Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
26/11/2022, 02:08
Static task
static1
Behavioral task
behavioral1
Sample
c40b65558d773d5148551fd3d0b2f4c002c5d16df2f0077afd15d10db0be7848.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
c40b65558d773d5148551fd3d0b2f4c002c5d16df2f0077afd15d10db0be7848.exe
Resource
win10v2004-20220901-en
General
-
Target
c40b65558d773d5148551fd3d0b2f4c002c5d16df2f0077afd15d10db0be7848.exe
-
Size
1.5MB
-
MD5
a7c3c8e1992dca26a686c79747b391d5
-
SHA1
716ee44002ac35a4201850ef52bf9f08b037c5ce
-
SHA256
c40b65558d773d5148551fd3d0b2f4c002c5d16df2f0077afd15d10db0be7848
-
SHA512
2c59435f875fcf3ceb38cd9a4bb89cb29f9e1a42e7e26206b9636df888eaf074dc7bad8331e57cd8d6860db85edc23a7f0fb6330f7f65ebe6d61cd7e8dd50b17
-
SSDEEP
24576:Xtb20pkaCqT5TBWgNQ7aC377sxJa2ALeGzaa7dNoxEH/MoZI8ndKJ6A:UVg5tQ7aC377sraXeUpNoxEfdZIB5
Malware Config
Extracted
darkcomet
Default
1336imm.noip.me:1336
DCMIN_MUTEX-DJ6DL69
-
gencode
rJML8aXpsfPK
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3252 27207.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation c40b65558d773d5148551fd3d0b2f4c002c5d16df2f0077afd15d10db0be7848.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 27207.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WerFault = "C:\\Users\\Admin\\AppData\\Roaming\\27207.exe" 27207.exe -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x000300000000072d-133.dat autoit_exe behavioral2/files/0x000300000000072d-134.dat autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3252 set thread context of 1240 3252 27207.exe 83 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NTFS ADS 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\c40b65558d773d5148551fd3d0b2f4c002c5d16df2f0077afd15d10db0be7848.exe:Zone.Identifier:$DATA c40b65558d773d5148551fd3d0b2f4c002c5d16df2f0077afd15d10db0be7848.exe File created C:\Users\Admin\AppData\Roaming\27207.exe\:Zone.Identifier:$DATA c40b65558d773d5148551fd3d0b2f4c002c5d16df2f0077afd15d10db0be7848.exe File opened for modification C:\Users\Admin\AppData\Roaming\27207.exe:Zone.Identifier:$DATA 27207.exe -
Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 4996 c40b65558d773d5148551fd3d0b2f4c002c5d16df2f0077afd15d10db0be7848.exe 4996 c40b65558d773d5148551fd3d0b2f4c002c5d16df2f0077afd15d10db0be7848.exe 4996 c40b65558d773d5148551fd3d0b2f4c002c5d16df2f0077afd15d10db0be7848.exe 4996 c40b65558d773d5148551fd3d0b2f4c002c5d16df2f0077afd15d10db0be7848.exe 3252 27207.exe 3252 27207.exe 3252 27207.exe -
Suspicious use of SendNotifyMessage 7 IoCs
pid Process 4996 c40b65558d773d5148551fd3d0b2f4c002c5d16df2f0077afd15d10db0be7848.exe 4996 c40b65558d773d5148551fd3d0b2f4c002c5d16df2f0077afd15d10db0be7848.exe 4996 c40b65558d773d5148551fd3d0b2f4c002c5d16df2f0077afd15d10db0be7848.exe 4996 c40b65558d773d5148551fd3d0b2f4c002c5d16df2f0077afd15d10db0be7848.exe 3252 27207.exe 3252 27207.exe 3252 27207.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 4996 wrote to memory of 3252 4996 c40b65558d773d5148551fd3d0b2f4c002c5d16df2f0077afd15d10db0be7848.exe 81 PID 4996 wrote to memory of 3252 4996 c40b65558d773d5148551fd3d0b2f4c002c5d16df2f0077afd15d10db0be7848.exe 81 PID 4996 wrote to memory of 3252 4996 c40b65558d773d5148551fd3d0b2f4c002c5d16df2f0077afd15d10db0be7848.exe 81 PID 3252 wrote to memory of 1240 3252 27207.exe 83 PID 3252 wrote to memory of 1240 3252 27207.exe 83 PID 3252 wrote to memory of 1240 3252 27207.exe 83 PID 3252 wrote to memory of 1240 3252 27207.exe 83 PID 3252 wrote to memory of 1240 3252 27207.exe 83 PID 3252 wrote to memory of 1240 3252 27207.exe 83 PID 3252 wrote to memory of 1240 3252 27207.exe 83 PID 3252 wrote to memory of 1240 3252 27207.exe 83 PID 3252 wrote to memory of 1240 3252 27207.exe 83 PID 3252 wrote to memory of 1240 3252 27207.exe 83 PID 3252 wrote to memory of 1240 3252 27207.exe 83 PID 3252 wrote to memory of 1240 3252 27207.exe 83 PID 3252 wrote to memory of 1240 3252 27207.exe 83 PID 3252 wrote to memory of 1240 3252 27207.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\c40b65558d773d5148551fd3d0b2f4c002c5d16df2f0077afd15d10db0be7848.exe"C:\Users\Admin\AppData\Local\Temp\c40b65558d773d5148551fd3d0b2f4c002c5d16df2f0077afd15d10db0be7848.exe"1⤵
- Checks computer location settings
- NTFS ADS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Roaming\27207.exe"C:\Users\Admin\AppData\Roaming\27207.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- NTFS ADS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Windows\SysWOW64\WerFault.exe"C:\Windows\SysWOW64\WerFault.exe"3⤵PID:1240
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD58db5d85d4e4fdd5502d657ac2f777304
SHA1c0e5a0782cf843aa2e82c36a1df367d8ea5c03d4
SHA256af005b46e08dddc9820363673bc425500f5ed7ab5c30f26f3ce273b8f9971f5c
SHA512acc00a26d8177723fe8c8caf413e88d72c446d9a56d459b8748102a90cbfb1a56e9df9c2d7db40eb5b6d4888ec9519e7af715d23644d99ceb33fd0c8081835ff
-
Filesize
1.5MB
MD5a7c3c8e1992dca26a686c79747b391d5
SHA1716ee44002ac35a4201850ef52bf9f08b037c5ce
SHA256c40b65558d773d5148551fd3d0b2f4c002c5d16df2f0077afd15d10db0be7848
SHA5122c59435f875fcf3ceb38cd9a4bb89cb29f9e1a42e7e26206b9636df888eaf074dc7bad8331e57cd8d6860db85edc23a7f0fb6330f7f65ebe6d61cd7e8dd50b17
-
Filesize
1.5MB
MD5a7c3c8e1992dca26a686c79747b391d5
SHA1716ee44002ac35a4201850ef52bf9f08b037c5ce
SHA256c40b65558d773d5148551fd3d0b2f4c002c5d16df2f0077afd15d10db0be7848
SHA5122c59435f875fcf3ceb38cd9a4bb89cb29f9e1a42e7e26206b9636df888eaf074dc7bad8331e57cd8d6860db85edc23a7f0fb6330f7f65ebe6d61cd7e8dd50b17