Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
26/11/2022, 02:06
Behavioral task
behavioral1
Sample
f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe
Resource
win7-20220812-en
windows7-x64
19 signatures
150 seconds
General
-
Target
f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe
-
Size
254KB
-
MD5
ef2711be866414d385e6bbb815e89063
-
SHA1
a37ca66873eaf900e63d2ba9423795a4a3c2b340
-
SHA256
f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb
-
SHA512
14975e3e97a3cb33cad1be88cb055452b111f946b7372690ff8fad7e3d78dcda2f64ffaac8c8d86ad4eff734789feb11bff3ac8c561fb604bbda036d19525f36
-
SSDEEP
6144:ycNYk1yuwEDBum3qYWnl0pd0EX3Zq2b6wfIDYm0Pq:ycWkbgTYWnYnt/IDYhPq
Malware Config
Extracted
Family
darkcomet
Botnet
Guest163
C2
kli4ka1989.ddns.net:1604
Mutex
DC_MUTEX-5XCBYZM
Attributes
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
pBfa4kKyXtru
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe" f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe -
Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" msdcsc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile msdcsc.exe -
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" msdcsc.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Executes dropped EXE 1 IoCs
pid Process 908 msdcsc.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 1988 attrib.exe 952 attrib.exe -
resource yara_rule behavioral1/files/0x000b000000012311-61.dat upx behavioral1/files/0x000b000000012311-64.dat upx behavioral1/files/0x000b000000012311-62.dat upx behavioral1/files/0x000b000000012311-66.dat upx behavioral1/memory/1800-67-0x0000000000400000-0x00000000004B8000-memory.dmp upx behavioral1/memory/908-71-0x0000000000400000-0x00000000004B8000-memory.dmp upx behavioral1/memory/908-72-0x0000000000400000-0x00000000004B8000-memory.dmp upx -
Deletes itself 1 IoCs
pid Process 1748 notepad.exe -
Loads dropped DLL 2 IoCs
pid Process 1800 f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe 1800 f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe" f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MSDCSC\\msdcsc.exe" msdcsc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 908 msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1800 f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe Token: SeSecurityPrivilege 1800 f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe Token: SeTakeOwnershipPrivilege 1800 f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe Token: SeLoadDriverPrivilege 1800 f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe Token: SeSystemProfilePrivilege 1800 f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe Token: SeSystemtimePrivilege 1800 f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe Token: SeProfSingleProcessPrivilege 1800 f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe Token: SeIncBasePriorityPrivilege 1800 f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe Token: SeCreatePagefilePrivilege 1800 f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe Token: SeBackupPrivilege 1800 f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe Token: SeRestorePrivilege 1800 f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe Token: SeShutdownPrivilege 1800 f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe Token: SeDebugPrivilege 1800 f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe Token: SeSystemEnvironmentPrivilege 1800 f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe Token: SeChangeNotifyPrivilege 1800 f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe Token: SeRemoteShutdownPrivilege 1800 f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe Token: SeUndockPrivilege 1800 f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe Token: SeManageVolumePrivilege 1800 f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe Token: SeImpersonatePrivilege 1800 f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe Token: SeCreateGlobalPrivilege 1800 f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe Token: 33 1800 f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe Token: 34 1800 f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe Token: 35 1800 f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe Token: SeIncreaseQuotaPrivilege 908 msdcsc.exe Token: SeSecurityPrivilege 908 msdcsc.exe Token: SeTakeOwnershipPrivilege 908 msdcsc.exe Token: SeLoadDriverPrivilege 908 msdcsc.exe Token: SeSystemProfilePrivilege 908 msdcsc.exe Token: SeSystemtimePrivilege 908 msdcsc.exe Token: SeProfSingleProcessPrivilege 908 msdcsc.exe Token: SeIncBasePriorityPrivilege 908 msdcsc.exe Token: SeCreatePagefilePrivilege 908 msdcsc.exe Token: SeBackupPrivilege 908 msdcsc.exe Token: SeRestorePrivilege 908 msdcsc.exe Token: SeShutdownPrivilege 908 msdcsc.exe Token: SeDebugPrivilege 908 msdcsc.exe Token: SeSystemEnvironmentPrivilege 908 msdcsc.exe Token: SeChangeNotifyPrivilege 908 msdcsc.exe Token: SeRemoteShutdownPrivilege 908 msdcsc.exe Token: SeUndockPrivilege 908 msdcsc.exe Token: SeManageVolumePrivilege 908 msdcsc.exe Token: SeImpersonatePrivilege 908 msdcsc.exe Token: SeCreateGlobalPrivilege 908 msdcsc.exe Token: 33 908 msdcsc.exe Token: 34 908 msdcsc.exe Token: 35 908 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 908 msdcsc.exe -
Suspicious use of WriteProcessMemory 61 IoCs
description pid Process procid_target PID 1800 wrote to memory of 1216 1800 f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe 28 PID 1800 wrote to memory of 1216 1800 f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe 28 PID 1800 wrote to memory of 1216 1800 f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe 28 PID 1800 wrote to memory of 1216 1800 f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe 28 PID 1800 wrote to memory of 1320 1800 f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe 29 PID 1800 wrote to memory of 1320 1800 f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe 29 PID 1800 wrote to memory of 1320 1800 f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe 29 PID 1800 wrote to memory of 1320 1800 f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe 29 PID 1800 wrote to memory of 1748 1800 f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe 32 PID 1800 wrote to memory of 1748 1800 f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe 32 PID 1800 wrote to memory of 1748 1800 f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe 32 PID 1800 wrote to memory of 1748 1800 f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe 32 PID 1800 wrote to memory of 1748 1800 f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe 32 PID 1800 wrote to memory of 1748 1800 f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe 32 PID 1800 wrote to memory of 1748 1800 f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe 32 PID 1800 wrote to memory of 1748 1800 f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe 32 PID 1800 wrote to memory of 1748 1800 f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe 32 PID 1800 wrote to memory of 1748 1800 f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe 32 PID 1800 wrote to memory of 1748 1800 f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe 32 PID 1800 wrote to memory of 1748 1800 f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe 32 PID 1800 wrote to memory of 1748 1800 f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe 32 PID 1800 wrote to memory of 1748 1800 f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe 32 PID 1800 wrote to memory of 1748 1800 f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe 32 PID 1800 wrote to memory of 1748 1800 f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe 32 PID 1800 wrote to memory of 1748 1800 f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe 32 PID 1800 wrote to memory of 1748 1800 f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe 32 PID 1320 wrote to memory of 1988 1320 cmd.exe 33 PID 1320 wrote to memory of 1988 1320 cmd.exe 33 PID 1320 wrote to memory of 1988 1320 cmd.exe 33 PID 1320 wrote to memory of 1988 1320 cmd.exe 33 PID 1216 wrote to memory of 952 1216 cmd.exe 34 PID 1216 wrote to memory of 952 1216 cmd.exe 34 PID 1216 wrote to memory of 952 1216 cmd.exe 34 PID 1216 wrote to memory of 952 1216 cmd.exe 34 PID 1800 wrote to memory of 908 1800 f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe 35 PID 1800 wrote to memory of 908 1800 f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe 35 PID 1800 wrote to memory of 908 1800 f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe 35 PID 1800 wrote to memory of 908 1800 f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe 35 PID 908 wrote to memory of 1912 908 msdcsc.exe 36 PID 908 wrote to memory of 1912 908 msdcsc.exe 36 PID 908 wrote to memory of 1912 908 msdcsc.exe 36 PID 908 wrote to memory of 1912 908 msdcsc.exe 36 PID 908 wrote to memory of 1912 908 msdcsc.exe 36 PID 908 wrote to memory of 1912 908 msdcsc.exe 36 PID 908 wrote to memory of 1912 908 msdcsc.exe 36 PID 908 wrote to memory of 1912 908 msdcsc.exe 36 PID 908 wrote to memory of 1912 908 msdcsc.exe 36 PID 908 wrote to memory of 1912 908 msdcsc.exe 36 PID 908 wrote to memory of 1912 908 msdcsc.exe 36 PID 908 wrote to memory of 1912 908 msdcsc.exe 36 PID 908 wrote to memory of 1912 908 msdcsc.exe 36 PID 908 wrote to memory of 1912 908 msdcsc.exe 36 PID 908 wrote to memory of 1912 908 msdcsc.exe 36 PID 908 wrote to memory of 1912 908 msdcsc.exe 36 PID 908 wrote to memory of 1912 908 msdcsc.exe 36 PID 908 wrote to memory of 1912 908 msdcsc.exe 36 PID 908 wrote to memory of 1912 908 msdcsc.exe 36 PID 908 wrote to memory of 1912 908 msdcsc.exe 36 PID 908 wrote to memory of 1912 908 msdcsc.exe 36 PID 908 wrote to memory of 1912 908 msdcsc.exe 36 PID 908 wrote to memory of 1912 908 msdcsc.exe 36 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern msdcsc.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 1988 attrib.exe 952 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe"C:\Users\Admin\AppData\Local\Temp\f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:952
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:1988
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Deletes itself
PID:1748
-
-
C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe"2⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:908 -
C:\Windows\SysWOW64\notepad.exenotepad3⤵PID:1912
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
254KB
MD5ef2711be866414d385e6bbb815e89063
SHA1a37ca66873eaf900e63d2ba9423795a4a3c2b340
SHA256f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb
SHA51214975e3e97a3cb33cad1be88cb055452b111f946b7372690ff8fad7e3d78dcda2f64ffaac8c8d86ad4eff734789feb11bff3ac8c561fb604bbda036d19525f36
-
Filesize
254KB
MD5ef2711be866414d385e6bbb815e89063
SHA1a37ca66873eaf900e63d2ba9423795a4a3c2b340
SHA256f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb
SHA51214975e3e97a3cb33cad1be88cb055452b111f946b7372690ff8fad7e3d78dcda2f64ffaac8c8d86ad4eff734789feb11bff3ac8c561fb604bbda036d19525f36
-
Filesize
254KB
MD5ef2711be866414d385e6bbb815e89063
SHA1a37ca66873eaf900e63d2ba9423795a4a3c2b340
SHA256f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb
SHA51214975e3e97a3cb33cad1be88cb055452b111f946b7372690ff8fad7e3d78dcda2f64ffaac8c8d86ad4eff734789feb11bff3ac8c561fb604bbda036d19525f36
-
Filesize
254KB
MD5ef2711be866414d385e6bbb815e89063
SHA1a37ca66873eaf900e63d2ba9423795a4a3c2b340
SHA256f4baaba9c0ebc1cc971dc073976a09c2904bb4a44c4db9cdf28da9266bd2d0bb
SHA51214975e3e97a3cb33cad1be88cb055452b111f946b7372690ff8fad7e3d78dcda2f64ffaac8c8d86ad4eff734789feb11bff3ac8c561fb604bbda036d19525f36