Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
156s -
max time network
173s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
24/12/2023, 14:53
Behavioral task
behavioral1
Sample
0257dd258ba3c33ffa2b3c4beba993fd.exe
Resource
win7-20231215-en
windows7-x64
10 signatures
150 seconds
General
-
Target
0257dd258ba3c33ffa2b3c4beba993fd.exe
-
Size
650KB
-
MD5
0257dd258ba3c33ffa2b3c4beba993fd
-
SHA1
bfb300534eb88a08e6eca1f89c21a62cb907b01f
-
SHA256
04c0c92253e08d5ce6617d8f29a317cf7353412a0fc15a4f804d562e036958d8
-
SHA512
ae582cd45713f0691f5bc7e3b58ea12224a87427ebe7a1bdc2eabb573a9010dcf7ab63912490bc9001b22bfb494099df49ec0829fcbb9b7492211ba20ee84fb9
-
SSDEEP
12288:7k0QVlhmPojAPTMEsUTg0oChO/Q2JbsbjPbN5qhRTtYe3f+Iw86k/9/+Bu:w0QRWoJEfg0oChGdJQbjPbNW5tYeP+GR
Malware Config
Extracted
Family
darkcomet
Botnet
Guest16
C2
89.230.228.93:100
Mutex
DC_MUTEX-F54S21D
Attributes
-
gencode
jmU3DkRL4vi9
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile iexplore.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" iexplore.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" iexplore.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile 0257dd258ba3c33ffa2b3c4beba993fd.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 0257dd258ba3c33ffa2b3c4beba993fd.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" 0257dd258ba3c33ffa2b3c4beba993fd.exe -
Modifies security service 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" 0257dd258ba3c33ffa2b3c4beba993fd.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" iexplore.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 0257dd258ba3c33ffa2b3c4beba993fd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 0257dd258ba3c33ffa2b3c4beba993fd.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 0257dd258ba3c33ffa2b3c4beba993fd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 0257dd258ba3c33ffa2b3c4beba993fd.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2332 set thread context of 4188 2332 0257dd258ba3c33ffa2b3c4beba993fd.exe 90 -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2332 0257dd258ba3c33ffa2b3c4beba993fd.exe Token: SeSecurityPrivilege 2332 0257dd258ba3c33ffa2b3c4beba993fd.exe Token: SeTakeOwnershipPrivilege 2332 0257dd258ba3c33ffa2b3c4beba993fd.exe Token: SeLoadDriverPrivilege 2332 0257dd258ba3c33ffa2b3c4beba993fd.exe Token: SeSystemProfilePrivilege 2332 0257dd258ba3c33ffa2b3c4beba993fd.exe Token: SeSystemtimePrivilege 2332 0257dd258ba3c33ffa2b3c4beba993fd.exe Token: SeProfSingleProcessPrivilege 2332 0257dd258ba3c33ffa2b3c4beba993fd.exe Token: SeIncBasePriorityPrivilege 2332 0257dd258ba3c33ffa2b3c4beba993fd.exe Token: SeCreatePagefilePrivilege 2332 0257dd258ba3c33ffa2b3c4beba993fd.exe Token: SeBackupPrivilege 2332 0257dd258ba3c33ffa2b3c4beba993fd.exe Token: SeRestorePrivilege 2332 0257dd258ba3c33ffa2b3c4beba993fd.exe Token: SeShutdownPrivilege 2332 0257dd258ba3c33ffa2b3c4beba993fd.exe Token: SeDebugPrivilege 2332 0257dd258ba3c33ffa2b3c4beba993fd.exe Token: SeSystemEnvironmentPrivilege 2332 0257dd258ba3c33ffa2b3c4beba993fd.exe Token: SeChangeNotifyPrivilege 2332 0257dd258ba3c33ffa2b3c4beba993fd.exe Token: SeRemoteShutdownPrivilege 2332 0257dd258ba3c33ffa2b3c4beba993fd.exe Token: SeUndockPrivilege 2332 0257dd258ba3c33ffa2b3c4beba993fd.exe Token: SeManageVolumePrivilege 2332 0257dd258ba3c33ffa2b3c4beba993fd.exe Token: SeImpersonatePrivilege 2332 0257dd258ba3c33ffa2b3c4beba993fd.exe Token: SeCreateGlobalPrivilege 2332 0257dd258ba3c33ffa2b3c4beba993fd.exe Token: 33 2332 0257dd258ba3c33ffa2b3c4beba993fd.exe Token: 34 2332 0257dd258ba3c33ffa2b3c4beba993fd.exe Token: 35 2332 0257dd258ba3c33ffa2b3c4beba993fd.exe Token: 36 2332 0257dd258ba3c33ffa2b3c4beba993fd.exe Token: SeIncreaseQuotaPrivilege 4188 iexplore.exe Token: SeSecurityPrivilege 4188 iexplore.exe Token: SeTakeOwnershipPrivilege 4188 iexplore.exe Token: SeLoadDriverPrivilege 4188 iexplore.exe Token: SeSystemProfilePrivilege 4188 iexplore.exe Token: SeSystemtimePrivilege 4188 iexplore.exe Token: SeProfSingleProcessPrivilege 4188 iexplore.exe Token: SeIncBasePriorityPrivilege 4188 iexplore.exe Token: SeCreatePagefilePrivilege 4188 iexplore.exe Token: SeBackupPrivilege 4188 iexplore.exe Token: SeRestorePrivilege 4188 iexplore.exe Token: SeShutdownPrivilege 4188 iexplore.exe Token: SeDebugPrivilege 4188 iexplore.exe Token: SeSystemEnvironmentPrivilege 4188 iexplore.exe Token: SeChangeNotifyPrivilege 4188 iexplore.exe Token: SeRemoteShutdownPrivilege 4188 iexplore.exe Token: SeUndockPrivilege 4188 iexplore.exe Token: SeManageVolumePrivilege 4188 iexplore.exe Token: SeImpersonatePrivilege 4188 iexplore.exe Token: SeCreateGlobalPrivilege 4188 iexplore.exe Token: 33 4188 iexplore.exe Token: 34 4188 iexplore.exe Token: 35 4188 iexplore.exe Token: 36 4188 iexplore.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2332 wrote to memory of 4188 2332 0257dd258ba3c33ffa2b3c4beba993fd.exe 90 PID 2332 wrote to memory of 4188 2332 0257dd258ba3c33ffa2b3c4beba993fd.exe 90 PID 2332 wrote to memory of 4188 2332 0257dd258ba3c33ffa2b3c4beba993fd.exe 90 PID 2332 wrote to memory of 4188 2332 0257dd258ba3c33ffa2b3c4beba993fd.exe 90 PID 2332 wrote to memory of 4188 2332 0257dd258ba3c33ffa2b3c4beba993fd.exe 90 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion 0257dd258ba3c33ffa2b3c4beba993fd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern 0257dd258ba3c33ffa2b3c4beba993fd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" 0257dd258ba3c33ffa2b3c4beba993fd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0257dd258ba3c33ffa2b3c4beba993fd.exe"C:\Users\Admin\AppData\Local\Temp\0257dd258ba3c33ffa2b3c4beba993fd.exe"1⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Windows security modification
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2332 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Suspicious use of AdjustPrivilegeToken
PID:4188
-