Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
174s -
max time network
179s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
26/11/2022, 02:10
Behavioral task
behavioral1
Sample
81a955c38b0a5d763002c59054844fcc30d61918259159991a6369ca9199fd56.exe
Resource
win7-20220812-en
windows7-x64
21 signatures
150 seconds
General
-
Target
81a955c38b0a5d763002c59054844fcc30d61918259159991a6369ca9199fd56.exe
-
Size
252KB
-
MD5
b74660b4c8e47a8aa2bf2717055dd307
-
SHA1
5f4ff3f54ed0a69dad66c40886152d1a79b6e79d
-
SHA256
81a955c38b0a5d763002c59054844fcc30d61918259159991a6369ca9199fd56
-
SHA512
8422288c834fb5374076b55141ec9ac15960b3ee2ba7a906f694929b0bed4dbd7ed43db5490c18a2de9588684d02af82cdeffef2c0f4754845e8b8d49e073cb3
-
SSDEEP
6144:8cNYS996KFifeVjBpeExgVTFSXFoMc5RhCaL37VX:8cW7KEZlPzCy37B
Malware Config
Extracted
Family
darkcomet
Botnet
Guest15
C2
kalitoor.ddns.net:2468
kalitoor.ddns.net:1357
Mutex
X1K3LKA15CPC33
Attributes
-
InstallPath
WINDS\system.exe
-
gencode
z8g3vHLKaCla
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
WindowsUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\WINDS\\system.exe" 81a955c38b0a5d763002c59054844fcc30d61918259159991a6369ca9199fd56.exe -
Modifies firewall policy service 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" system.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile iexplore.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" iexplore.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" iexplore.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile system.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" system.exe -
Modifies security service 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" iexplore.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" system.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" system.exe -
Disables RegEdit via registry modification 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" system.exe -
Disables Task Manager via registry modification
-
Executes dropped EXE 1 IoCs
pid Process 4788 system.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 488 attrib.exe 2616 attrib.exe -
resource yara_rule behavioral2/memory/1800-132-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/files/0x0006000000022e2f-138.dat upx behavioral2/files/0x0006000000022e2f-139.dat upx behavioral2/memory/4788-140-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral2/memory/1800-142-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 81a955c38b0a5d763002c59054844fcc30d61918259159991a6369ca9199fd56.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" system.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\WINDS\\system.exe" 81a955c38b0a5d763002c59054844fcc30d61918259159991a6369ca9199fd56.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4788 set thread context of 4768 4788 system.exe 86 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 81a955c38b0a5d763002c59054844fcc30d61918259159991a6369ca9199fd56.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4768 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1800 81a955c38b0a5d763002c59054844fcc30d61918259159991a6369ca9199fd56.exe Token: SeSecurityPrivilege 1800 81a955c38b0a5d763002c59054844fcc30d61918259159991a6369ca9199fd56.exe Token: SeTakeOwnershipPrivilege 1800 81a955c38b0a5d763002c59054844fcc30d61918259159991a6369ca9199fd56.exe Token: SeLoadDriverPrivilege 1800 81a955c38b0a5d763002c59054844fcc30d61918259159991a6369ca9199fd56.exe Token: SeSystemProfilePrivilege 1800 81a955c38b0a5d763002c59054844fcc30d61918259159991a6369ca9199fd56.exe Token: SeSystemtimePrivilege 1800 81a955c38b0a5d763002c59054844fcc30d61918259159991a6369ca9199fd56.exe Token: SeProfSingleProcessPrivilege 1800 81a955c38b0a5d763002c59054844fcc30d61918259159991a6369ca9199fd56.exe Token: SeIncBasePriorityPrivilege 1800 81a955c38b0a5d763002c59054844fcc30d61918259159991a6369ca9199fd56.exe Token: SeCreatePagefilePrivilege 1800 81a955c38b0a5d763002c59054844fcc30d61918259159991a6369ca9199fd56.exe Token: SeBackupPrivilege 1800 81a955c38b0a5d763002c59054844fcc30d61918259159991a6369ca9199fd56.exe Token: SeRestorePrivilege 1800 81a955c38b0a5d763002c59054844fcc30d61918259159991a6369ca9199fd56.exe Token: SeShutdownPrivilege 1800 81a955c38b0a5d763002c59054844fcc30d61918259159991a6369ca9199fd56.exe Token: SeDebugPrivilege 1800 81a955c38b0a5d763002c59054844fcc30d61918259159991a6369ca9199fd56.exe Token: SeSystemEnvironmentPrivilege 1800 81a955c38b0a5d763002c59054844fcc30d61918259159991a6369ca9199fd56.exe Token: SeChangeNotifyPrivilege 1800 81a955c38b0a5d763002c59054844fcc30d61918259159991a6369ca9199fd56.exe Token: SeRemoteShutdownPrivilege 1800 81a955c38b0a5d763002c59054844fcc30d61918259159991a6369ca9199fd56.exe Token: SeUndockPrivilege 1800 81a955c38b0a5d763002c59054844fcc30d61918259159991a6369ca9199fd56.exe Token: SeManageVolumePrivilege 1800 81a955c38b0a5d763002c59054844fcc30d61918259159991a6369ca9199fd56.exe Token: SeImpersonatePrivilege 1800 81a955c38b0a5d763002c59054844fcc30d61918259159991a6369ca9199fd56.exe Token: SeCreateGlobalPrivilege 1800 81a955c38b0a5d763002c59054844fcc30d61918259159991a6369ca9199fd56.exe Token: 33 1800 81a955c38b0a5d763002c59054844fcc30d61918259159991a6369ca9199fd56.exe Token: 34 1800 81a955c38b0a5d763002c59054844fcc30d61918259159991a6369ca9199fd56.exe Token: 35 1800 81a955c38b0a5d763002c59054844fcc30d61918259159991a6369ca9199fd56.exe Token: 36 1800 81a955c38b0a5d763002c59054844fcc30d61918259159991a6369ca9199fd56.exe Token: SeIncreaseQuotaPrivilege 4788 system.exe Token: SeSecurityPrivilege 4788 system.exe Token: SeTakeOwnershipPrivilege 4788 system.exe Token: SeLoadDriverPrivilege 4788 system.exe Token: SeSystemProfilePrivilege 4788 system.exe Token: SeSystemtimePrivilege 4788 system.exe Token: SeProfSingleProcessPrivilege 4788 system.exe Token: SeIncBasePriorityPrivilege 4788 system.exe Token: SeCreatePagefilePrivilege 4788 system.exe Token: SeBackupPrivilege 4788 system.exe Token: SeRestorePrivilege 4788 system.exe Token: SeShutdownPrivilege 4788 system.exe Token: SeDebugPrivilege 4788 system.exe Token: SeSystemEnvironmentPrivilege 4788 system.exe Token: SeChangeNotifyPrivilege 4788 system.exe Token: SeRemoteShutdownPrivilege 4788 system.exe Token: SeUndockPrivilege 4788 system.exe Token: SeManageVolumePrivilege 4788 system.exe Token: SeImpersonatePrivilege 4788 system.exe Token: SeCreateGlobalPrivilege 4788 system.exe Token: 33 4788 system.exe Token: 34 4788 system.exe Token: 35 4788 system.exe Token: 36 4788 system.exe Token: SeIncreaseQuotaPrivilege 4768 iexplore.exe Token: SeSecurityPrivilege 4768 iexplore.exe Token: SeTakeOwnershipPrivilege 4768 iexplore.exe Token: SeLoadDriverPrivilege 4768 iexplore.exe Token: SeSystemProfilePrivilege 4768 iexplore.exe Token: SeSystemtimePrivilege 4768 iexplore.exe Token: SeProfSingleProcessPrivilege 4768 iexplore.exe Token: SeIncBasePriorityPrivilege 4768 iexplore.exe Token: SeCreatePagefilePrivilege 4768 iexplore.exe Token: SeBackupPrivilege 4768 iexplore.exe Token: SeRestorePrivilege 4768 iexplore.exe Token: SeShutdownPrivilege 4768 iexplore.exe Token: SeDebugPrivilege 4768 iexplore.exe Token: SeSystemEnvironmentPrivilege 4768 iexplore.exe Token: SeChangeNotifyPrivilege 4768 iexplore.exe Token: SeRemoteShutdownPrivilege 4768 iexplore.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4768 iexplore.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 1800 wrote to memory of 4104 1800 81a955c38b0a5d763002c59054844fcc30d61918259159991a6369ca9199fd56.exe 79 PID 1800 wrote to memory of 4104 1800 81a955c38b0a5d763002c59054844fcc30d61918259159991a6369ca9199fd56.exe 79 PID 1800 wrote to memory of 4104 1800 81a955c38b0a5d763002c59054844fcc30d61918259159991a6369ca9199fd56.exe 79 PID 1800 wrote to memory of 3672 1800 81a955c38b0a5d763002c59054844fcc30d61918259159991a6369ca9199fd56.exe 81 PID 1800 wrote to memory of 3672 1800 81a955c38b0a5d763002c59054844fcc30d61918259159991a6369ca9199fd56.exe 81 PID 1800 wrote to memory of 3672 1800 81a955c38b0a5d763002c59054844fcc30d61918259159991a6369ca9199fd56.exe 81 PID 4104 wrote to memory of 488 4104 cmd.exe 83 PID 4104 wrote to memory of 488 4104 cmd.exe 83 PID 4104 wrote to memory of 488 4104 cmd.exe 83 PID 3672 wrote to memory of 2616 3672 cmd.exe 84 PID 3672 wrote to memory of 2616 3672 cmd.exe 84 PID 3672 wrote to memory of 2616 3672 cmd.exe 84 PID 1800 wrote to memory of 4788 1800 81a955c38b0a5d763002c59054844fcc30d61918259159991a6369ca9199fd56.exe 85 PID 1800 wrote to memory of 4788 1800 81a955c38b0a5d763002c59054844fcc30d61918259159991a6369ca9199fd56.exe 85 PID 1800 wrote to memory of 4788 1800 81a955c38b0a5d763002c59054844fcc30d61918259159991a6369ca9199fd56.exe 85 PID 4788 wrote to memory of 4768 4788 system.exe 86 PID 4788 wrote to memory of 4768 4788 system.exe 86 PID 4788 wrote to memory of 4768 4788 system.exe 86 PID 4788 wrote to memory of 4768 4788 system.exe 86 PID 4788 wrote to memory of 4768 4788 system.exe 86 PID 4768 wrote to memory of 448 4768 iexplore.exe 87 PID 4768 wrote to memory of 448 4768 iexplore.exe 87 PID 4768 wrote to memory of 448 4768 iexplore.exe 87 PID 4768 wrote to memory of 448 4768 iexplore.exe 87 PID 4768 wrote to memory of 448 4768 iexplore.exe 87 PID 4768 wrote to memory of 448 4768 iexplore.exe 87 PID 4768 wrote to memory of 448 4768 iexplore.exe 87 PID 4768 wrote to memory of 448 4768 iexplore.exe 87 PID 4768 wrote to memory of 448 4768 iexplore.exe 87 PID 4768 wrote to memory of 448 4768 iexplore.exe 87 PID 4768 wrote to memory of 448 4768 iexplore.exe 87 PID 4768 wrote to memory of 448 4768 iexplore.exe 87 PID 4768 wrote to memory of 448 4768 iexplore.exe 87 PID 4768 wrote to memory of 448 4768 iexplore.exe 87 PID 4768 wrote to memory of 448 4768 iexplore.exe 87 PID 4768 wrote to memory of 448 4768 iexplore.exe 87 PID 4768 wrote to memory of 448 4768 iexplore.exe 87 PID 4768 wrote to memory of 448 4768 iexplore.exe 87 PID 4768 wrote to memory of 448 4768 iexplore.exe 87 PID 4768 wrote to memory of 448 4768 iexplore.exe 87 PID 4768 wrote to memory of 448 4768 iexplore.exe 87 PID 4768 wrote to memory of 448 4768 iexplore.exe 87 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion system.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern system.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" system.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 488 attrib.exe 2616 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\81a955c38b0a5d763002c59054844fcc30d61918259159991a6369ca9199fd56.exe"C:\Users\Admin\AppData\Local\Temp\81a955c38b0a5d763002c59054844fcc30d61918259159991a6369ca9199fd56.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\81a955c38b0a5d763002c59054844fcc30d61918259159991a6369ca9199fd56.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\81a955c38b0a5d763002c59054844fcc30d61918259159991a6369ca9199fd56.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:488
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2616
-
-
-
C:\ProgramData\Microsoft\Windows\Start Menu\WINDS\system.exe"C:\ProgramData\Microsoft\Windows\Start Menu\WINDS\system.exe"2⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4788 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Windows\SysWOW64\notepad.exenotepad4⤵PID:448
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
252KB
MD5b74660b4c8e47a8aa2bf2717055dd307
SHA15f4ff3f54ed0a69dad66c40886152d1a79b6e79d
SHA25681a955c38b0a5d763002c59054844fcc30d61918259159991a6369ca9199fd56
SHA5128422288c834fb5374076b55141ec9ac15960b3ee2ba7a906f694929b0bed4dbd7ed43db5490c18a2de9588684d02af82cdeffef2c0f4754845e8b8d49e073cb3
-
Filesize
252KB
MD5b74660b4c8e47a8aa2bf2717055dd307
SHA15f4ff3f54ed0a69dad66c40886152d1a79b6e79d
SHA25681a955c38b0a5d763002c59054844fcc30d61918259159991a6369ca9199fd56
SHA5128422288c834fb5374076b55141ec9ac15960b3ee2ba7a906f694929b0bed4dbd7ed43db5490c18a2de9588684d02af82cdeffef2c0f4754845e8b8d49e073cb3