Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2024, 19:49
Behavioral task
behavioral1
Sample
24ffc54781f9737d530037e3ad2239c4823955dc00ce8e67b2c29195b7c972c1N.exe
Resource
win7-20241010-en
General
-
Target
24ffc54781f9737d530037e3ad2239c4823955dc00ce8e67b2c29195b7c972c1N.exe
-
Size
3.8MB
-
MD5
e5fc9720f9fa2b5b22c86e2ca5b672f0
-
SHA1
01b06521fd81f34084865f9ad0f71df1288f7f91
-
SHA256
24ffc54781f9737d530037e3ad2239c4823955dc00ce8e67b2c29195b7c972c1
-
SHA512
bf6c70f41289b381d9846f74a72b9daf7ca4bb4e5c21cd6fdc2cee9fd9a277a550bf66a7b705b519725129d905e3bcd9bc6b2d52ff6265075c614cdcdb3806cd
-
SSDEEP
98304:3i4hTLOMtHDMlANqnfVGPyhcMYg4lSiSLCQrdGLcjFjj/eWKS5h7EleIljztU/qk:3i4hTLOMtHDMlANqnfVGPyhcMYg4lSi6
Malware Config
Signatures
-
Darkcomet family
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate mcsft.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation 24ffc54781f9737d530037e3ad2239c4823955dc00ce8e67b2c29195b7c972c1N.exe -
Executes dropped EXE 2 IoCs
pid Process 2744 mcsft.exe 2892 mcsft.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Mcrosoft = "C:\\Users\\Admin\\AppData\\Roaming\\mcsft.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2744 set thread context of 2892 2744 mcsft.exe 91 -
resource yara_rule behavioral2/memory/1856-0-0x0000000000400000-0x00000000007C9000-memory.dmp upx behavioral2/files/0x000b000000023b8e-16.dat upx behavioral2/memory/2744-29-0x0000000000400000-0x00000000007C9000-memory.dmp upx behavioral2/memory/1856-28-0x0000000000400000-0x00000000007C9000-memory.dmp upx behavioral2/memory/2892-32-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2892-35-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2892-36-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2892-37-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2892-38-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2892-40-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2892-44-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2892-43-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2892-42-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2892-41-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2744-39-0x0000000000400000-0x00000000007C9000-memory.dmp upx behavioral2/memory/2892-45-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2892-46-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2892-47-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2892-48-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2892-49-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2892-50-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2892-51-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2892-52-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2892-53-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2892-54-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2892-55-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2892-56-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2892-57-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/2892-58-0x0000000000400000-0x00000000004B5000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24ffc54781f9737d530037e3ad2239c4823955dc00ce8e67b2c29195b7c972c1N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mcsft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mcsft.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier mcsft.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier mcsft.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2892 mcsft.exe Token: SeSecurityPrivilege 2892 mcsft.exe Token: SeTakeOwnershipPrivilege 2892 mcsft.exe Token: SeLoadDriverPrivilege 2892 mcsft.exe Token: SeSystemProfilePrivilege 2892 mcsft.exe Token: SeSystemtimePrivilege 2892 mcsft.exe Token: SeProfSingleProcessPrivilege 2892 mcsft.exe Token: SeIncBasePriorityPrivilege 2892 mcsft.exe Token: SeCreatePagefilePrivilege 2892 mcsft.exe Token: SeBackupPrivilege 2892 mcsft.exe Token: SeRestorePrivilege 2892 mcsft.exe Token: SeShutdownPrivilege 2892 mcsft.exe Token: SeDebugPrivilege 2892 mcsft.exe Token: SeSystemEnvironmentPrivilege 2892 mcsft.exe Token: SeChangeNotifyPrivilege 2892 mcsft.exe Token: SeRemoteShutdownPrivilege 2892 mcsft.exe Token: SeUndockPrivilege 2892 mcsft.exe Token: SeManageVolumePrivilege 2892 mcsft.exe Token: SeImpersonatePrivilege 2892 mcsft.exe Token: SeCreateGlobalPrivilege 2892 mcsft.exe Token: 33 2892 mcsft.exe Token: 34 2892 mcsft.exe Token: 35 2892 mcsft.exe Token: 36 2892 mcsft.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1856 24ffc54781f9737d530037e3ad2239c4823955dc00ce8e67b2c29195b7c972c1N.exe 2744 mcsft.exe 2892 mcsft.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1856 wrote to memory of 1872 1856 24ffc54781f9737d530037e3ad2239c4823955dc00ce8e67b2c29195b7c972c1N.exe 86 PID 1856 wrote to memory of 1872 1856 24ffc54781f9737d530037e3ad2239c4823955dc00ce8e67b2c29195b7c972c1N.exe 86 PID 1856 wrote to memory of 1872 1856 24ffc54781f9737d530037e3ad2239c4823955dc00ce8e67b2c29195b7c972c1N.exe 86 PID 1872 wrote to memory of 3644 1872 cmd.exe 89 PID 1872 wrote to memory of 3644 1872 cmd.exe 89 PID 1872 wrote to memory of 3644 1872 cmd.exe 89 PID 1856 wrote to memory of 2744 1856 24ffc54781f9737d530037e3ad2239c4823955dc00ce8e67b2c29195b7c972c1N.exe 90 PID 1856 wrote to memory of 2744 1856 24ffc54781f9737d530037e3ad2239c4823955dc00ce8e67b2c29195b7c972c1N.exe 90 PID 1856 wrote to memory of 2744 1856 24ffc54781f9737d530037e3ad2239c4823955dc00ce8e67b2c29195b7c972c1N.exe 90 PID 2744 wrote to memory of 2892 2744 mcsft.exe 91 PID 2744 wrote to memory of 2892 2744 mcsft.exe 91 PID 2744 wrote to memory of 2892 2744 mcsft.exe 91 PID 2744 wrote to memory of 2892 2744 mcsft.exe 91 PID 2744 wrote to memory of 2892 2744 mcsft.exe 91 PID 2744 wrote to memory of 2892 2744 mcsft.exe 91 PID 2744 wrote to memory of 2892 2744 mcsft.exe 91 PID 2744 wrote to memory of 2892 2744 mcsft.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\24ffc54781f9737d530037e3ad2239c4823955dc00ce8e67b2c29195b7c972c1N.exe"C:\Users\Admin\AppData\Local\Temp\24ffc54781f9737d530037e3ad2239c4823955dc00ce8e67b2c29195b7c972c1N.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kdVBA.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Mcrosoft" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\mcsft.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3644
-
-
-
C:\Users\Admin\AppData\Roaming\mcsft.exe"C:\Users\Admin\AppData\Roaming\mcsft.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Roaming\mcsft.exeC:\Users\Admin\AppData\Roaming\mcsft.exe3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2892
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135B
MD5a5feca573884d76f559b996d45e8ad9a
SHA10e81a993f3af4e31d60653dc2513186f0495f1c8
SHA256c98e20d46d6465febb5d29cfab51241521ea5d6cd621f5e18b9b7d6fbfac3f0f
SHA512a9239648b5f15eac4d4151b6e1bdc81065eeaeb101404c2a0126f03bc87f1e6a57206bfa07a44379e9d3bba889e4497a9991ff41fb109099b01512df3dc3cbda
-
Filesize
3.8MB
MD53f3f03af8ef2f0b2874d899fc660b880
SHA1bac5ccabbb282ce7815ab57d7000f049ca53e947
SHA256d912d9c53db3fd86adc7ca6ea542184d2813959468f949992bde0752778eb832
SHA512fdb4df470b2cc4600673236398f4d0e66e0074f8f9e41c5d6af07b344816b19a948e98af6f907ce775a25fd74020c6bed77e8f9f4c5a8d88dcf6228109081091