Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    7s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/12/2023, 01:56

General

  • Target

    238df395c33b4b139cdfcd48a871b759.exe

  • Size

    911KB

  • MD5

    238df395c33b4b139cdfcd48a871b759

  • SHA1

    b83cb7d627cdcf46a6ed89f68644ef5f2d9ed20f

  • SHA256

    97e81fe572b0b43a79a678e04d1ec5f1c11243087e73708d0a1486eb3cc657ff

  • SHA512

    be3654267d03d6f822497b52e34f3e77bd508d797d7184541528ae893f6784ffa754f040b1cfb46db79a1a9c43e097ca2228d6c180d189886aecc9aede65a8b4

  • SSDEEP

    12288:d8UaT9XY2siA0bMG09xD7I3Gg8ecgVvfBoCDBOQQYbVXpuy1r/f:uUKoN0bUxgGa/pfBHDb+y1L

Malware Config

Signatures

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\238df395c33b4b139cdfcd48a871b759.exe
    "C:\Users\Admin\AppData\Local\Temp\238df395c33b4b139cdfcd48a871b759.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Adds Run key to start application
    • Suspicious use of AdjustPrivilegeToken
    PID:2888
    • C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
      "C:\Users\Admin\Documents\MSDCSC\msdcsc.exe"
      2⤵
        PID:2168
    • C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
      1⤵
        PID:2980

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2168-18-0x0000000000400000-0x00000000004E5000-memory.dmp

        Filesize

        916KB

      • memory/2168-16-0x0000000000700000-0x0000000000701000-memory.dmp

        Filesize

        4KB

      • memory/2168-15-0x0000000000400000-0x00000000004E5000-memory.dmp

        Filesize

        916KB

      • memory/2888-0-0x0000000000400000-0x00000000004E5000-memory.dmp

        Filesize

        916KB

      • memory/2888-1-0x0000000000750000-0x0000000000751000-memory.dmp

        Filesize

        4KB

      • memory/2888-14-0x0000000000400000-0x00000000004E5000-memory.dmp

        Filesize

        916KB