Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
112s -
max time network
114s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
30/12/2024, 17:48
Behavioral task
behavioral1
Sample
5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99.exe
Resource
win7-20241010-en
General
-
Target
5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99.exe
-
Size
559KB
-
MD5
71e81da5d572dd1732a7162ec2e40f12
-
SHA1
43e9a6c348c20e9ab5b647893828610174ae42fa
-
SHA256
5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99
-
SHA512
0570a7c5c40c98cffe2305f8be1537c01fa521cae1787071740b95ff78a01cab11ac96b96ac6f33e3e6a9b8450841807d42927fc01296cfe9f21585d311a85f9
-
SSDEEP
12288:x+xOrozCCYaCphtIYJb6lzOqPpFOblme0pLLsbii9cWDeO7HtoNmKzoSK:COEzCFaCpAYJbwzOqPUlvOsmi9c8Sl0
Malware Config
Signatures
-
Darkcomet family
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate mcsft.exe -
Executes dropped EXE 2 IoCs
pid Process 2484 mcsft.exe 2852 mcsft.exe -
Loads dropped DLL 6 IoCs
pid Process 1740 5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99.exe 1740 5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99.exe 1740 5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99.exe 1740 5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99.exe 1740 5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99.exe 2484 mcsft.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\Mcrosoft = "C:\\Users\\Admin\\AppData\\Roaming\\mcsft.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2484 set thread context of 2852 2484 mcsft.exe 34 -
resource yara_rule behavioral1/memory/1740-0-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral1/files/0x000800000001938e-27.dat upx behavioral1/memory/2484-47-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral1/memory/1740-49-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral1/memory/2852-54-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2852-56-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2852-57-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2484-59-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral1/memory/2852-60-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2852-62-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2852-63-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2852-61-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2852-66-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2852-65-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2852-64-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2852-67-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2852-70-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2852-72-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2852-74-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2852-76-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2852-78-0x0000000000400000-0x00000000004B5000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mcsft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mcsft.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier mcsft.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier mcsft.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2852 mcsft.exe Token: SeSecurityPrivilege 2852 mcsft.exe Token: SeTakeOwnershipPrivilege 2852 mcsft.exe Token: SeLoadDriverPrivilege 2852 mcsft.exe Token: SeSystemProfilePrivilege 2852 mcsft.exe Token: SeSystemtimePrivilege 2852 mcsft.exe Token: SeProfSingleProcessPrivilege 2852 mcsft.exe Token: SeIncBasePriorityPrivilege 2852 mcsft.exe Token: SeCreatePagefilePrivilege 2852 mcsft.exe Token: SeBackupPrivilege 2852 mcsft.exe Token: SeRestorePrivilege 2852 mcsft.exe Token: SeShutdownPrivilege 2852 mcsft.exe Token: SeDebugPrivilege 2852 mcsft.exe Token: SeSystemEnvironmentPrivilege 2852 mcsft.exe Token: SeChangeNotifyPrivilege 2852 mcsft.exe Token: SeRemoteShutdownPrivilege 2852 mcsft.exe Token: SeUndockPrivilege 2852 mcsft.exe Token: SeManageVolumePrivilege 2852 mcsft.exe Token: SeImpersonatePrivilege 2852 mcsft.exe Token: SeCreateGlobalPrivilege 2852 mcsft.exe Token: 33 2852 mcsft.exe Token: 34 2852 mcsft.exe Token: 35 2852 mcsft.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1740 5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99.exe 2484 mcsft.exe 2852 mcsft.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1740 wrote to memory of 2128 1740 5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99.exe 30 PID 1740 wrote to memory of 2128 1740 5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99.exe 30 PID 1740 wrote to memory of 2128 1740 5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99.exe 30 PID 1740 wrote to memory of 2128 1740 5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99.exe 30 PID 2128 wrote to memory of 1696 2128 cmd.exe 32 PID 2128 wrote to memory of 1696 2128 cmd.exe 32 PID 2128 wrote to memory of 1696 2128 cmd.exe 32 PID 2128 wrote to memory of 1696 2128 cmd.exe 32 PID 1740 wrote to memory of 2484 1740 5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99.exe 33 PID 1740 wrote to memory of 2484 1740 5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99.exe 33 PID 1740 wrote to memory of 2484 1740 5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99.exe 33 PID 1740 wrote to memory of 2484 1740 5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99.exe 33 PID 2484 wrote to memory of 2852 2484 mcsft.exe 34 PID 2484 wrote to memory of 2852 2484 mcsft.exe 34 PID 2484 wrote to memory of 2852 2484 mcsft.exe 34 PID 2484 wrote to memory of 2852 2484 mcsft.exe 34 PID 2484 wrote to memory of 2852 2484 mcsft.exe 34 PID 2484 wrote to memory of 2852 2484 mcsft.exe 34 PID 2484 wrote to memory of 2852 2484 mcsft.exe 34 PID 2484 wrote to memory of 2852 2484 mcsft.exe 34 PID 2484 wrote to memory of 2852 2484 mcsft.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99.exe"C:\Users\Admin\AppData\Local\Temp\5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\HfBuw.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Mcrosoft" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\mcsft.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1696
-
-
-
C:\Users\Admin\AppData\Roaming\mcsft.exe"C:\Users\Admin\AppData\Roaming\mcsft.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Roaming\mcsft.exeC:\Users\Admin\AppData\Roaming\mcsft.exe3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2852
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135B
MD5a5feca573884d76f559b996d45e8ad9a
SHA10e81a993f3af4e31d60653dc2513186f0495f1c8
SHA256c98e20d46d6465febb5d29cfab51241521ea5d6cd621f5e18b9b7d6fbfac3f0f
SHA512a9239648b5f15eac4d4151b6e1bdc81065eeaeb101404c2a0126f03bc87f1e6a57206bfa07a44379e9d3bba889e4497a9991ff41fb109099b01512df3dc3cbda
-
Filesize
559KB
MD5f0f1fcf59193219a7594888080512109
SHA151b7587914aba8d772af549439d9e02d2d37c9ce
SHA25667509ad290bd74e5851ddefdf35e62d8f6a4f6c08baa46f709d636d49b342f2a
SHA512b3cfc73ce25f9246edae71169b9371f19f5a9996767fe8976d294746e3ba22a76aabf42518ca7fa2b3a58750cba4afd74a451825707d5a59ee5eed031662f856