Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18/12/2024, 01:35
Behavioral task
behavioral1
Sample
5bb855d5a99607884dcbe6eb24e859da01e138fe93b9db3ac60000c6666490e0.exe
Resource
win7-20240903-en
General
-
Target
5bb855d5a99607884dcbe6eb24e859da01e138fe93b9db3ac60000c6666490e0.exe
-
Size
576KB
-
MD5
634b3b667463eb68a80151623408bc02
-
SHA1
7d31d1df8a96c846d5b04de5a5435e38561d26d3
-
SHA256
5bb855d5a99607884dcbe6eb24e859da01e138fe93b9db3ac60000c6666490e0
-
SHA512
eec6928fa0f431882ac0818b93924dc010e657cfcff5411c13c1659832109976d6d851be5f877152760f13a5e5c32f134147b7604ab872f287cb0eb67fd7d5ca
-
SSDEEP
12288:+NWPkHlUkErBuxQ4uzi6d6dL/yiXLzeMdK6io8levy0FhVlpzkzDDoSK:+NWPkHlUfBgpuPdWzyuDTifgyWl1
Malware Config
Signatures
-
Darkcomet family
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate mcsft.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation 5bb855d5a99607884dcbe6eb24e859da01e138fe93b9db3ac60000c6666490e0.exe -
Executes dropped EXE 2 IoCs
pid Process 4700 mcsft.exe 1136 mcsft.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Mcrosoft = "C:\\Users\\Admin\\AppData\\Roaming\\mcsft.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4700 set thread context of 1136 4700 mcsft.exe 87 -
resource yara_rule behavioral2/memory/3496-0-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral2/files/0x000b000000023b82-16.dat upx behavioral2/memory/4700-28-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral2/memory/3496-30-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral2/memory/1136-33-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1136-36-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4700-37-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral2/memory/1136-38-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1136-41-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1136-45-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1136-44-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1136-43-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1136-42-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1136-40-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1136-39-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1136-46-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1136-47-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1136-48-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1136-49-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1136-50-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1136-51-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1136-52-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1136-53-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1136-54-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1136-55-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1136-56-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1136-57-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1136-58-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/1136-59-0x0000000000400000-0x00000000004B5000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5bb855d5a99607884dcbe6eb24e859da01e138fe93b9db3ac60000c6666490e0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mcsft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mcsft.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier mcsft.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 mcsft.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier mcsft.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1136 mcsft.exe Token: SeSecurityPrivilege 1136 mcsft.exe Token: SeTakeOwnershipPrivilege 1136 mcsft.exe Token: SeLoadDriverPrivilege 1136 mcsft.exe Token: SeSystemProfilePrivilege 1136 mcsft.exe Token: SeSystemtimePrivilege 1136 mcsft.exe Token: SeProfSingleProcessPrivilege 1136 mcsft.exe Token: SeIncBasePriorityPrivilege 1136 mcsft.exe Token: SeCreatePagefilePrivilege 1136 mcsft.exe Token: SeBackupPrivilege 1136 mcsft.exe Token: SeRestorePrivilege 1136 mcsft.exe Token: SeShutdownPrivilege 1136 mcsft.exe Token: SeDebugPrivilege 1136 mcsft.exe Token: SeSystemEnvironmentPrivilege 1136 mcsft.exe Token: SeChangeNotifyPrivilege 1136 mcsft.exe Token: SeRemoteShutdownPrivilege 1136 mcsft.exe Token: SeUndockPrivilege 1136 mcsft.exe Token: SeManageVolumePrivilege 1136 mcsft.exe Token: SeImpersonatePrivilege 1136 mcsft.exe Token: SeCreateGlobalPrivilege 1136 mcsft.exe Token: 33 1136 mcsft.exe Token: 34 1136 mcsft.exe Token: 35 1136 mcsft.exe Token: 36 1136 mcsft.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3496 5bb855d5a99607884dcbe6eb24e859da01e138fe93b9db3ac60000c6666490e0.exe 4700 mcsft.exe 1136 mcsft.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 3496 wrote to memory of 3096 3496 5bb855d5a99607884dcbe6eb24e859da01e138fe93b9db3ac60000c6666490e0.exe 82 PID 3496 wrote to memory of 3096 3496 5bb855d5a99607884dcbe6eb24e859da01e138fe93b9db3ac60000c6666490e0.exe 82 PID 3496 wrote to memory of 3096 3496 5bb855d5a99607884dcbe6eb24e859da01e138fe93b9db3ac60000c6666490e0.exe 82 PID 3096 wrote to memory of 1516 3096 cmd.exe 85 PID 3096 wrote to memory of 1516 3096 cmd.exe 85 PID 3096 wrote to memory of 1516 3096 cmd.exe 85 PID 3496 wrote to memory of 4700 3496 5bb855d5a99607884dcbe6eb24e859da01e138fe93b9db3ac60000c6666490e0.exe 86 PID 3496 wrote to memory of 4700 3496 5bb855d5a99607884dcbe6eb24e859da01e138fe93b9db3ac60000c6666490e0.exe 86 PID 3496 wrote to memory of 4700 3496 5bb855d5a99607884dcbe6eb24e859da01e138fe93b9db3ac60000c6666490e0.exe 86 PID 4700 wrote to memory of 1136 4700 mcsft.exe 87 PID 4700 wrote to memory of 1136 4700 mcsft.exe 87 PID 4700 wrote to memory of 1136 4700 mcsft.exe 87 PID 4700 wrote to memory of 1136 4700 mcsft.exe 87 PID 4700 wrote to memory of 1136 4700 mcsft.exe 87 PID 4700 wrote to memory of 1136 4700 mcsft.exe 87 PID 4700 wrote to memory of 1136 4700 mcsft.exe 87 PID 4700 wrote to memory of 1136 4700 mcsft.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\5bb855d5a99607884dcbe6eb24e859da01e138fe93b9db3ac60000c6666490e0.exe"C:\Users\Admin\AppData\Local\Temp\5bb855d5a99607884dcbe6eb24e859da01e138fe93b9db3ac60000c6666490e0.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kdsuy.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Mcrosoft" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\mcsft.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1516
-
-
-
C:\Users\Admin\AppData\Roaming\mcsft.exe"C:\Users\Admin\AppData\Roaming\mcsft.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Roaming\mcsft.exeC:\Users\Admin\AppData\Roaming\mcsft.exe3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1136
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135B
MD5a5feca573884d76f559b996d45e8ad9a
SHA10e81a993f3af4e31d60653dc2513186f0495f1c8
SHA256c98e20d46d6465febb5d29cfab51241521ea5d6cd621f5e18b9b7d6fbfac3f0f
SHA512a9239648b5f15eac4d4151b6e1bdc81065eeaeb101404c2a0126f03bc87f1e6a57206bfa07a44379e9d3bba889e4497a9991ff41fb109099b01512df3dc3cbda
-
Filesize
576KB
MD5f2089849ca73a1422e2e0ae891a2788a
SHA16be80626edffdc1dd310f3a2008c672bc5a4dcb5
SHA256bc19e5ed73d6f155cc6e7a0282c3c998bbfaad8e6d82bcad8c5606a26f36f35c
SHA512edb8fe03b6d0a01c96b66020af1354cfd588f0dad6fa75bde33c440fb5e6f4dce02a91da0ca25f654ced96a7f0b60a127445880ba6ef15b13ec41f41afe400b7