Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
111s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2024, 17:48
Behavioral task
behavioral1
Sample
5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99.exe
Resource
win7-20241010-en
General
-
Target
5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99.exe
-
Size
559KB
-
MD5
71e81da5d572dd1732a7162ec2e40f12
-
SHA1
43e9a6c348c20e9ab5b647893828610174ae42fa
-
SHA256
5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99
-
SHA512
0570a7c5c40c98cffe2305f8be1537c01fa521cae1787071740b95ff78a01cab11ac96b96ac6f33e3e6a9b8450841807d42927fc01296cfe9f21585d311a85f9
-
SSDEEP
12288:x+xOrozCCYaCphtIYJb6lzOqPpFOblme0pLLsbii9cWDeO7HtoNmKzoSK:COEzCFaCpAYJbwzOqPUlvOsmi9c8Sl0
Malware Config
Signatures
-
Darkcomet family
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate mcsft.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation 5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99.exe -
Executes dropped EXE 2 IoCs
pid Process 4944 mcsft.exe 4824 mcsft.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Mcrosoft = "C:\\Users\\Admin\\AppData\\Roaming\\mcsft.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4944 set thread context of 4824 4944 mcsft.exe 87 -
resource yara_rule behavioral2/memory/4488-0-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral2/files/0x000b000000023b77-16.dat upx behavioral2/memory/4488-29-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral2/memory/4824-32-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4824-34-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4824-35-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4944-37-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral2/memory/4824-39-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4824-38-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4824-43-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4824-42-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4824-41-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4824-40-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4824-44-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4824-45-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4824-48-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4824-50-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4824-52-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4824-54-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4824-56-0x0000000000400000-0x00000000004B5000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mcsft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mcsft.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier mcsft.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier mcsft.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4824 mcsft.exe Token: SeSecurityPrivilege 4824 mcsft.exe Token: SeTakeOwnershipPrivilege 4824 mcsft.exe Token: SeLoadDriverPrivilege 4824 mcsft.exe Token: SeSystemProfilePrivilege 4824 mcsft.exe Token: SeSystemtimePrivilege 4824 mcsft.exe Token: SeProfSingleProcessPrivilege 4824 mcsft.exe Token: SeIncBasePriorityPrivilege 4824 mcsft.exe Token: SeCreatePagefilePrivilege 4824 mcsft.exe Token: SeBackupPrivilege 4824 mcsft.exe Token: SeRestorePrivilege 4824 mcsft.exe Token: SeShutdownPrivilege 4824 mcsft.exe Token: SeDebugPrivilege 4824 mcsft.exe Token: SeSystemEnvironmentPrivilege 4824 mcsft.exe Token: SeChangeNotifyPrivilege 4824 mcsft.exe Token: SeRemoteShutdownPrivilege 4824 mcsft.exe Token: SeUndockPrivilege 4824 mcsft.exe Token: SeManageVolumePrivilege 4824 mcsft.exe Token: SeImpersonatePrivilege 4824 mcsft.exe Token: SeCreateGlobalPrivilege 4824 mcsft.exe Token: 33 4824 mcsft.exe Token: 34 4824 mcsft.exe Token: 35 4824 mcsft.exe Token: 36 4824 mcsft.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4488 5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99.exe 4944 mcsft.exe 4824 mcsft.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 4488 wrote to memory of 4976 4488 5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99.exe 82 PID 4488 wrote to memory of 4976 4488 5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99.exe 82 PID 4488 wrote to memory of 4976 4488 5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99.exe 82 PID 4976 wrote to memory of 5008 4976 cmd.exe 85 PID 4976 wrote to memory of 5008 4976 cmd.exe 85 PID 4976 wrote to memory of 5008 4976 cmd.exe 85 PID 4488 wrote to memory of 4944 4488 5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99.exe 86 PID 4488 wrote to memory of 4944 4488 5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99.exe 86 PID 4488 wrote to memory of 4944 4488 5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99.exe 86 PID 4944 wrote to memory of 4824 4944 mcsft.exe 87 PID 4944 wrote to memory of 4824 4944 mcsft.exe 87 PID 4944 wrote to memory of 4824 4944 mcsft.exe 87 PID 4944 wrote to memory of 4824 4944 mcsft.exe 87 PID 4944 wrote to memory of 4824 4944 mcsft.exe 87 PID 4944 wrote to memory of 4824 4944 mcsft.exe 87 PID 4944 wrote to memory of 4824 4944 mcsft.exe 87 PID 4944 wrote to memory of 4824 4944 mcsft.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99.exe"C:\Users\Admin\AppData\Local\Temp\5a153fbd6e42b3c15c4a52b9ba1bf688ade2148921d10a08314b17173dbdbb99.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\VBPKJ.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Mcrosoft" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\mcsft.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:5008
-
-
-
C:\Users\Admin\AppData\Roaming\mcsft.exe"C:\Users\Admin\AppData\Roaming\mcsft.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Roaming\mcsft.exeC:\Users\Admin\AppData\Roaming\mcsft.exe3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4824
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135B
MD5a5feca573884d76f559b996d45e8ad9a
SHA10e81a993f3af4e31d60653dc2513186f0495f1c8
SHA256c98e20d46d6465febb5d29cfab51241521ea5d6cd621f5e18b9b7d6fbfac3f0f
SHA512a9239648b5f15eac4d4151b6e1bdc81065eeaeb101404c2a0126f03bc87f1e6a57206bfa07a44379e9d3bba889e4497a9991ff41fb109099b01512df3dc3cbda
-
Filesize
559KB
MD5c834c78bc3be3bb03c282c550cfcd7fc
SHA181d6bb92026aae6d6288038a809a5bde174f85b7
SHA2566bbf69fd263e6cbdfbd84d054e6bb9c178cb0232a19390145bb1dfff79c8a185
SHA512656dfac5dce560852298b0e1da5869a7e75f198d5f0aabb219f8a592cb32f0f3ca3e090a867836a6133e0caa1fd1e072e573279ee9bc7531017b6ae9b6499bc7