Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25-12-2023 15:02
Behavioral task
behavioral1
Sample
27b96be403685a34c41056fdbb6c6e09.exe
Resource
win7-20231215-en
General
-
Target
27b96be403685a34c41056fdbb6c6e09.exe
-
Size
756KB
-
MD5
27b96be403685a34c41056fdbb6c6e09
-
SHA1
6466daed5e5c6818a96324fcfb03333dd53a340e
-
SHA256
33b87e2b46562bfffedc7d6652f4c1574eb877ec8828900133856da2126817a6
-
SHA512
a66f27519cea93e0497de6eecb6c7266cf3db15a8f73e438d86bee6814a9f9534e9d2969e0591130ad7e3598b47d99baf92f1764208b8050cd8bf60084b8c38a
-
SSDEEP
12288:Y9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/hiW:MZ1xuVVjfFoynPaVBUR8f+kN10EB9
Malware Config
Extracted
darkcomet
Slave
jakescomet.no-ip.biz:1604
DC_MUTEX-36Z1G1Z
-
InstallPath
MSDCSC\msdcsc.exe
-
gencode
Ho1ZjXVvgkT0
-
install
true
-
offline_keylogger
true
-
persistence
false
-
reg_key
MicroUpdate
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
27b96be403685a34c41056fdbb6c6e09.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 27b96be403685a34c41056fdbb6c6e09.exe -
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
msdcsc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" msdcsc.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" msdcsc.exe -
Modifies security service 2 TTPs 1 IoCs
Processes:
msdcsc.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" msdcsc.exe -
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
msdcsc.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" msdcsc.exe -
Disables Task Manager via registry modification
-
Executes dropped EXE 1 IoCs
Processes:
msdcsc.exepid process 2388 msdcsc.exe -
Loads dropped DLL 2 IoCs
Processes:
27b96be403685a34c41056fdbb6c6e09.exepid process 3036 27b96be403685a34c41056fdbb6c6e09.exe 3036 27b96be403685a34c41056fdbb6c6e09.exe -
Processes:
msdcsc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" msdcsc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
27b96be403685a34c41056fdbb6c6e09.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicroUpdate = "C:\\Users\\Admin\\Documents\\MSDCSC\\msdcsc.exe" 27b96be403685a34c41056fdbb6c6e09.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
msdcsc.exepid process 2388 msdcsc.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
27b96be403685a34c41056fdbb6c6e09.exemsdcsc.exedescription pid process Token: SeIncreaseQuotaPrivilege 3036 27b96be403685a34c41056fdbb6c6e09.exe Token: SeSecurityPrivilege 3036 27b96be403685a34c41056fdbb6c6e09.exe Token: SeTakeOwnershipPrivilege 3036 27b96be403685a34c41056fdbb6c6e09.exe Token: SeLoadDriverPrivilege 3036 27b96be403685a34c41056fdbb6c6e09.exe Token: SeSystemProfilePrivilege 3036 27b96be403685a34c41056fdbb6c6e09.exe Token: SeSystemtimePrivilege 3036 27b96be403685a34c41056fdbb6c6e09.exe Token: SeProfSingleProcessPrivilege 3036 27b96be403685a34c41056fdbb6c6e09.exe Token: SeIncBasePriorityPrivilege 3036 27b96be403685a34c41056fdbb6c6e09.exe Token: SeCreatePagefilePrivilege 3036 27b96be403685a34c41056fdbb6c6e09.exe Token: SeBackupPrivilege 3036 27b96be403685a34c41056fdbb6c6e09.exe Token: SeRestorePrivilege 3036 27b96be403685a34c41056fdbb6c6e09.exe Token: SeShutdownPrivilege 3036 27b96be403685a34c41056fdbb6c6e09.exe Token: SeDebugPrivilege 3036 27b96be403685a34c41056fdbb6c6e09.exe Token: SeSystemEnvironmentPrivilege 3036 27b96be403685a34c41056fdbb6c6e09.exe Token: SeChangeNotifyPrivilege 3036 27b96be403685a34c41056fdbb6c6e09.exe Token: SeRemoteShutdownPrivilege 3036 27b96be403685a34c41056fdbb6c6e09.exe Token: SeUndockPrivilege 3036 27b96be403685a34c41056fdbb6c6e09.exe Token: SeManageVolumePrivilege 3036 27b96be403685a34c41056fdbb6c6e09.exe Token: SeImpersonatePrivilege 3036 27b96be403685a34c41056fdbb6c6e09.exe Token: SeCreateGlobalPrivilege 3036 27b96be403685a34c41056fdbb6c6e09.exe Token: 33 3036 27b96be403685a34c41056fdbb6c6e09.exe Token: 34 3036 27b96be403685a34c41056fdbb6c6e09.exe Token: 35 3036 27b96be403685a34c41056fdbb6c6e09.exe Token: SeIncreaseQuotaPrivilege 2388 msdcsc.exe Token: SeSecurityPrivilege 2388 msdcsc.exe Token: SeTakeOwnershipPrivilege 2388 msdcsc.exe Token: SeLoadDriverPrivilege 2388 msdcsc.exe Token: SeSystemProfilePrivilege 2388 msdcsc.exe Token: SeSystemtimePrivilege 2388 msdcsc.exe Token: SeProfSingleProcessPrivilege 2388 msdcsc.exe Token: SeIncBasePriorityPrivilege 2388 msdcsc.exe Token: SeCreatePagefilePrivilege 2388 msdcsc.exe Token: SeBackupPrivilege 2388 msdcsc.exe Token: SeRestorePrivilege 2388 msdcsc.exe Token: SeShutdownPrivilege 2388 msdcsc.exe Token: SeDebugPrivilege 2388 msdcsc.exe Token: SeSystemEnvironmentPrivilege 2388 msdcsc.exe Token: SeChangeNotifyPrivilege 2388 msdcsc.exe Token: SeRemoteShutdownPrivilege 2388 msdcsc.exe Token: SeUndockPrivilege 2388 msdcsc.exe Token: SeManageVolumePrivilege 2388 msdcsc.exe Token: SeImpersonatePrivilege 2388 msdcsc.exe Token: SeCreateGlobalPrivilege 2388 msdcsc.exe Token: 33 2388 msdcsc.exe Token: 34 2388 msdcsc.exe Token: 35 2388 msdcsc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
msdcsc.exepid process 2388 msdcsc.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
27b96be403685a34c41056fdbb6c6e09.exemsdcsc.exedescription pid process target process PID 3036 wrote to memory of 2388 3036 27b96be403685a34c41056fdbb6c6e09.exe msdcsc.exe PID 3036 wrote to memory of 2388 3036 27b96be403685a34c41056fdbb6c6e09.exe msdcsc.exe PID 3036 wrote to memory of 2388 3036 27b96be403685a34c41056fdbb6c6e09.exe msdcsc.exe PID 3036 wrote to memory of 2388 3036 27b96be403685a34c41056fdbb6c6e09.exe msdcsc.exe PID 2388 wrote to memory of 2836 2388 msdcsc.exe notepad.exe PID 2388 wrote to memory of 2836 2388 msdcsc.exe notepad.exe PID 2388 wrote to memory of 2836 2388 msdcsc.exe notepad.exe PID 2388 wrote to memory of 2836 2388 msdcsc.exe notepad.exe PID 2388 wrote to memory of 2836 2388 msdcsc.exe notepad.exe PID 2388 wrote to memory of 2836 2388 msdcsc.exe notepad.exe PID 2388 wrote to memory of 2836 2388 msdcsc.exe notepad.exe PID 2388 wrote to memory of 2836 2388 msdcsc.exe notepad.exe PID 2388 wrote to memory of 2836 2388 msdcsc.exe notepad.exe PID 2388 wrote to memory of 2836 2388 msdcsc.exe notepad.exe PID 2388 wrote to memory of 2836 2388 msdcsc.exe notepad.exe PID 2388 wrote to memory of 2836 2388 msdcsc.exe notepad.exe PID 2388 wrote to memory of 2836 2388 msdcsc.exe notepad.exe PID 2388 wrote to memory of 2836 2388 msdcsc.exe notepad.exe PID 2388 wrote to memory of 2836 2388 msdcsc.exe notepad.exe PID 2388 wrote to memory of 2836 2388 msdcsc.exe notepad.exe PID 2388 wrote to memory of 2836 2388 msdcsc.exe notepad.exe PID 2388 wrote to memory of 2836 2388 msdcsc.exe notepad.exe PID 2388 wrote to memory of 2836 2388 msdcsc.exe notepad.exe PID 2388 wrote to memory of 2836 2388 msdcsc.exe notepad.exe PID 2388 wrote to memory of 2836 2388 msdcsc.exe notepad.exe PID 2388 wrote to memory of 2836 2388 msdcsc.exe notepad.exe PID 2388 wrote to memory of 2836 2388 msdcsc.exe notepad.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
msdcsc.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion msdcsc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern msdcsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" msdcsc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\27b96be403685a34c41056fdbb6c6e09.exe"C:\Users\Admin\AppData\Local\Temp\27b96be403685a34c41056fdbb6c6e09.exe"1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"2⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\Documents\MSDCSC\msdcsc.exeFilesize
756KB
MD527b96be403685a34c41056fdbb6c6e09
SHA16466daed5e5c6818a96324fcfb03333dd53a340e
SHA25633b87e2b46562bfffedc7d6652f4c1574eb877ec8828900133856da2126817a6
SHA512a66f27519cea93e0497de6eecb6c7266cf3db15a8f73e438d86bee6814a9f9534e9d2969e0591130ad7e3598b47d99baf92f1764208b8050cd8bf60084b8c38a
-
memory/2388-55-0x0000000000400000-0x00000000004CA000-memory.dmpFilesize
808KB
-
memory/2388-59-0x0000000000400000-0x00000000004CA000-memory.dmpFilesize
808KB
-
memory/2388-49-0x0000000000400000-0x00000000004CA000-memory.dmpFilesize
808KB
-
memory/2388-50-0x0000000000400000-0x00000000004CA000-memory.dmpFilesize
808KB
-
memory/2388-58-0x0000000000400000-0x00000000004CA000-memory.dmpFilesize
808KB
-
memory/2388-46-0x0000000000400000-0x00000000004CA000-memory.dmpFilesize
808KB
-
memory/2388-47-0x0000000000400000-0x00000000004CA000-memory.dmpFilesize
808KB
-
memory/2388-48-0x0000000000400000-0x00000000004CA000-memory.dmpFilesize
808KB
-
memory/2388-57-0x0000000000400000-0x00000000004CA000-memory.dmpFilesize
808KB
-
memory/2388-11-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/2388-52-0x0000000000400000-0x00000000004CA000-memory.dmpFilesize
808KB
-
memory/2388-51-0x0000000000400000-0x00000000004CA000-memory.dmpFilesize
808KB
-
memory/2388-53-0x0000000000400000-0x00000000004CA000-memory.dmpFilesize
808KB
-
memory/2388-54-0x0000000000400000-0x00000000004CA000-memory.dmpFilesize
808KB
-
memory/2388-56-0x0000000000400000-0x00000000004CA000-memory.dmpFilesize
808KB
-
memory/2836-13-0x0000000000080000-0x0000000000081000-memory.dmpFilesize
4KB
-
memory/2836-44-0x00000000002D0000-0x00000000002D1000-memory.dmpFilesize
4KB
-
memory/3036-0-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/3036-45-0x0000000000400000-0x00000000004CA000-memory.dmpFilesize
808KB