Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30/10/2024, 01:09
Behavioral task
behavioral1
Sample
7f83e96df5105f1f717e1e34915bb5d3bd0f411fbd3f4fd75433dcfee1155ca4.exe
Resource
win7-20240903-en
General
-
Target
7f83e96df5105f1f717e1e34915bb5d3bd0f411fbd3f4fd75433dcfee1155ca4.exe
-
Size
3.9MB
-
MD5
e66a7cc714310b83718173d51cc496d5
-
SHA1
011e86f661c66ebd697bc915ea478f17d597a91b
-
SHA256
7f83e96df5105f1f717e1e34915bb5d3bd0f411fbd3f4fd75433dcfee1155ca4
-
SHA512
a49976acc39623ddac00d9611458de5fe66b1dda4ad3bc352902570edd619e04f52d8fd75c9be66d6c630dec1ab12bf3af191b24d2bd1336197db3f3ff66a78a
-
SSDEEP
98304:alX3KMj7yBNUVPhd5G0Z5DxdM3hZpmBAlB6D4tyX6kuT4IkQApCgvms0Cv05J5Cr:alX3KMj7yBNUVPhd5G0Z5DxdM3hZpmBr
Malware Config
Signatures
-
Darkcomet family
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate Soundcrd.exe -
Executes dropped EXE 3 IoCs
pid Process 2228 Soundcrd.exe 2656 Soundcrd.exe 2616 Soundcrd.exe -
Loads dropped DLL 7 IoCs
pid Process 2256 7f83e96df5105f1f717e1e34915bb5d3bd0f411fbd3f4fd75433dcfee1155ca4.exe 2256 7f83e96df5105f1f717e1e34915bb5d3bd0f411fbd3f4fd75433dcfee1155ca4.exe 2256 7f83e96df5105f1f717e1e34915bb5d3bd0f411fbd3f4fd75433dcfee1155ca4.exe 2256 7f83e96df5105f1f717e1e34915bb5d3bd0f411fbd3f4fd75433dcfee1155ca4.exe 2256 7f83e96df5105f1f717e1e34915bb5d3bd0f411fbd3f4fd75433dcfee1155ca4.exe 2228 Soundcrd.exe 2228 Soundcrd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\Mcrosoftt = "C:\\Users\\Admin\\AppData\\Roaming\\Soundcrd.exe" reg.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2228 set thread context of 2656 2228 Soundcrd.exe 34 PID 2228 set thread context of 2616 2228 Soundcrd.exe 35 -
resource yara_rule behavioral1/memory/2256-1-0x0000000000400000-0x00000000007EC000-memory.dmp upx behavioral1/files/0x0008000000016d33-27.dat upx behavioral1/memory/2256-46-0x0000000000400000-0x00000000007EC000-memory.dmp upx behavioral1/memory/2656-52-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2656-54-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2656-60-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2656-61-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2656-62-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2656-58-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2656-57-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2656-56-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2656-63-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2616-68-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2228-69-0x0000000000400000-0x00000000007EC000-memory.dmp upx behavioral1/memory/2616-67-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2616-66-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2616-64-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2656-72-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2616-74-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2656-77-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2656-81-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2656-85-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2656-89-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2656-93-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2656-97-0x0000000000400000-0x00000000004B5000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Soundcrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Soundcrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Soundcrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7f83e96df5105f1f717e1e34915bb5d3bd0f411fbd3f4fd75433dcfee1155ca4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Soundcrd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Soundcrd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier Soundcrd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier Soundcrd.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Soundcrd.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2656 Soundcrd.exe Token: SeSecurityPrivilege 2656 Soundcrd.exe Token: SeTakeOwnershipPrivilege 2656 Soundcrd.exe Token: SeLoadDriverPrivilege 2656 Soundcrd.exe Token: SeSystemProfilePrivilege 2656 Soundcrd.exe Token: SeSystemtimePrivilege 2656 Soundcrd.exe Token: SeProfSingleProcessPrivilege 2656 Soundcrd.exe Token: SeIncBasePriorityPrivilege 2656 Soundcrd.exe Token: SeCreatePagefilePrivilege 2656 Soundcrd.exe Token: SeBackupPrivilege 2656 Soundcrd.exe Token: SeRestorePrivilege 2656 Soundcrd.exe Token: SeShutdownPrivilege 2656 Soundcrd.exe Token: SeDebugPrivilege 2656 Soundcrd.exe Token: SeSystemEnvironmentPrivilege 2656 Soundcrd.exe Token: SeChangeNotifyPrivilege 2656 Soundcrd.exe Token: SeRemoteShutdownPrivilege 2656 Soundcrd.exe Token: SeUndockPrivilege 2656 Soundcrd.exe Token: SeManageVolumePrivilege 2656 Soundcrd.exe Token: SeImpersonatePrivilege 2656 Soundcrd.exe Token: SeCreateGlobalPrivilege 2656 Soundcrd.exe Token: 33 2656 Soundcrd.exe Token: 34 2656 Soundcrd.exe Token: 35 2656 Soundcrd.exe Token: SeDebugPrivilege 2616 Soundcrd.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2256 7f83e96df5105f1f717e1e34915bb5d3bd0f411fbd3f4fd75433dcfee1155ca4.exe 2228 Soundcrd.exe 2616 Soundcrd.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 2256 wrote to memory of 2808 2256 7f83e96df5105f1f717e1e34915bb5d3bd0f411fbd3f4fd75433dcfee1155ca4.exe 30 PID 2256 wrote to memory of 2808 2256 7f83e96df5105f1f717e1e34915bb5d3bd0f411fbd3f4fd75433dcfee1155ca4.exe 30 PID 2256 wrote to memory of 2808 2256 7f83e96df5105f1f717e1e34915bb5d3bd0f411fbd3f4fd75433dcfee1155ca4.exe 30 PID 2256 wrote to memory of 2808 2256 7f83e96df5105f1f717e1e34915bb5d3bd0f411fbd3f4fd75433dcfee1155ca4.exe 30 PID 2808 wrote to memory of 2824 2808 cmd.exe 32 PID 2808 wrote to memory of 2824 2808 cmd.exe 32 PID 2808 wrote to memory of 2824 2808 cmd.exe 32 PID 2808 wrote to memory of 2824 2808 cmd.exe 32 PID 2256 wrote to memory of 2228 2256 7f83e96df5105f1f717e1e34915bb5d3bd0f411fbd3f4fd75433dcfee1155ca4.exe 33 PID 2256 wrote to memory of 2228 2256 7f83e96df5105f1f717e1e34915bb5d3bd0f411fbd3f4fd75433dcfee1155ca4.exe 33 PID 2256 wrote to memory of 2228 2256 7f83e96df5105f1f717e1e34915bb5d3bd0f411fbd3f4fd75433dcfee1155ca4.exe 33 PID 2256 wrote to memory of 2228 2256 7f83e96df5105f1f717e1e34915bb5d3bd0f411fbd3f4fd75433dcfee1155ca4.exe 33 PID 2228 wrote to memory of 2656 2228 Soundcrd.exe 34 PID 2228 wrote to memory of 2656 2228 Soundcrd.exe 34 PID 2228 wrote to memory of 2656 2228 Soundcrd.exe 34 PID 2228 wrote to memory of 2656 2228 Soundcrd.exe 34 PID 2228 wrote to memory of 2656 2228 Soundcrd.exe 34 PID 2228 wrote to memory of 2656 2228 Soundcrd.exe 34 PID 2228 wrote to memory of 2656 2228 Soundcrd.exe 34 PID 2228 wrote to memory of 2656 2228 Soundcrd.exe 34 PID 2228 wrote to memory of 2656 2228 Soundcrd.exe 34 PID 2228 wrote to memory of 2616 2228 Soundcrd.exe 35 PID 2228 wrote to memory of 2616 2228 Soundcrd.exe 35 PID 2228 wrote to memory of 2616 2228 Soundcrd.exe 35 PID 2228 wrote to memory of 2616 2228 Soundcrd.exe 35 PID 2228 wrote to memory of 2616 2228 Soundcrd.exe 35 PID 2228 wrote to memory of 2616 2228 Soundcrd.exe 35 PID 2228 wrote to memory of 2616 2228 Soundcrd.exe 35 PID 2228 wrote to memory of 2616 2228 Soundcrd.exe 35 PID 2228 wrote to memory of 2616 2228 Soundcrd.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f83e96df5105f1f717e1e34915bb5d3bd0f411fbd3f4fd75433dcfee1155ca4.exe"C:\Users\Admin\AppData\Local\Temp\7f83e96df5105f1f717e1e34915bb5d3bd0f411fbd3f4fd75433dcfee1155ca4.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\kwjsU.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Mcrosoftt" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Soundcrd.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2824
-
-
-
C:\Users\Admin\AppData\Roaming\Soundcrd.exe"C:\Users\Admin\AppData\Roaming\Soundcrd.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Roaming\Soundcrd.exeC:\Users\Admin\AppData\Roaming\Soundcrd.exe3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:2656
-
-
C:\Users\Admin\AppData\Roaming\Soundcrd.exeC:\Users\Admin\AppData\Roaming\Soundcrd.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2616
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
139B
MD5173bcce4810d4901872d0ef4f0bfea4e
SHA1561b03fdfe68b6419fddf57f32e1aab9a6126a2f
SHA25610ea37eceabbe80fe9814280b66b957636951dbeeed18a9b4d50a1d24a6f1d1d
SHA5122401e0a5e3f7bf590a0767449da2249d09717e8c1cb71a7475e81d9615580001cfc38705cd1a5b4edc33f7df043bf195e28e4a5442a32bc879dffc6473bd545e
-
Filesize
3.9MB
MD558902cead4b4012c225ff79bb12519e5
SHA1b47ea162d27860fc44afd501f33c8cec53ad8077
SHA256c4c3ad44fd6899131440de1af4bde97c83b137a356f344d449c90af5a0f992ea
SHA5129d7d72b8e2148ce89b01f4616ca614c2e072e1c346f8dfaf313ff77d335c2ce6c4d6f9160c824dc9f82bca9b3dcf9abbac78fe2754dc5d5f7077cd58a736f81c