Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
01/01/2025, 17:06
Behavioral task
behavioral1
Sample
f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe
Resource
win7-20240903-en
General
-
Target
f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe
-
Size
1.0MB
-
MD5
9a5bf98f8b7e161f7e211086a3c49ba1
-
SHA1
813526050d2550c2e318cf8e915932ddde6a223e
-
SHA256
f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96
-
SHA512
a05511332c90923690a12caa5e801a85e4f420e591b38581f4f9a25530651e69ccbcd35fe39ad0e9230309dae37e37fec1ab61faede28fa95a60b9399ed5a848
-
SSDEEP
24576:Rx7UJ81apKbDL+3DdVrBta0ShvVboU4TIn9ohOCMXE0QxbD/dlwc4Z99rpLMO38t:DV1apKbDL+3DdVrBta0ShvVboU4TIn9A
Malware Config
Signatures
-
Darkcomet family
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\Windupdt\\winupdate.exe" f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate winupdate.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe -
Executes dropped EXE 2 IoCs
pid Process 1008 winupdate.exe 4876 winupdate.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Users\\Admin\\AppData\\Roaming\\Windupdt\\winupdate.exe" f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4972 set thread context of 5004 4972 f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe 82 PID 1008 set thread context of 4876 1008 winupdate.exe 84 -
resource yara_rule behavioral2/memory/4972-0-0x0000000000400000-0x0000000000512000-memory.dmp upx behavioral2/memory/4972-5-0x0000000000400000-0x0000000000512000-memory.dmp upx behavioral2/files/0x0007000000023c88-14.dat upx behavioral2/memory/1008-70-0x0000000000400000-0x0000000000512000-memory.dmp upx behavioral2/memory/1008-81-0x0000000000400000-0x0000000000512000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winupdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winupdate.exe -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 winupdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString winupdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier winupdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier winupdate.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier winupdate.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 5004 f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe Token: SeSecurityPrivilege 5004 f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe Token: SeTakeOwnershipPrivilege 5004 f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe Token: SeLoadDriverPrivilege 5004 f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe Token: SeSystemProfilePrivilege 5004 f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe Token: SeSystemtimePrivilege 5004 f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe Token: SeProfSingleProcessPrivilege 5004 f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe Token: SeIncBasePriorityPrivilege 5004 f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe Token: SeCreatePagefilePrivilege 5004 f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe Token: SeBackupPrivilege 5004 f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe Token: SeRestorePrivilege 5004 f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe Token: SeShutdownPrivilege 5004 f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe Token: SeDebugPrivilege 5004 f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe Token: SeSystemEnvironmentPrivilege 5004 f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe Token: SeChangeNotifyPrivilege 5004 f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe Token: SeRemoteShutdownPrivilege 5004 f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe Token: SeUndockPrivilege 5004 f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe Token: SeManageVolumePrivilege 5004 f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe Token: SeImpersonatePrivilege 5004 f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe Token: SeCreateGlobalPrivilege 5004 f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe Token: 33 5004 f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe Token: 34 5004 f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe Token: 35 5004 f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe Token: 36 5004 f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe Token: SeIncreaseQuotaPrivilege 4876 winupdate.exe Token: SeSecurityPrivilege 4876 winupdate.exe Token: SeTakeOwnershipPrivilege 4876 winupdate.exe Token: SeLoadDriverPrivilege 4876 winupdate.exe Token: SeSystemProfilePrivilege 4876 winupdate.exe Token: SeSystemtimePrivilege 4876 winupdate.exe Token: SeProfSingleProcessPrivilege 4876 winupdate.exe Token: SeIncBasePriorityPrivilege 4876 winupdate.exe Token: SeCreatePagefilePrivilege 4876 winupdate.exe Token: SeBackupPrivilege 4876 winupdate.exe Token: SeRestorePrivilege 4876 winupdate.exe Token: SeShutdownPrivilege 4876 winupdate.exe Token: SeDebugPrivilege 4876 winupdate.exe Token: SeSystemEnvironmentPrivilege 4876 winupdate.exe Token: SeChangeNotifyPrivilege 4876 winupdate.exe Token: SeRemoteShutdownPrivilege 4876 winupdate.exe Token: SeUndockPrivilege 4876 winupdate.exe Token: SeManageVolumePrivilege 4876 winupdate.exe Token: SeImpersonatePrivilege 4876 winupdate.exe Token: SeCreateGlobalPrivilege 4876 winupdate.exe Token: 33 4876 winupdate.exe Token: 34 4876 winupdate.exe Token: 35 4876 winupdate.exe Token: 36 4876 winupdate.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4972 f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe 1008 winupdate.exe 4876 winupdate.exe -
Suspicious use of WriteProcessMemory 31 IoCs
description pid Process procid_target PID 4972 wrote to memory of 5004 4972 f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe 82 PID 4972 wrote to memory of 5004 4972 f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe 82 PID 4972 wrote to memory of 5004 4972 f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe 82 PID 4972 wrote to memory of 5004 4972 f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe 82 PID 4972 wrote to memory of 5004 4972 f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe 82 PID 4972 wrote to memory of 5004 4972 f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe 82 PID 4972 wrote to memory of 5004 4972 f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe 82 PID 4972 wrote to memory of 5004 4972 f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe 82 PID 4972 wrote to memory of 5004 4972 f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe 82 PID 4972 wrote to memory of 5004 4972 f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe 82 PID 4972 wrote to memory of 5004 4972 f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe 82 PID 4972 wrote to memory of 5004 4972 f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe 82 PID 4972 wrote to memory of 5004 4972 f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe 82 PID 4972 wrote to memory of 5004 4972 f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe 82 PID 5004 wrote to memory of 1008 5004 f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe 83 PID 5004 wrote to memory of 1008 5004 f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe 83 PID 5004 wrote to memory of 1008 5004 f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe 83 PID 1008 wrote to memory of 4876 1008 winupdate.exe 84 PID 1008 wrote to memory of 4876 1008 winupdate.exe 84 PID 1008 wrote to memory of 4876 1008 winupdate.exe 84 PID 1008 wrote to memory of 4876 1008 winupdate.exe 84 PID 1008 wrote to memory of 4876 1008 winupdate.exe 84 PID 1008 wrote to memory of 4876 1008 winupdate.exe 84 PID 1008 wrote to memory of 4876 1008 winupdate.exe 84 PID 1008 wrote to memory of 4876 1008 winupdate.exe 84 PID 1008 wrote to memory of 4876 1008 winupdate.exe 84 PID 1008 wrote to memory of 4876 1008 winupdate.exe 84 PID 1008 wrote to memory of 4876 1008 winupdate.exe 84 PID 1008 wrote to memory of 4876 1008 winupdate.exe 84 PID 1008 wrote to memory of 4876 1008 winupdate.exe 84 PID 1008 wrote to memory of 4876 1008 winupdate.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe"C:\Users\Admin\AppData\Local\Temp\f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe"C:\Users\Admin\AppData\Local\Temp\f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96.exe"2⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe"C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe"C:\Users\Admin\AppData\Roaming\Windupdt\winupdate.exe"4⤵
- Checks BIOS information in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4876
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD59a5bf98f8b7e161f7e211086a3c49ba1
SHA1813526050d2550c2e318cf8e915932ddde6a223e
SHA256f986ccfea9ea474c52ecbb9c72e968b9f9aa7868846f87d2b681f7b717576f96
SHA512a05511332c90923690a12caa5e801a85e4f420e591b38581f4f9a25530651e69ccbcd35fe39ad0e9230309dae37e37fec1ab61faede28fa95a60b9399ed5a848