Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/11/2024, 22:34
Behavioral task
behavioral1
Sample
54d79a24b7e7d3fc30b355f6ae0673a2821b779e47fc0a25eafe9ac1376b4aad.exe
Resource
win7-20240903-en
General
-
Target
54d79a24b7e7d3fc30b355f6ae0673a2821b779e47fc0a25eafe9ac1376b4aad.exe
-
Size
576KB
-
MD5
005fff98861d685b2128155a51b944bd
-
SHA1
102c0b1475775255bd3181723a831bb470209c9f
-
SHA256
54d79a24b7e7d3fc30b355f6ae0673a2821b779e47fc0a25eafe9ac1376b4aad
-
SHA512
f4dcfd2be5eb66d7029c3358ccc5dfe7d0c74720b6ac1aaff7c9986e4e716899636a977d036d9c38cdcaf5fb6c40461b506b17d65c527f375c7202c8d98095db
-
SSDEEP
12288:+NWPkHlUkErBuxQ4uzi6d6dL/yiXLzeMdK6io8levy0FhVlpzkzDDoSw:+NWPkHlUfBgpuPdWzyuDTifgyWlt
Malware Config
Signatures
-
Darkcomet family
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate mcsft.exe -
Executes dropped EXE 2 IoCs
pid Process 2752 mcsft.exe 2688 mcsft.exe -
Loads dropped DLL 6 IoCs
pid Process 3044 54d79a24b7e7d3fc30b355f6ae0673a2821b779e47fc0a25eafe9ac1376b4aad.exe 3044 54d79a24b7e7d3fc30b355f6ae0673a2821b779e47fc0a25eafe9ac1376b4aad.exe 3044 54d79a24b7e7d3fc30b355f6ae0673a2821b779e47fc0a25eafe9ac1376b4aad.exe 3044 54d79a24b7e7d3fc30b355f6ae0673a2821b779e47fc0a25eafe9ac1376b4aad.exe 3044 54d79a24b7e7d3fc30b355f6ae0673a2821b779e47fc0a25eafe9ac1376b4aad.exe 2752 mcsft.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Mcrosoft = "C:\\Users\\Admin\\AppData\\Roaming\\mcsft.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2752 set thread context of 2688 2752 mcsft.exe 34 -
resource yara_rule behavioral1/memory/3044-0-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral1/files/0x000800000001878c-27.dat upx behavioral1/memory/2752-47-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral1/memory/3044-49-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral1/memory/2688-57-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2688-56-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2688-54-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2752-59-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral1/memory/2688-61-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2688-62-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2688-60-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2688-63-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2688-66-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2688-65-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2688-64-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2688-67-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2688-68-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2688-69-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2688-70-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2688-71-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2688-72-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2688-73-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2688-74-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2688-75-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2688-76-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2688-77-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2688-78-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2688-79-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2688-80-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2688-81-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2688-82-0x0000000000400000-0x00000000004B5000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54d79a24b7e7d3fc30b355f6ae0673a2821b779e47fc0a25eafe9ac1376b4aad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mcsft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mcsft.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier mcsft.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier mcsft.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2688 mcsft.exe Token: SeSecurityPrivilege 2688 mcsft.exe Token: SeTakeOwnershipPrivilege 2688 mcsft.exe Token: SeLoadDriverPrivilege 2688 mcsft.exe Token: SeSystemProfilePrivilege 2688 mcsft.exe Token: SeSystemtimePrivilege 2688 mcsft.exe Token: SeProfSingleProcessPrivilege 2688 mcsft.exe Token: SeIncBasePriorityPrivilege 2688 mcsft.exe Token: SeCreatePagefilePrivilege 2688 mcsft.exe Token: SeBackupPrivilege 2688 mcsft.exe Token: SeRestorePrivilege 2688 mcsft.exe Token: SeShutdownPrivilege 2688 mcsft.exe Token: SeDebugPrivilege 2688 mcsft.exe Token: SeSystemEnvironmentPrivilege 2688 mcsft.exe Token: SeChangeNotifyPrivilege 2688 mcsft.exe Token: SeRemoteShutdownPrivilege 2688 mcsft.exe Token: SeUndockPrivilege 2688 mcsft.exe Token: SeManageVolumePrivilege 2688 mcsft.exe Token: SeImpersonatePrivilege 2688 mcsft.exe Token: SeCreateGlobalPrivilege 2688 mcsft.exe Token: 33 2688 mcsft.exe Token: 34 2688 mcsft.exe Token: 35 2688 mcsft.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3044 54d79a24b7e7d3fc30b355f6ae0673a2821b779e47fc0a25eafe9ac1376b4aad.exe 2752 mcsft.exe 2688 mcsft.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 3044 wrote to memory of 2924 3044 54d79a24b7e7d3fc30b355f6ae0673a2821b779e47fc0a25eafe9ac1376b4aad.exe 30 PID 3044 wrote to memory of 2924 3044 54d79a24b7e7d3fc30b355f6ae0673a2821b779e47fc0a25eafe9ac1376b4aad.exe 30 PID 3044 wrote to memory of 2924 3044 54d79a24b7e7d3fc30b355f6ae0673a2821b779e47fc0a25eafe9ac1376b4aad.exe 30 PID 3044 wrote to memory of 2924 3044 54d79a24b7e7d3fc30b355f6ae0673a2821b779e47fc0a25eafe9ac1376b4aad.exe 30 PID 2924 wrote to memory of 1848 2924 cmd.exe 32 PID 2924 wrote to memory of 1848 2924 cmd.exe 32 PID 2924 wrote to memory of 1848 2924 cmd.exe 32 PID 2924 wrote to memory of 1848 2924 cmd.exe 32 PID 3044 wrote to memory of 2752 3044 54d79a24b7e7d3fc30b355f6ae0673a2821b779e47fc0a25eafe9ac1376b4aad.exe 33 PID 3044 wrote to memory of 2752 3044 54d79a24b7e7d3fc30b355f6ae0673a2821b779e47fc0a25eafe9ac1376b4aad.exe 33 PID 3044 wrote to memory of 2752 3044 54d79a24b7e7d3fc30b355f6ae0673a2821b779e47fc0a25eafe9ac1376b4aad.exe 33 PID 3044 wrote to memory of 2752 3044 54d79a24b7e7d3fc30b355f6ae0673a2821b779e47fc0a25eafe9ac1376b4aad.exe 33 PID 2752 wrote to memory of 2688 2752 mcsft.exe 34 PID 2752 wrote to memory of 2688 2752 mcsft.exe 34 PID 2752 wrote to memory of 2688 2752 mcsft.exe 34 PID 2752 wrote to memory of 2688 2752 mcsft.exe 34 PID 2752 wrote to memory of 2688 2752 mcsft.exe 34 PID 2752 wrote to memory of 2688 2752 mcsft.exe 34 PID 2752 wrote to memory of 2688 2752 mcsft.exe 34 PID 2752 wrote to memory of 2688 2752 mcsft.exe 34 PID 2752 wrote to memory of 2688 2752 mcsft.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\54d79a24b7e7d3fc30b355f6ae0673a2821b779e47fc0a25eafe9ac1376b4aad.exe"C:\Users\Admin\AppData\Local\Temp\54d79a24b7e7d3fc30b355f6ae0673a2821b779e47fc0a25eafe9ac1376b4aad.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\uLwkq.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Mcrosoft" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\mcsft.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1848
-
-
-
C:\Users\Admin\AppData\Roaming\mcsft.exe"C:\Users\Admin\AppData\Roaming\mcsft.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Roaming\mcsft.exeC:\Users\Admin\AppData\Roaming\mcsft.exe3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2688
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135B
MD5a5feca573884d76f559b996d45e8ad9a
SHA10e81a993f3af4e31d60653dc2513186f0495f1c8
SHA256c98e20d46d6465febb5d29cfab51241521ea5d6cd621f5e18b9b7d6fbfac3f0f
SHA512a9239648b5f15eac4d4151b6e1bdc81065eeaeb101404c2a0126f03bc87f1e6a57206bfa07a44379e9d3bba889e4497a9991ff41fb109099b01512df3dc3cbda
-
Filesize
576KB
MD5c819d764e34080a55a2a8ba2f2321b2c
SHA1f3baee156616d68579152a2799260568ca645e5a
SHA256350d8a69157e89ba4b99ad596ea619b97dd843ee90eae2ebffdb12d70025f84d
SHA5122e7789c0b3d09a592abdd8e00f7fb0c5e27cb818cc6a10d4291d5eb01a626b20771374806f27f16cbe1aed8bb5f9128424e8040756c8f41882547d68901117ed