Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25/11/2024, 04:46
Behavioral task
behavioral1
Sample
df56f0c9d0007f5125d92cfd481e21760d41eb10a92009ce1ab6d5da01140687.exe
Resource
win7-20240708-en
General
-
Target
df56f0c9d0007f5125d92cfd481e21760d41eb10a92009ce1ab6d5da01140687.exe
-
Size
576KB
-
MD5
6385129ecaf875fa5b4a1d0b2a4a4a34
-
SHA1
bc93685b3334d8a007344e7e330dd6550322febd
-
SHA256
df56f0c9d0007f5125d92cfd481e21760d41eb10a92009ce1ab6d5da01140687
-
SHA512
dab9ffd159b7413630302ae050d5a50b4340075a1d34e005d86373a42b60e09c2ba63197e8d4c1d824b8ccad2a29b41b72e3c30e337918aa0c2fe610f4e609f3
-
SSDEEP
12288:+NWPkHlUkErBuxQ4uzi6d6dL/yiXLzeMdK6io8levy0FhVlpzkzDDoS5:+NWPkHlUfBgpuPdWzyuDTifgyWlw
Malware Config
Signatures
-
Darkcomet family
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate mcsft.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation df56f0c9d0007f5125d92cfd481e21760d41eb10a92009ce1ab6d5da01140687.exe -
Executes dropped EXE 2 IoCs
pid Process 3616 mcsft.exe 3984 mcsft.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Mcrosoft = "C:\\Users\\Admin\\AppData\\Roaming\\mcsft.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3616 set thread context of 3984 3616 mcsft.exe 88 -
resource yara_rule behavioral2/memory/4580-0-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral2/files/0x0008000000023c65-16.dat upx behavioral2/memory/4580-29-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral2/memory/3616-30-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral2/memory/3984-35-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3984-36-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3616-38-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral2/memory/3984-33-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3984-40-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3984-39-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3984-41-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3984-45-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3984-43-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3984-44-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3984-42-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3984-46-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3984-47-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3984-48-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3984-49-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3984-50-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3984-51-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3984-52-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3984-53-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3984-54-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3984-55-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3984-56-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3984-57-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3984-58-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3984-59-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3984-60-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3984-61-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3984-62-0x0000000000400000-0x00000000004B5000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language df56f0c9d0007f5125d92cfd481e21760d41eb10a92009ce1ab6d5da01140687.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mcsft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mcsft.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier mcsft.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier mcsft.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3984 mcsft.exe Token: SeSecurityPrivilege 3984 mcsft.exe Token: SeTakeOwnershipPrivilege 3984 mcsft.exe Token: SeLoadDriverPrivilege 3984 mcsft.exe Token: SeSystemProfilePrivilege 3984 mcsft.exe Token: SeSystemtimePrivilege 3984 mcsft.exe Token: SeProfSingleProcessPrivilege 3984 mcsft.exe Token: SeIncBasePriorityPrivilege 3984 mcsft.exe Token: SeCreatePagefilePrivilege 3984 mcsft.exe Token: SeBackupPrivilege 3984 mcsft.exe Token: SeRestorePrivilege 3984 mcsft.exe Token: SeShutdownPrivilege 3984 mcsft.exe Token: SeDebugPrivilege 3984 mcsft.exe Token: SeSystemEnvironmentPrivilege 3984 mcsft.exe Token: SeChangeNotifyPrivilege 3984 mcsft.exe Token: SeRemoteShutdownPrivilege 3984 mcsft.exe Token: SeUndockPrivilege 3984 mcsft.exe Token: SeManageVolumePrivilege 3984 mcsft.exe Token: SeImpersonatePrivilege 3984 mcsft.exe Token: SeCreateGlobalPrivilege 3984 mcsft.exe Token: 33 3984 mcsft.exe Token: 34 3984 mcsft.exe Token: 35 3984 mcsft.exe Token: 36 3984 mcsft.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4580 df56f0c9d0007f5125d92cfd481e21760d41eb10a92009ce1ab6d5da01140687.exe 3616 mcsft.exe 3984 mcsft.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 4580 wrote to memory of 2196 4580 df56f0c9d0007f5125d92cfd481e21760d41eb10a92009ce1ab6d5da01140687.exe 83 PID 4580 wrote to memory of 2196 4580 df56f0c9d0007f5125d92cfd481e21760d41eb10a92009ce1ab6d5da01140687.exe 83 PID 4580 wrote to memory of 2196 4580 df56f0c9d0007f5125d92cfd481e21760d41eb10a92009ce1ab6d5da01140687.exe 83 PID 2196 wrote to memory of 4876 2196 cmd.exe 86 PID 2196 wrote to memory of 4876 2196 cmd.exe 86 PID 2196 wrote to memory of 4876 2196 cmd.exe 86 PID 4580 wrote to memory of 3616 4580 df56f0c9d0007f5125d92cfd481e21760d41eb10a92009ce1ab6d5da01140687.exe 87 PID 4580 wrote to memory of 3616 4580 df56f0c9d0007f5125d92cfd481e21760d41eb10a92009ce1ab6d5da01140687.exe 87 PID 4580 wrote to memory of 3616 4580 df56f0c9d0007f5125d92cfd481e21760d41eb10a92009ce1ab6d5da01140687.exe 87 PID 3616 wrote to memory of 3984 3616 mcsft.exe 88 PID 3616 wrote to memory of 3984 3616 mcsft.exe 88 PID 3616 wrote to memory of 3984 3616 mcsft.exe 88 PID 3616 wrote to memory of 3984 3616 mcsft.exe 88 PID 3616 wrote to memory of 3984 3616 mcsft.exe 88 PID 3616 wrote to memory of 3984 3616 mcsft.exe 88 PID 3616 wrote to memory of 3984 3616 mcsft.exe 88 PID 3616 wrote to memory of 3984 3616 mcsft.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\df56f0c9d0007f5125d92cfd481e21760d41eb10a92009ce1ab6d5da01140687.exe"C:\Users\Admin\AppData\Local\Temp\df56f0c9d0007f5125d92cfd481e21760d41eb10a92009ce1ab6d5da01140687.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XVQPK.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Mcrosoft" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\mcsft.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4876
-
-
-
C:\Users\Admin\AppData\Roaming\mcsft.exe"C:\Users\Admin\AppData\Roaming\mcsft.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Users\Admin\AppData\Roaming\mcsft.exeC:\Users\Admin\AppData\Roaming\mcsft.exe3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3984
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135B
MD5a5feca573884d76f559b996d45e8ad9a
SHA10e81a993f3af4e31d60653dc2513186f0495f1c8
SHA256c98e20d46d6465febb5d29cfab51241521ea5d6cd621f5e18b9b7d6fbfac3f0f
SHA512a9239648b5f15eac4d4151b6e1bdc81065eeaeb101404c2a0126f03bc87f1e6a57206bfa07a44379e9d3bba889e4497a9991ff41fb109099b01512df3dc3cbda
-
Filesize
576KB
MD5fbcac9098a9a46fa677bf68202c7ad8f
SHA17fc2bdb90a2f5bf18157331ece3d689cdb332460
SHA256f8bdfb9890067557f02529e3799467c7ede4e1944a725c8ac363f01dc3453028
SHA5125929d367636aaabef12aebba27be1db642134c8ec5d8c9f88df8b1f579055b2c5237f62c0a18e05217751a96f24d10f5586aa8eee019b1f9a19720c3959ba378