Analysis
-
max time kernel
193s -
max time network
107s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
02-12-2022 21:31
Behavioral task
behavioral1
Sample
f0fc44b0c5abcecb98bfe9694f72a520fd86698ab2a00264f124f5aa64a4c619.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
f0fc44b0c5abcecb98bfe9694f72a520fd86698ab2a00264f124f5aa64a4c619.exe
Resource
win10v2004-20221111-en
General
-
Target
f0fc44b0c5abcecb98bfe9694f72a520fd86698ab2a00264f124f5aa64a4c619.exe
-
Size
9.2MB
-
MD5
11c39f218ff351925b48cac10509b319
-
SHA1
6226df06aa249ed2578f9d2b0d022ff5a47d44c4
-
SHA256
f0fc44b0c5abcecb98bfe9694f72a520fd86698ab2a00264f124f5aa64a4c619
-
SHA512
d1769fe01fae65342221f00620a8c64a4cbfbdf728568d29039f007730657c1c82e848f8e9f139d05cd23cf8184bbcf9c1e60b8164bdf8c35ee09a238645ba1f
-
SSDEEP
98304:z4zCcIZAyRD3Aq5WSFZyqBAc7c1KNK981ptXoyVacNPIumpSf0e/vOSKKPIx:cKZnR7AqSEMpupI6wc80vOSz4
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
DarkComet.exeMinecraft Hack V2.3.exevbc.exepid process 1556 DarkComet.exe 588 Minecraft Hack V2.3.exe 628 vbc.exe -
Loads dropped DLL 2 IoCs
Processes:
f0fc44b0c5abcecb98bfe9694f72a520fd86698ab2a00264f124f5aa64a4c619.exeMinecraft Hack V2.3.exepid process 2016 f0fc44b0c5abcecb98bfe9694f72a520fd86698ab2a00264f124f5aa64a4c619.exe 588 Minecraft Hack V2.3.exe -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Minecraft Hack V2.3.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\1 = "C:\\Users\\Admin\\AppData\\Roaming\\Minecraft Hack V2.3.exe" Minecraft Hack V2.3.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Minecraft Hack V2.3.exedescription pid process target process PID 588 set thread context of 628 588 Minecraft Hack V2.3.exe vbc.exe -
Drops file in Program Files directory 1 IoCs
Processes:
f0fc44b0c5abcecb98bfe9694f72a520fd86698ab2a00264f124f5aa64a4c619.exedescription ioc process File opened for modification C:\Program Files (x86)\DarkComet.exe f0fc44b0c5abcecb98bfe9694f72a520fd86698ab2a00264f124f5aa64a4c619.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
vbc.exedescription pid process Token: SeIncreaseQuotaPrivilege 628 vbc.exe Token: SeSecurityPrivilege 628 vbc.exe Token: SeTakeOwnershipPrivilege 628 vbc.exe Token: SeLoadDriverPrivilege 628 vbc.exe Token: SeSystemProfilePrivilege 628 vbc.exe Token: SeSystemtimePrivilege 628 vbc.exe Token: SeProfSingleProcessPrivilege 628 vbc.exe Token: SeIncBasePriorityPrivilege 628 vbc.exe Token: SeCreatePagefilePrivilege 628 vbc.exe Token: SeBackupPrivilege 628 vbc.exe Token: SeRestorePrivilege 628 vbc.exe Token: SeShutdownPrivilege 628 vbc.exe Token: SeDebugPrivilege 628 vbc.exe Token: SeSystemEnvironmentPrivilege 628 vbc.exe Token: SeChangeNotifyPrivilege 628 vbc.exe Token: SeRemoteShutdownPrivilege 628 vbc.exe Token: SeUndockPrivilege 628 vbc.exe Token: SeManageVolumePrivilege 628 vbc.exe Token: SeImpersonatePrivilege 628 vbc.exe Token: SeCreateGlobalPrivilege 628 vbc.exe Token: 33 628 vbc.exe Token: 34 628 vbc.exe Token: 35 628 vbc.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
f0fc44b0c5abcecb98bfe9694f72a520fd86698ab2a00264f124f5aa64a4c619.exevbc.exepid process 2016 f0fc44b0c5abcecb98bfe9694f72a520fd86698ab2a00264f124f5aa64a4c619.exe 628 vbc.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
f0fc44b0c5abcecb98bfe9694f72a520fd86698ab2a00264f124f5aa64a4c619.exeMinecraft Hack V2.3.exedescription pid process target process PID 2016 wrote to memory of 1556 2016 f0fc44b0c5abcecb98bfe9694f72a520fd86698ab2a00264f124f5aa64a4c619.exe DarkComet.exe PID 2016 wrote to memory of 1556 2016 f0fc44b0c5abcecb98bfe9694f72a520fd86698ab2a00264f124f5aa64a4c619.exe DarkComet.exe PID 2016 wrote to memory of 1556 2016 f0fc44b0c5abcecb98bfe9694f72a520fd86698ab2a00264f124f5aa64a4c619.exe DarkComet.exe PID 2016 wrote to memory of 1556 2016 f0fc44b0c5abcecb98bfe9694f72a520fd86698ab2a00264f124f5aa64a4c619.exe DarkComet.exe PID 2016 wrote to memory of 588 2016 f0fc44b0c5abcecb98bfe9694f72a520fd86698ab2a00264f124f5aa64a4c619.exe Minecraft Hack V2.3.exe PID 2016 wrote to memory of 588 2016 f0fc44b0c5abcecb98bfe9694f72a520fd86698ab2a00264f124f5aa64a4c619.exe Minecraft Hack V2.3.exe PID 2016 wrote to memory of 588 2016 f0fc44b0c5abcecb98bfe9694f72a520fd86698ab2a00264f124f5aa64a4c619.exe Minecraft Hack V2.3.exe PID 2016 wrote to memory of 588 2016 f0fc44b0c5abcecb98bfe9694f72a520fd86698ab2a00264f124f5aa64a4c619.exe Minecraft Hack V2.3.exe PID 588 wrote to memory of 628 588 Minecraft Hack V2.3.exe vbc.exe PID 588 wrote to memory of 628 588 Minecraft Hack V2.3.exe vbc.exe PID 588 wrote to memory of 628 588 Minecraft Hack V2.3.exe vbc.exe PID 588 wrote to memory of 628 588 Minecraft Hack V2.3.exe vbc.exe PID 588 wrote to memory of 628 588 Minecraft Hack V2.3.exe vbc.exe PID 588 wrote to memory of 628 588 Minecraft Hack V2.3.exe vbc.exe PID 588 wrote to memory of 628 588 Minecraft Hack V2.3.exe vbc.exe PID 588 wrote to memory of 628 588 Minecraft Hack V2.3.exe vbc.exe PID 588 wrote to memory of 628 588 Minecraft Hack V2.3.exe vbc.exe PID 588 wrote to memory of 628 588 Minecraft Hack V2.3.exe vbc.exe PID 588 wrote to memory of 628 588 Minecraft Hack V2.3.exe vbc.exe PID 588 wrote to memory of 628 588 Minecraft Hack V2.3.exe vbc.exe PID 588 wrote to memory of 628 588 Minecraft Hack V2.3.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f0fc44b0c5abcecb98bfe9694f72a520fd86698ab2a00264f124f5aa64a4c619.exe"C:\Users\Admin\AppData\Local\Temp\f0fc44b0c5abcecb98bfe9694f72a520fd86698ab2a00264f124f5aa64a4c619.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\DarkComet.exe"C:\Program Files (x86)\DarkComet.exe"2⤵
- Executes dropped EXE
-
C:\Minecraft Hack V2.3.exe"C:\Minecraft Hack V2.3.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vbc.exeC:\Users\Admin\AppData\Local\Temp\vbc.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Minecraft Hack V2.3.exeFilesize
686KB
MD5a95cd2ed4c9221589d7e01d09c686cca
SHA13ce89ad920705d5cdcaecc6dd065e211aa96ed59
SHA25684b1c4c355956d23398aac59abbb5299bdb644d7581112f77bf82c400e9d38fa
SHA512da0c860dd6b9f28c3a789d640b5ae6e7f38fcc3bed226e86128e33490f520586935e1e19024af9587ebb1bd7a31f018f5193b952cd35b6f040dfd785341b7cbe
-
C:\Minecraft Hack V2.3.exeFilesize
686KB
MD5a95cd2ed4c9221589d7e01d09c686cca
SHA13ce89ad920705d5cdcaecc6dd065e211aa96ed59
SHA25684b1c4c355956d23398aac59abbb5299bdb644d7581112f77bf82c400e9d38fa
SHA512da0c860dd6b9f28c3a789d640b5ae6e7f38fcc3bed226e86128e33490f520586935e1e19024af9587ebb1bd7a31f018f5193b952cd35b6f040dfd785341b7cbe
-
C:\Program Files (x86)\DarkComet.exeFilesize
8.4MB
MD5680abcfee992a68de99ef8bf13b1d8ab
SHA12a84253a240e313f33dc266e37a0d4b2533d18aa
SHA256cfa8c430b754de111ef3727d597e18319000a617d0d5db9913bc4bc6c448e006
SHA512a780a986b9fee1e81d6ce0c6729c642c64adb50d408b00755ea26412e6833a5aa96bb45055b7f642b1dbffa14c7d5b2dc25b9fd60f827c73b40f7a152a832c68
-
C:\Users\Admin\AppData\Local\Temp\vbc.exeFilesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98
-
\Program Files (x86)\DarkComet.exeFilesize
8.4MB
MD5680abcfee992a68de99ef8bf13b1d8ab
SHA12a84253a240e313f33dc266e37a0d4b2533d18aa
SHA256cfa8c430b754de111ef3727d597e18319000a617d0d5db9913bc4bc6c448e006
SHA512a780a986b9fee1e81d6ce0c6729c642c64adb50d408b00755ea26412e6833a5aa96bb45055b7f642b1dbffa14c7d5b2dc25b9fd60f827c73b40f7a152a832c68
-
\Users\Admin\AppData\Local\Temp\vbc.exeFilesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98
-
memory/588-87-0x0000000073D90000-0x000000007433B000-memory.dmpFilesize
5.7MB
-
memory/588-62-0x0000000000000000-mapping.dmp
-
memory/628-72-0x0000000000400000-0x00000000004B4000-memory.dmpFilesize
720KB
-
memory/628-82-0x00000000004928A0-mapping.dmp
-
memory/628-68-0x0000000000400000-0x00000000004B4000-memory.dmpFilesize
720KB
-
memory/628-70-0x0000000000400000-0x00000000004B4000-memory.dmpFilesize
720KB
-
memory/628-89-0x0000000000400000-0x00000000004B4000-memory.dmpFilesize
720KB
-
memory/628-74-0x0000000000400000-0x00000000004B4000-memory.dmpFilesize
720KB
-
memory/628-76-0x0000000000400000-0x00000000004B4000-memory.dmpFilesize
720KB
-
memory/628-77-0x0000000000400000-0x00000000004B4000-memory.dmpFilesize
720KB
-
memory/628-79-0x0000000000400000-0x00000000004B4000-memory.dmpFilesize
720KB
-
memory/628-67-0x0000000000400000-0x00000000004B4000-memory.dmpFilesize
720KB
-
memory/628-81-0x0000000000400000-0x00000000004B4000-memory.dmpFilesize
720KB
-
memory/628-84-0x0000000000400000-0x00000000004B4000-memory.dmpFilesize
720KB
-
memory/628-88-0x0000000000400000-0x00000000004B4000-memory.dmpFilesize
720KB
-
memory/628-86-0x0000000000400000-0x00000000004B4000-memory.dmpFilesize
720KB
-
memory/1556-58-0x0000000000000000-mapping.dmp
-
memory/2016-61-0x00000000051F0000-0x0000000005A7A000-memory.dmpFilesize
8.5MB
-
memory/2016-56-0x00000000760C1000-0x00000000760C3000-memory.dmpFilesize
8KB