Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
05/11/2024, 01:04
Behavioral task
behavioral1
Sample
096ef0a7d06f08738b38369ebbfe928e318a489ec3966c16443e85943d8d7035N.exe
Resource
win7-20241010-en
General
-
Target
096ef0a7d06f08738b38369ebbfe928e318a489ec3966c16443e85943d8d7035N.exe
-
Size
3.9MB
-
MD5
dc2cb40dc4d9683db4305a8a560d6400
-
SHA1
6521f5fcb647781512eb53dee8be9f37e354b53c
-
SHA256
096ef0a7d06f08738b38369ebbfe928e318a489ec3966c16443e85943d8d7035
-
SHA512
cf9654d56df81663b26b6b5912b13894be429b8e59b81d25f0f9ef3463a3bb20c715e631fce984eff6478ee52344ed62a12990dae87193ecc1dacd47d1970cfc
-
SSDEEP
98304:alX3KMj7yBNUVPhd5G0Z5DxdM3hZpmBAlB6D4tyX6kuT4IkQApCgvms0Cv05J5CV:alX3KMj7yBNUVPhd5G0Z5DxdM3hZpmBV
Malware Config
Signatures
-
Darkcomet family
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate Soundcrd.exe -
Executes dropped EXE 3 IoCs
pid Process 2660 Soundcrd.exe 2628 Soundcrd.exe 2704 Soundcrd.exe -
Loads dropped DLL 7 IoCs
pid Process 2224 096ef0a7d06f08738b38369ebbfe928e318a489ec3966c16443e85943d8d7035N.exe 2224 096ef0a7d06f08738b38369ebbfe928e318a489ec3966c16443e85943d8d7035N.exe 2224 096ef0a7d06f08738b38369ebbfe928e318a489ec3966c16443e85943d8d7035N.exe 2224 096ef0a7d06f08738b38369ebbfe928e318a489ec3966c16443e85943d8d7035N.exe 2224 096ef0a7d06f08738b38369ebbfe928e318a489ec3966c16443e85943d8d7035N.exe 2660 Soundcrd.exe 2660 Soundcrd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\Mcrosoftt = "C:\\Users\\Admin\\AppData\\Roaming\\Soundcrd.exe" reg.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2660 set thread context of 2628 2660 Soundcrd.exe 35 PID 2660 set thread context of 2704 2660 Soundcrd.exe 36 -
resource yara_rule behavioral1/memory/2224-2-0x0000000000400000-0x00000000007EC000-memory.dmp upx behavioral1/files/0x0009000000018bdd-27.dat upx behavioral1/memory/2704-59-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2628-50-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2224-49-0x0000000000400000-0x00000000007EC000-memory.dmp upx behavioral1/memory/2628-62-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2660-60-0x0000000000400000-0x00000000007EC000-memory.dmp upx behavioral1/memory/2628-63-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2704-58-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2628-65-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2628-64-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2628-56-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2704-54-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2660-52-0x0000000000400000-0x00000000007EC000-memory.dmp upx behavioral1/memory/2628-68-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2628-69-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2628-70-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2704-71-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral1/memory/2628-72-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2628-77-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2628-81-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2628-85-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2628-89-0x0000000000400000-0x00000000004B5000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 096ef0a7d06f08738b38369ebbfe928e318a489ec3966c16443e85943d8d7035N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Soundcrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Soundcrd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Soundcrd.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Soundcrd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Soundcrd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier Soundcrd.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier Soundcrd.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Soundcrd.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeDebugPrivilege 2704 Soundcrd.exe Token: SeIncreaseQuotaPrivilege 2628 Soundcrd.exe Token: SeSecurityPrivilege 2628 Soundcrd.exe Token: SeTakeOwnershipPrivilege 2628 Soundcrd.exe Token: SeLoadDriverPrivilege 2628 Soundcrd.exe Token: SeSystemProfilePrivilege 2628 Soundcrd.exe Token: SeSystemtimePrivilege 2628 Soundcrd.exe Token: SeProfSingleProcessPrivilege 2628 Soundcrd.exe Token: SeIncBasePriorityPrivilege 2628 Soundcrd.exe Token: SeCreatePagefilePrivilege 2628 Soundcrd.exe Token: SeBackupPrivilege 2628 Soundcrd.exe Token: SeRestorePrivilege 2628 Soundcrd.exe Token: SeShutdownPrivilege 2628 Soundcrd.exe Token: SeDebugPrivilege 2628 Soundcrd.exe Token: SeSystemEnvironmentPrivilege 2628 Soundcrd.exe Token: SeChangeNotifyPrivilege 2628 Soundcrd.exe Token: SeRemoteShutdownPrivilege 2628 Soundcrd.exe Token: SeUndockPrivilege 2628 Soundcrd.exe Token: SeManageVolumePrivilege 2628 Soundcrd.exe Token: SeImpersonatePrivilege 2628 Soundcrd.exe Token: SeCreateGlobalPrivilege 2628 Soundcrd.exe Token: 33 2628 Soundcrd.exe Token: 34 2628 Soundcrd.exe Token: 35 2628 Soundcrd.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2224 096ef0a7d06f08738b38369ebbfe928e318a489ec3966c16443e85943d8d7035N.exe 2660 Soundcrd.exe 2704 Soundcrd.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 2224 wrote to memory of 2784 2224 096ef0a7d06f08738b38369ebbfe928e318a489ec3966c16443e85943d8d7035N.exe 31 PID 2224 wrote to memory of 2784 2224 096ef0a7d06f08738b38369ebbfe928e318a489ec3966c16443e85943d8d7035N.exe 31 PID 2224 wrote to memory of 2784 2224 096ef0a7d06f08738b38369ebbfe928e318a489ec3966c16443e85943d8d7035N.exe 31 PID 2224 wrote to memory of 2784 2224 096ef0a7d06f08738b38369ebbfe928e318a489ec3966c16443e85943d8d7035N.exe 31 PID 2784 wrote to memory of 2936 2784 cmd.exe 33 PID 2784 wrote to memory of 2936 2784 cmd.exe 33 PID 2784 wrote to memory of 2936 2784 cmd.exe 33 PID 2784 wrote to memory of 2936 2784 cmd.exe 33 PID 2224 wrote to memory of 2660 2224 096ef0a7d06f08738b38369ebbfe928e318a489ec3966c16443e85943d8d7035N.exe 34 PID 2224 wrote to memory of 2660 2224 096ef0a7d06f08738b38369ebbfe928e318a489ec3966c16443e85943d8d7035N.exe 34 PID 2224 wrote to memory of 2660 2224 096ef0a7d06f08738b38369ebbfe928e318a489ec3966c16443e85943d8d7035N.exe 34 PID 2224 wrote to memory of 2660 2224 096ef0a7d06f08738b38369ebbfe928e318a489ec3966c16443e85943d8d7035N.exe 34 PID 2660 wrote to memory of 2628 2660 Soundcrd.exe 35 PID 2660 wrote to memory of 2628 2660 Soundcrd.exe 35 PID 2660 wrote to memory of 2628 2660 Soundcrd.exe 35 PID 2660 wrote to memory of 2628 2660 Soundcrd.exe 35 PID 2660 wrote to memory of 2628 2660 Soundcrd.exe 35 PID 2660 wrote to memory of 2628 2660 Soundcrd.exe 35 PID 2660 wrote to memory of 2628 2660 Soundcrd.exe 35 PID 2660 wrote to memory of 2628 2660 Soundcrd.exe 35 PID 2660 wrote to memory of 2628 2660 Soundcrd.exe 35 PID 2660 wrote to memory of 2704 2660 Soundcrd.exe 36 PID 2660 wrote to memory of 2704 2660 Soundcrd.exe 36 PID 2660 wrote to memory of 2704 2660 Soundcrd.exe 36 PID 2660 wrote to memory of 2704 2660 Soundcrd.exe 36 PID 2660 wrote to memory of 2704 2660 Soundcrd.exe 36 PID 2660 wrote to memory of 2704 2660 Soundcrd.exe 36 PID 2660 wrote to memory of 2704 2660 Soundcrd.exe 36 PID 2660 wrote to memory of 2704 2660 Soundcrd.exe 36 PID 2660 wrote to memory of 2704 2660 Soundcrd.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\096ef0a7d06f08738b38369ebbfe928e318a489ec3966c16443e85943d8d7035N.exe"C:\Users\Admin\AppData\Local\Temp\096ef0a7d06f08738b38369ebbfe928e318a489ec3966c16443e85943d8d7035N.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\NlMwk.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Mcrosoftt" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Soundcrd.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2936
-
-
-
C:\Users\Admin\AppData\Roaming\Soundcrd.exe"C:\Users\Admin\AppData\Roaming\Soundcrd.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Roaming\Soundcrd.exeC:\Users\Admin\AppData\Roaming\Soundcrd.exe3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:2628
-
-
C:\Users\Admin\AppData\Roaming\Soundcrd.exeC:\Users\Admin\AppData\Roaming\Soundcrd.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2704
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
139B
MD5173bcce4810d4901872d0ef4f0bfea4e
SHA1561b03fdfe68b6419fddf57f32e1aab9a6126a2f
SHA25610ea37eceabbe80fe9814280b66b957636951dbeeed18a9b4d50a1d24a6f1d1d
SHA5122401e0a5e3f7bf590a0767449da2249d09717e8c1cb71a7475e81d9615580001cfc38705cd1a5b4edc33f7df043bf195e28e4a5442a32bc879dffc6473bd545e
-
Filesize
3.9MB
MD5f05d272bae9f5a70e46a6e4b64b84acc
SHA1d049a39b75f346a7ca0732d6921478bf2b03a7c1
SHA25635ba5eba10f5cd114433a20231d4fc4807a41c2e6ec9a13359ddeb8c245a283a
SHA512b2071a9b3625cca009247febb3dcf24aab5e77f5b696e4160ac706166abe0934325648f8a03ca4d8fcbf393639d26351d7df89424ed6f5017a2503b7f4e1b059