1656 wrote to memory of 1744 1656 msdcsc.exe 90 PID 1656 wrote to memory of 1744 1656 msdcsc.exe 90 PID 1656 wrote to memory of 1744 1656 msdcsc.exe 90 PID 1656 wrote to memory of 1744 1656 msdcsc.exe 90 PID 1656 wrote to memory of 1744 1656 msdcsc.exe 90 PID 1656 wrote to memory of 1744 1656 msdcsc.exe 90 PID 1656 wrote to memory of 1744 1656 msdcsc.exe 90 PID 1656 wrote to memory of 1744 1656 msdcsc.exe 90 PID 1656 wrote to memory of 1744 1656 msdcsc.exe 90 PID 1656 wrote to memory of 1744 1656 msdcsc.exe 90 PID 1656 wrote to memory of 1744 1656 msdcsc.exe 90 PID 1656 wrote to memory of 1744 1656 msdcsc.exe 90 PID 1656 wrote to memory of 1744 1656 msdcsc.exe 90 PID 1656 wrote to memory of 1744 1656 msdcsc.exe 90 PID 1656 wrote to memory of 1744 1656 msdcsc.exe 90 PID 1656 wrote to memory of 1744 1656 msdcsc.exe 90 PID 1656 wrote to memory of 1744 1656 msdcsc.exe 90 PID 1656 wrote to memory of 1744 1656 msdcsc.exe 90 PID 1656 wrote to memory of 1744 1656 msdcsc.exe 90 PID 1656 wrote to memory of 1744 1656 msdcsc.exe 90 -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 3456 attrib.exe 4664 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\22aa1e3289e416f53ab651dc468236516d3f005d3066a04f8c47fa9cd2511736.exe"C:\Users\Admin\AppData\Local\Temp\22aa1e3289e416f53ab651dc468236516d3f005d3066a04f8c47fa9cd2511736.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\GWUAP.EXE"C:\Users\Admin\AppData\Local\Temp\GWUAP.EXE"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\GWUAP.EXE" +s +h3⤵
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\GWUAP.EXE" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:4664
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
PID:3456
-
-
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"3⤵
- Modifies firewall policy service
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\SysWOW64\notepad.exenotepad4⤵PID:1744
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
658KB
MD5d7f382a357becb92fad459356bf125e3
SHA15d18bda457b297145d8156898f5be95ab38c0a4a
SHA25667b3abb3e5e6cfecad60a25a90b31cb697b89406413d6a442675aeb69ee80e73
SHA51246b05a0b5eabfdbcdd38eb5a2f3a11fe402467f71ce3027c5797e871e2d70618101bcb9a5bf9ef3ed46a2bd1d042a64c9dd555bd2360fdb6fbcdaff0683bfff8
-
Filesize
658KB
MD5d7f382a357becb92fad459356bf125e3
SHA15d18bda457b297145d8156898f5be95ab38c0a4a
SHA25667b3abb3e5e6cfecad60a25a90b31cb697b89406413d6a442675aeb69ee80e73
SHA51246b05a0b5eabfdbcdd38eb5a2f3a11fe402467f71ce3027c5797e871e2d70618101bcb9a5bf9ef3ed46a2bd1d042a64c9dd555bd2360fdb6fbcdaff0683bfff8
-
Filesize
658KB
MD5d7f382a357becb92fad459356bf125e3
SHA15d18bda457b297145d8156898f5be95ab38c0a4a
SHA25667b3abb3e5e6cfecad60a25a90b31cb697b89406413d6a442675aeb69ee80e73
SHA51246b05a0b5eabfdbcdd38eb5a2f3a11fe402467f71ce3027c5797e871e2d70618101bcb9a5bf9ef3ed46a2bd1d042a64c9dd555bd2360fdb6fbcdaff0683bfff8
-
Filesize
658KB
MD5d7f382a357becb92fad459356bf125e3
SHA15d18bda457b297145d8156898f5be95ab38c0a4a
SHA25667b3abb3e5e6cfecad60a25a90b31cb697b89406413d6a442675aeb69ee80e73
SHA51246b05a0b5eabfdbcdd38eb5a2f3a11fe402467f71ce3027c5797e871e2d70618101bcb9a5bf9ef3ed46a2bd1d042a64c9dd555bd2360fdb6fbcdaff0683bfff8