Analysis
-
max time kernel
254s -
max time network
336s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
27-11-2022 19:16
Behavioral task
behavioral1
Sample
39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe
Resource
win7-20221111-en
General
-
Target
39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe
-
Size
658KB
-
MD5
0adfe43ac6185801448fc4ab1b4e1303
-
SHA1
f391453f17beeed40cf4a8a232d538b931ecc888
-
SHA256
39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd
-
SHA512
5626bbb112200b00655c2ab7a7ac4d4897d96e6995043cacadaf99c8d04f250512594cea9fe510af77c9983da1b1614448478f00773c8b47a62dfa64536336fd
-
SSDEEP
12288:e9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/h/:qZ1xuVVjfFoynPaVBUR8f+kN10EBx
Malware Config
Extracted
darkcomet
System
adknxxxxxx.ddns.net:1604
DC_MUTEX-YD9TJ9S
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
TUbLiSM9jJeW
-
install
true
-
offline_keylogger
true
-
persistence
true
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe -
Modifies security service 2 TTPs 1 IoCs
Processes:
msdcsc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" msdcsc.exe -
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
msdcsc.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" msdcsc.exe -
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 584 msdcsc.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 1536 attrib.exe 1524 attrib.exe -
Deletes itself 1 IoCs
Processes:
notepad.exepid process 1340 notepad.exe -
Loads dropped DLL 2 IoCs
Processes:
39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exepid process 716 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe 716 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe -
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exemsdcsc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Windows\\system32\\MSDCSC\\msdcsc.exe" msdcsc.exe -
Drops file in System32 directory 3 IoCs
Processes:
39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exedescription ioc process File created C:\Windows\SysWOW64\MSDCSC\msdcsc.exe 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\msdcsc.exe 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe File opened for modification C:\Windows\SysWOW64\MSDCSC\ 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
msdcsc.exepid process 584 msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 716 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe Token: SeSecurityPrivilege 716 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe Token: SeTakeOwnershipPrivilege 716 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe Token: SeLoadDriverPrivilege 716 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe Token: SeSystemProfilePrivilege 716 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe Token: SeSystemtimePrivilege 716 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe Token: SeProfSingleProcessPrivilege 716 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe Token: SeIncBasePriorityPrivilege 716 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe Token: SeCreatePagefilePrivilege 716 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe Token: SeBackupPrivilege 716 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe Token: SeRestorePrivilege 716 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe Token: SeShutdownPrivilege 716 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe Token: SeDebugPrivilege 716 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe Token: SeSystemEnvironmentPrivilege 716 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe Token: SeChangeNotifyPrivilege 716 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe Token: SeRemoteShutdownPrivilege 716 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe Token: SeUndockPrivilege 716 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe Token: SeManageVolumePrivilege 716 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe Token: SeImpersonatePrivilege 716 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe Token: SeCreateGlobalPrivilege 716 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe Token: 33 716 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe Token: 34 716 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe Token: 35 716 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe Token: SeIncreaseQuotaPrivilege 584 msdcsc.exe Token: SeSecurityPrivilege 584 msdcsc.exe Token: SeTakeOwnershipPrivilege 584 msdcsc.exe Token: SeLoadDriverPrivilege 584 msdcsc.exe Token: SeSystemProfilePrivilege 584 msdcsc.exe Token: SeSystemtimePrivilege 584 msdcsc.exe Token: SeProfSingleProcessPrivilege 584 msdcsc.exe Token: SeIncBasePriorityPrivilege 584 msdcsc.exe Token: SeCreatePagefilePrivilege 584 msdcsc.exe Token: SeBackupPrivilege 584 msdcsc.exe Token: SeRestorePrivilege 584 msdcsc.exe Token: SeShutdownPrivilege 584 msdcsc.exe Token: SeDebugPrivilege 584 msdcsc.exe Token: SeSystemEnvironmentPrivilege 584 msdcsc.exe Token: SeChangeNotifyPrivilege 584 msdcsc.exe Token: SeRemoteShutdownPrivilege 584 msdcsc.exe Token: SeUndockPrivilege 584 msdcsc.exe Token: SeManageVolumePrivilege 584 msdcsc.exe Token: SeImpersonatePrivilege 584 msdcsc.exe Token: SeCreateGlobalPrivilege 584 msdcsc.exe Token: 33 584 msdcsc.exe Token: 34 584 msdcsc.exe Token: 35 584 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
msdcsc.exepid process 584 msdcsc.exe -
Suspicious use of WriteProcessMemory 61 IoCs
Processes:
39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.execmd.execmd.exemsdcsc.exedescription pid process target process PID 716 wrote to memory of 1160 716 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe cmd.exe PID 716 wrote to memory of 1160 716 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe cmd.exe PID 716 wrote to memory of 1160 716 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe cmd.exe PID 716 wrote to memory of 1160 716 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe cmd.exe PID 716 wrote to memory of 1812 716 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe cmd.exe PID 716 wrote to memory of 1812 716 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe cmd.exe PID 716 wrote to memory of 1812 716 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe cmd.exe PID 716 wrote to memory of 1812 716 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe cmd.exe PID 716 wrote to memory of 1340 716 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe notepad.exe PID 716 wrote to memory of 1340 716 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe notepad.exe PID 716 wrote to memory of 1340 716 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe notepad.exe PID 716 wrote to memory of 1340 716 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe notepad.exe PID 716 wrote to memory of 1340 716 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe notepad.exe PID 716 wrote to memory of 1340 716 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe notepad.exe PID 716 wrote to memory of 1340 716 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe notepad.exe PID 716 wrote to memory of 1340 716 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe notepad.exe PID 716 wrote to memory of 1340 716 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe notepad.exe PID 716 wrote to memory of 1340 716 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe notepad.exe PID 716 wrote to memory of 1340 716 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe notepad.exe PID 716 wrote to memory of 1340 716 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe notepad.exe PID 716 wrote to memory of 1340 716 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe notepad.exe PID 716 wrote to memory of 1340 716 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe notepad.exe PID 716 wrote to memory of 1340 716 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe notepad.exe PID 716 wrote to memory of 1340 716 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe notepad.exe PID 716 wrote to memory of 1340 716 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe notepad.exe PID 716 wrote to memory of 1340 716 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe notepad.exe PID 1160 wrote to memory of 1524 1160 cmd.exe attrib.exe PID 1160 wrote to memory of 1524 1160 cmd.exe attrib.exe PID 1160 wrote to memory of 1524 1160 cmd.exe attrib.exe PID 1160 wrote to memory of 1524 1160 cmd.exe attrib.exe PID 1812 wrote to memory of 1536 1812 cmd.exe attrib.exe PID 1812 wrote to memory of 1536 1812 cmd.exe attrib.exe PID 1812 wrote to memory of 1536 1812 cmd.exe attrib.exe PID 1812 wrote to memory of 1536 1812 cmd.exe attrib.exe PID 716 wrote to memory of 584 716 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe msdcsc.exe PID 716 wrote to memory of 584 716 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe msdcsc.exe PID 716 wrote to memory of 584 716 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe msdcsc.exe PID 716 wrote to memory of 584 716 39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe msdcsc.exe PID 584 wrote to memory of 1080 584 msdcsc.exe notepad.exe PID 584 wrote to memory of 1080 584 msdcsc.exe notepad.exe PID 584 wrote to memory of 1080 584 msdcsc.exe notepad.exe PID 584 wrote to memory of 1080 584 msdcsc.exe notepad.exe PID 584 wrote to memory of 1080 584 msdcsc.exe notepad.exe PID 584 wrote to memory of 1080 584 msdcsc.exe notepad.exe PID 584 wrote to memory of 1080 584 msdcsc.exe notepad.exe PID 584 wrote to memory of 1080 584 msdcsc.exe notepad.exe PID 584 wrote to memory of 1080 584 msdcsc.exe notepad.exe PID 584 wrote to memory of 1080 584 msdcsc.exe notepad.exe PID 584 wrote to memory of 1080 584 msdcsc.exe notepad.exe PID 584 wrote to memory of 1080 584 msdcsc.exe notepad.exe PID 584 wrote to memory of 1080 584 msdcsc.exe notepad.exe PID 584 wrote to memory of 1080 584 msdcsc.exe notepad.exe PID 584 wrote to memory of 1080 584 msdcsc.exe notepad.exe PID 584 wrote to memory of 1080 584 msdcsc.exe notepad.exe PID 584 wrote to memory of 1080 584 msdcsc.exe notepad.exe PID 584 wrote to memory of 1080 584 msdcsc.exe notepad.exe PID 584 wrote to memory of 1080 584 msdcsc.exe notepad.exe PID 584 wrote to memory of 1080 584 msdcsc.exe notepad.exe PID 584 wrote to memory of 1080 584 msdcsc.exe notepad.exe PID 584 wrote to memory of 1080 584 msdcsc.exe notepad.exe PID 584 wrote to memory of 1080 584 msdcsc.exe notepad.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 1536 attrib.exe 1524 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe"C:\Users\Admin\AppData\Local\Temp\39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\39116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Deletes itself
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exe"C:\Windows\system32\MSDCSC\msdcsc.exe"2⤵
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
658KB
MD50adfe43ac6185801448fc4ab1b4e1303
SHA1f391453f17beeed40cf4a8a232d538b931ecc888
SHA25639116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd
SHA5125626bbb112200b00655c2ab7a7ac4d4897d96e6995043cacadaf99c8d04f250512594cea9fe510af77c9983da1b1614448478f00773c8b47a62dfa64536336fd
-
C:\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
658KB
MD50adfe43ac6185801448fc4ab1b4e1303
SHA1f391453f17beeed40cf4a8a232d538b931ecc888
SHA25639116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd
SHA5125626bbb112200b00655c2ab7a7ac4d4897d96e6995043cacadaf99c8d04f250512594cea9fe510af77c9983da1b1614448478f00773c8b47a62dfa64536336fd
-
\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
658KB
MD50adfe43ac6185801448fc4ab1b4e1303
SHA1f391453f17beeed40cf4a8a232d538b931ecc888
SHA25639116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd
SHA5125626bbb112200b00655c2ab7a7ac4d4897d96e6995043cacadaf99c8d04f250512594cea9fe510af77c9983da1b1614448478f00773c8b47a62dfa64536336fd
-
\Windows\SysWOW64\MSDCSC\msdcsc.exeFilesize
658KB
MD50adfe43ac6185801448fc4ab1b4e1303
SHA1f391453f17beeed40cf4a8a232d538b931ecc888
SHA25639116035169ea9c544db5746e7c39729d4072bfe4d792afe02a726fac321ffbd
SHA5125626bbb112200b00655c2ab7a7ac4d4897d96e6995043cacadaf99c8d04f250512594cea9fe510af77c9983da1b1614448478f00773c8b47a62dfa64536336fd
-
memory/584-63-0x0000000000000000-mapping.dmp
-
memory/716-54-0x0000000074E61000-0x0000000074E63000-memory.dmpFilesize
8KB
-
memory/1080-67-0x0000000000000000-mapping.dmp
-
memory/1160-55-0x0000000000000000-mapping.dmp
-
memory/1340-57-0x0000000000000000-mapping.dmp
-
memory/1524-59-0x0000000000000000-mapping.dmp
-
memory/1536-60-0x0000000000000000-mapping.dmp
-
memory/1812-56-0x0000000000000000-mapping.dmp