Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
111s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
02/01/2025, 01:02
Behavioral task
behavioral1
Sample
28077b9fc0a3c230acec87246ba45ce6ec5037a26c304bd0160f1d489344faf2.exe
Resource
win7-20241010-en
General
-
Target
28077b9fc0a3c230acec87246ba45ce6ec5037a26c304bd0160f1d489344faf2.exe
-
Size
559KB
-
MD5
36bc17eaa400cce566f480f8415c9305
-
SHA1
be0e76f8dbaba413810135f7b99f75d68d6e1158
-
SHA256
28077b9fc0a3c230acec87246ba45ce6ec5037a26c304bd0160f1d489344faf2
-
SHA512
954ce916fc83570dd7a496146c31cf56ae99036216838d7269b68b96c88452b60fe7a2f3a49a783c93a581a6f1e44ca6c3452dcade8cd4305d2e2b87fd8dba74
-
SSDEEP
12288:x+xOrozCCYaCphtIYJb6lzOqPpFOblme0pLLsbii9cWDeO7HtoNmKzoSw:COEzCFaCpAYJbwzOqPUlvOsmi9c8Sle
Malware Config
Signatures
-
Darkcomet family
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate mcsft.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation 28077b9fc0a3c230acec87246ba45ce6ec5037a26c304bd0160f1d489344faf2.exe -
Executes dropped EXE 2 IoCs
pid Process 3024 mcsft.exe 4012 mcsft.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Mcrosoft = "C:\\Users\\Admin\\AppData\\Roaming\\mcsft.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3024 set thread context of 4012 3024 mcsft.exe 88 -
resource yara_rule behavioral2/memory/4924-0-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral2/files/0x0008000000023caf-16.dat upx behavioral2/memory/4924-29-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral2/memory/4012-32-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4012-35-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/3024-38-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral2/memory/4012-37-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4012-40-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4012-42-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4012-43-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4012-46-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4012-45-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4012-44-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4012-41-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4012-47-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4012-49-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4012-51-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4012-53-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4012-55-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral2/memory/4012-57-0x0000000000400000-0x00000000004B5000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28077b9fc0a3c230acec87246ba45ce6ec5037a26c304bd0160f1d489344faf2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mcsft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mcsft.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier mcsft.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier mcsft.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4012 mcsft.exe Token: SeSecurityPrivilege 4012 mcsft.exe Token: SeTakeOwnershipPrivilege 4012 mcsft.exe Token: SeLoadDriverPrivilege 4012 mcsft.exe Token: SeSystemProfilePrivilege 4012 mcsft.exe Token: SeSystemtimePrivilege 4012 mcsft.exe Token: SeProfSingleProcessPrivilege 4012 mcsft.exe Token: SeIncBasePriorityPrivilege 4012 mcsft.exe Token: SeCreatePagefilePrivilege 4012 mcsft.exe Token: SeBackupPrivilege 4012 mcsft.exe Token: SeRestorePrivilege 4012 mcsft.exe Token: SeShutdownPrivilege 4012 mcsft.exe Token: SeDebugPrivilege 4012 mcsft.exe Token: SeSystemEnvironmentPrivilege 4012 mcsft.exe Token: SeChangeNotifyPrivilege 4012 mcsft.exe Token: SeRemoteShutdownPrivilege 4012 mcsft.exe Token: SeUndockPrivilege 4012 mcsft.exe Token: SeManageVolumePrivilege 4012 mcsft.exe Token: SeImpersonatePrivilege 4012 mcsft.exe Token: SeCreateGlobalPrivilege 4012 mcsft.exe Token: 33 4012 mcsft.exe Token: 34 4012 mcsft.exe Token: 35 4012 mcsft.exe Token: 36 4012 mcsft.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4924 28077b9fc0a3c230acec87246ba45ce6ec5037a26c304bd0160f1d489344faf2.exe 3024 mcsft.exe 4012 mcsft.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 4924 wrote to memory of 4828 4924 28077b9fc0a3c230acec87246ba45ce6ec5037a26c304bd0160f1d489344faf2.exe 83 PID 4924 wrote to memory of 4828 4924 28077b9fc0a3c230acec87246ba45ce6ec5037a26c304bd0160f1d489344faf2.exe 83 PID 4924 wrote to memory of 4828 4924 28077b9fc0a3c230acec87246ba45ce6ec5037a26c304bd0160f1d489344faf2.exe 83 PID 4828 wrote to memory of 3972 4828 cmd.exe 86 PID 4828 wrote to memory of 3972 4828 cmd.exe 86 PID 4828 wrote to memory of 3972 4828 cmd.exe 86 PID 4924 wrote to memory of 3024 4924 28077b9fc0a3c230acec87246ba45ce6ec5037a26c304bd0160f1d489344faf2.exe 87 PID 4924 wrote to memory of 3024 4924 28077b9fc0a3c230acec87246ba45ce6ec5037a26c304bd0160f1d489344faf2.exe 87 PID 4924 wrote to memory of 3024 4924 28077b9fc0a3c230acec87246ba45ce6ec5037a26c304bd0160f1d489344faf2.exe 87 PID 3024 wrote to memory of 4012 3024 mcsft.exe 88 PID 3024 wrote to memory of 4012 3024 mcsft.exe 88 PID 3024 wrote to memory of 4012 3024 mcsft.exe 88 PID 3024 wrote to memory of 4012 3024 mcsft.exe 88 PID 3024 wrote to memory of 4012 3024 mcsft.exe 88 PID 3024 wrote to memory of 4012 3024 mcsft.exe 88 PID 3024 wrote to memory of 4012 3024 mcsft.exe 88 PID 3024 wrote to memory of 4012 3024 mcsft.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\28077b9fc0a3c230acec87246ba45ce6ec5037a26c304bd0160f1d489344faf2.exe"C:\Users\Admin\AppData\Local\Temp\28077b9fc0a3c230acec87246ba45ce6ec5037a26c304bd0160f1d489344faf2.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uPKJE.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Mcrosoft" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\mcsft.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3972
-
-
-
C:\Users\Admin\AppData\Roaming\mcsft.exe"C:\Users\Admin\AppData\Roaming\mcsft.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Roaming\mcsft.exeC:\Users\Admin\AppData\Roaming\mcsft.exe3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4012
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135B
MD5a5feca573884d76f559b996d45e8ad9a
SHA10e81a993f3af4e31d60653dc2513186f0495f1c8
SHA256c98e20d46d6465febb5d29cfab51241521ea5d6cd621f5e18b9b7d6fbfac3f0f
SHA512a9239648b5f15eac4d4151b6e1bdc81065eeaeb101404c2a0126f03bc87f1e6a57206bfa07a44379e9d3bba889e4497a9991ff41fb109099b01512df3dc3cbda
-
Filesize
559KB
MD53f2c33d023529d2e0a947fa1c90aa21c
SHA1e13c52d58cf9fd7df8bd425b86345dc0ded017cb
SHA2563f4c0dad91b9bdd6387be51d3ec2ae787b4c60bfec5f6c577f640eb37b02c0af
SHA5127886998d5be8a05ff5d635c2e2c0f79f243a29dc73e8e733cb6d1d81e53fb71617e35ab9d37409659b9e4ee65f53bf29025c5f16693e60e8afa7cf1099c74ade