Analysis
-
max time kernel
208s -
max time network
210s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
02-12-2022 21:31
Behavioral task
behavioral1
Sample
f0fc44b0c5abcecb98bfe9694f72a520fd86698ab2a00264f124f5aa64a4c619.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
f0fc44b0c5abcecb98bfe9694f72a520fd86698ab2a00264f124f5aa64a4c619.exe
Resource
win10v2004-20221111-en
General
-
Target
f0fc44b0c5abcecb98bfe9694f72a520fd86698ab2a00264f124f5aa64a4c619.exe
-
Size
9.2MB
-
MD5
11c39f218ff351925b48cac10509b319
-
SHA1
6226df06aa249ed2578f9d2b0d022ff5a47d44c4
-
SHA256
f0fc44b0c5abcecb98bfe9694f72a520fd86698ab2a00264f124f5aa64a4c619
-
SHA512
d1769fe01fae65342221f00620a8c64a4cbfbdf728568d29039f007730657c1c82e848f8e9f139d05cd23cf8184bbcf9c1e60b8164bdf8c35ee09a238645ba1f
-
SSDEEP
98304:z4zCcIZAyRD3Aq5WSFZyqBAc7c1KNK981ptXoyVacNPIumpSf0e/vOSKKPIx:cKZnR7AqSEMpupI6wc80vOSz4
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
DarkComet.exeMinecraft Hack V2.3.exevbc.exepid process 5044 DarkComet.exe 4428 Minecraft Hack V2.3.exe 400 vbc.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
f0fc44b0c5abcecb98bfe9694f72a520fd86698ab2a00264f124f5aa64a4c619.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation f0fc44b0c5abcecb98bfe9694f72a520fd86698ab2a00264f124f5aa64a4c619.exe -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Minecraft Hack V2.3.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1 = "C:\\Users\\Admin\\AppData\\Roaming\\Minecraft Hack V2.3.exe" Minecraft Hack V2.3.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Minecraft Hack V2.3.exedescription pid process target process PID 4428 set thread context of 400 4428 Minecraft Hack V2.3.exe vbc.exe -
Drops file in Program Files directory 1 IoCs
Processes:
f0fc44b0c5abcecb98bfe9694f72a520fd86698ab2a00264f124f5aa64a4c619.exedescription ioc process File opened for modification C:\Program Files (x86)\DarkComet.exe f0fc44b0c5abcecb98bfe9694f72a520fd86698ab2a00264f124f5aa64a4c619.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
vbc.exedescription pid process Token: SeIncreaseQuotaPrivilege 400 vbc.exe Token: SeSecurityPrivilege 400 vbc.exe Token: SeTakeOwnershipPrivilege 400 vbc.exe Token: SeLoadDriverPrivilege 400 vbc.exe Token: SeSystemProfilePrivilege 400 vbc.exe Token: SeSystemtimePrivilege 400 vbc.exe Token: SeProfSingleProcessPrivilege 400 vbc.exe Token: SeIncBasePriorityPrivilege 400 vbc.exe Token: SeCreatePagefilePrivilege 400 vbc.exe Token: SeBackupPrivilege 400 vbc.exe Token: SeRestorePrivilege 400 vbc.exe Token: SeShutdownPrivilege 400 vbc.exe Token: SeDebugPrivilege 400 vbc.exe Token: SeSystemEnvironmentPrivilege 400 vbc.exe Token: SeChangeNotifyPrivilege 400 vbc.exe Token: SeRemoteShutdownPrivilege 400 vbc.exe Token: SeUndockPrivilege 400 vbc.exe Token: SeManageVolumePrivilege 400 vbc.exe Token: SeImpersonatePrivilege 400 vbc.exe Token: SeCreateGlobalPrivilege 400 vbc.exe Token: 33 400 vbc.exe Token: 34 400 vbc.exe Token: 35 400 vbc.exe Token: 36 400 vbc.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
f0fc44b0c5abcecb98bfe9694f72a520fd86698ab2a00264f124f5aa64a4c619.exevbc.exepid process 4176 f0fc44b0c5abcecb98bfe9694f72a520fd86698ab2a00264f124f5aa64a4c619.exe 400 vbc.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
f0fc44b0c5abcecb98bfe9694f72a520fd86698ab2a00264f124f5aa64a4c619.exeMinecraft Hack V2.3.exedescription pid process target process PID 4176 wrote to memory of 5044 4176 f0fc44b0c5abcecb98bfe9694f72a520fd86698ab2a00264f124f5aa64a4c619.exe DarkComet.exe PID 4176 wrote to memory of 5044 4176 f0fc44b0c5abcecb98bfe9694f72a520fd86698ab2a00264f124f5aa64a4c619.exe DarkComet.exe PID 4176 wrote to memory of 5044 4176 f0fc44b0c5abcecb98bfe9694f72a520fd86698ab2a00264f124f5aa64a4c619.exe DarkComet.exe PID 4176 wrote to memory of 4428 4176 f0fc44b0c5abcecb98bfe9694f72a520fd86698ab2a00264f124f5aa64a4c619.exe Minecraft Hack V2.3.exe PID 4176 wrote to memory of 4428 4176 f0fc44b0c5abcecb98bfe9694f72a520fd86698ab2a00264f124f5aa64a4c619.exe Minecraft Hack V2.3.exe PID 4176 wrote to memory of 4428 4176 f0fc44b0c5abcecb98bfe9694f72a520fd86698ab2a00264f124f5aa64a4c619.exe Minecraft Hack V2.3.exe PID 4428 wrote to memory of 400 4428 Minecraft Hack V2.3.exe vbc.exe PID 4428 wrote to memory of 400 4428 Minecraft Hack V2.3.exe vbc.exe PID 4428 wrote to memory of 400 4428 Minecraft Hack V2.3.exe vbc.exe PID 4428 wrote to memory of 400 4428 Minecraft Hack V2.3.exe vbc.exe PID 4428 wrote to memory of 400 4428 Minecraft Hack V2.3.exe vbc.exe PID 4428 wrote to memory of 400 4428 Minecraft Hack V2.3.exe vbc.exe PID 4428 wrote to memory of 400 4428 Minecraft Hack V2.3.exe vbc.exe PID 4428 wrote to memory of 400 4428 Minecraft Hack V2.3.exe vbc.exe PID 4428 wrote to memory of 400 4428 Minecraft Hack V2.3.exe vbc.exe PID 4428 wrote to memory of 400 4428 Minecraft Hack V2.3.exe vbc.exe PID 4428 wrote to memory of 400 4428 Minecraft Hack V2.3.exe vbc.exe PID 4428 wrote to memory of 400 4428 Minecraft Hack V2.3.exe vbc.exe PID 4428 wrote to memory of 400 4428 Minecraft Hack V2.3.exe vbc.exe PID 4428 wrote to memory of 400 4428 Minecraft Hack V2.3.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f0fc44b0c5abcecb98bfe9694f72a520fd86698ab2a00264f124f5aa64a4c619.exe"C:\Users\Admin\AppData\Local\Temp\f0fc44b0c5abcecb98bfe9694f72a520fd86698ab2a00264f124f5aa64a4c619.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\DarkComet.exe"C:\Program Files (x86)\DarkComet.exe"2⤵
- Executes dropped EXE
-
C:\Minecraft Hack V2.3.exe"C:\Minecraft Hack V2.3.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vbc.exeC:\Users\Admin\AppData\Local\Temp\vbc.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Minecraft Hack V2.3.exeFilesize
686KB
MD5a95cd2ed4c9221589d7e01d09c686cca
SHA13ce89ad920705d5cdcaecc6dd065e211aa96ed59
SHA25684b1c4c355956d23398aac59abbb5299bdb644d7581112f77bf82c400e9d38fa
SHA512da0c860dd6b9f28c3a789d640b5ae6e7f38fcc3bed226e86128e33490f520586935e1e19024af9587ebb1bd7a31f018f5193b952cd35b6f040dfd785341b7cbe
-
C:\Minecraft Hack V2.3.exeFilesize
686KB
MD5a95cd2ed4c9221589d7e01d09c686cca
SHA13ce89ad920705d5cdcaecc6dd065e211aa96ed59
SHA25684b1c4c355956d23398aac59abbb5299bdb644d7581112f77bf82c400e9d38fa
SHA512da0c860dd6b9f28c3a789d640b5ae6e7f38fcc3bed226e86128e33490f520586935e1e19024af9587ebb1bd7a31f018f5193b952cd35b6f040dfd785341b7cbe
-
C:\Program Files (x86)\DarkComet.exeFilesize
8.4MB
MD5680abcfee992a68de99ef8bf13b1d8ab
SHA12a84253a240e313f33dc266e37a0d4b2533d18aa
SHA256cfa8c430b754de111ef3727d597e18319000a617d0d5db9913bc4bc6c448e006
SHA512a780a986b9fee1e81d6ce0c6729c642c64adb50d408b00755ea26412e6833a5aa96bb45055b7f642b1dbffa14c7d5b2dc25b9fd60f827c73b40f7a152a832c68
-
C:\Program Files (x86)\DarkComet.exeFilesize
8.4MB
MD5680abcfee992a68de99ef8bf13b1d8ab
SHA12a84253a240e313f33dc266e37a0d4b2533d18aa
SHA256cfa8c430b754de111ef3727d597e18319000a617d0d5db9913bc4bc6c448e006
SHA512a780a986b9fee1e81d6ce0c6729c642c64adb50d408b00755ea26412e6833a5aa96bb45055b7f642b1dbffa14c7d5b2dc25b9fd60f827c73b40f7a152a832c68
-
C:\Users\Admin\AppData\Local\Temp\vbc.exeFilesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
C:\Users\Admin\AppData\Local\Temp\vbc.exeFilesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
memory/400-140-0x0000000000000000-mapping.dmp
-
memory/400-141-0x0000000000400000-0x00000000004B4000-memory.dmpFilesize
720KB
-
memory/400-144-0x0000000000400000-0x00000000004B4000-memory.dmpFilesize
720KB
-
memory/400-145-0x0000000000400000-0x00000000004B4000-memory.dmpFilesize
720KB
-
memory/400-147-0x0000000000400000-0x00000000004B4000-memory.dmpFilesize
720KB
-
memory/400-149-0x0000000000400000-0x00000000004B4000-memory.dmpFilesize
720KB
-
memory/400-151-0x0000000000400000-0x00000000004B4000-memory.dmpFilesize
720KB
-
memory/4428-137-0x0000000000000000-mapping.dmp
-
memory/4428-148-0x0000000075060000-0x0000000075611000-memory.dmpFilesize
5.7MB
-
memory/4428-150-0x0000000075060000-0x0000000075611000-memory.dmpFilesize
5.7MB
-
memory/5044-134-0x0000000000000000-mapping.dmp