Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
02/01/2025, 06:32
Static task
static1
Behavioral task
behavioral1
Sample
f1178b4f455c0e7eaed0a745e73daba143ae288e442de0de7a2f55a3ab1978bc.exe
Resource
win7-20241023-en
General
-
Target
f1178b4f455c0e7eaed0a745e73daba143ae288e442de0de7a2f55a3ab1978bc.exe
-
Size
520KB
-
MD5
17705720e760c663115260a1693becc3
-
SHA1
444d41ab035b90b971cbc7df34a9c0fac6069c04
-
SHA256
f1178b4f455c0e7eaed0a745e73daba143ae288e442de0de7a2f55a3ab1978bc
-
SHA512
c1b582123b9e99a6c301652ed9103d43eefeb0ff831069e399d23bf4ee33c581799224bedae6a1dd639a936d22414722f08b6768c5855c410da084cd418c8e6c
-
SSDEEP
6144:f9GGo2CwtGg6eeihEfph2CMvvqqSaYwpncOeC66AOa0aFtVEQfTo1ozVqMbm:f9fC3hh29Ya77A90aFtDfT5IMbm
Malware Config
Extracted
darkcomet
PrivateEye
ratblackshades.no-ip.biz:1604
DC_MUTEX-ACC1R98
-
gencode
8GG5LVVGljSF
-
install
false
-
offline_keylogger
true
-
persistence
false
Signatures
-
Darkcomet family
-
Executes dropped EXE 3 IoCs
pid Process 2648 winupd.exe 2784 winupd.exe 2636 winupd.exe -
Loads dropped DLL 4 IoCs
pid Process 2072 f1178b4f455c0e7eaed0a745e73daba143ae288e442de0de7a2f55a3ab1978bc.exe 2072 f1178b4f455c0e7eaed0a745e73daba143ae288e442de0de7a2f55a3ab1978bc.exe 2648 winupd.exe 2648 winupd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\winupd.exe -notray" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2712 set thread context of 2072 2712 f1178b4f455c0e7eaed0a745e73daba143ae288e442de0de7a2f55a3ab1978bc.exe 28 PID 2648 set thread context of 2784 2648 winupd.exe 30 PID 2648 set thread context of 2636 2648 winupd.exe 31 -
resource yara_rule behavioral1/memory/2636-54-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2636-66-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2636-68-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2636-71-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2636-70-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2636-69-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2636-67-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2636-73-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2636-74-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2636-64-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2636-58-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2636-82-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2636-83-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2636-84-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2636-85-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2636-86-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2636-87-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2636-88-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2636-89-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2636-90-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2636-91-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2636-92-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2636-93-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2636-94-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2636-95-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2636-96-0x0000000000400000-0x00000000004B7000-memory.dmp upx behavioral1/memory/2636-97-0x0000000000400000-0x00000000004B7000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winupd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ipconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f1178b4f455c0e7eaed0a745e73daba143ae288e442de0de7a2f55a3ab1978bc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f1178b4f455c0e7eaed0a745e73daba143ae288e442de0de7a2f55a3ab1978bc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winupd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winupd.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 2552 ipconfig.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 2832 reg.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2636 winupd.exe Token: SeSecurityPrivilege 2636 winupd.exe Token: SeTakeOwnershipPrivilege 2636 winupd.exe Token: SeLoadDriverPrivilege 2636 winupd.exe Token: SeSystemProfilePrivilege 2636 winupd.exe Token: SeSystemtimePrivilege 2636 winupd.exe Token: SeProfSingleProcessPrivilege 2636 winupd.exe Token: SeIncBasePriorityPrivilege 2636 winupd.exe Token: SeCreatePagefilePrivilege 2636 winupd.exe Token: SeBackupPrivilege 2636 winupd.exe Token: SeRestorePrivilege 2636 winupd.exe Token: SeShutdownPrivilege 2636 winupd.exe Token: SeDebugPrivilege 2636 winupd.exe Token: SeSystemEnvironmentPrivilege 2636 winupd.exe Token: SeChangeNotifyPrivilege 2636 winupd.exe Token: SeRemoteShutdownPrivilege 2636 winupd.exe Token: SeUndockPrivilege 2636 winupd.exe Token: SeManageVolumePrivilege 2636 winupd.exe Token: SeImpersonatePrivilege 2636 winupd.exe Token: SeCreateGlobalPrivilege 2636 winupd.exe Token: 33 2636 winupd.exe Token: 34 2636 winupd.exe Token: 35 2636 winupd.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2712 f1178b4f455c0e7eaed0a745e73daba143ae288e442de0de7a2f55a3ab1978bc.exe 2072 f1178b4f455c0e7eaed0a745e73daba143ae288e442de0de7a2f55a3ab1978bc.exe 2648 winupd.exe 2784 winupd.exe 2636 winupd.exe -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 2712 wrote to memory of 2072 2712 f1178b4f455c0e7eaed0a745e73daba143ae288e442de0de7a2f55a3ab1978bc.exe 28 PID 2712 wrote to memory of 2072 2712 f1178b4f455c0e7eaed0a745e73daba143ae288e442de0de7a2f55a3ab1978bc.exe 28 PID 2712 wrote to memory of 2072 2712 f1178b4f455c0e7eaed0a745e73daba143ae288e442de0de7a2f55a3ab1978bc.exe 28 PID 2712 wrote to memory of 2072 2712 f1178b4f455c0e7eaed0a745e73daba143ae288e442de0de7a2f55a3ab1978bc.exe 28 PID 2712 wrote to memory of 2072 2712 f1178b4f455c0e7eaed0a745e73daba143ae288e442de0de7a2f55a3ab1978bc.exe 28 PID 2712 wrote to memory of 2072 2712 f1178b4f455c0e7eaed0a745e73daba143ae288e442de0de7a2f55a3ab1978bc.exe 28 PID 2712 wrote to memory of 2072 2712 f1178b4f455c0e7eaed0a745e73daba143ae288e442de0de7a2f55a3ab1978bc.exe 28 PID 2712 wrote to memory of 2072 2712 f1178b4f455c0e7eaed0a745e73daba143ae288e442de0de7a2f55a3ab1978bc.exe 28 PID 2712 wrote to memory of 2072 2712 f1178b4f455c0e7eaed0a745e73daba143ae288e442de0de7a2f55a3ab1978bc.exe 28 PID 2072 wrote to memory of 2648 2072 f1178b4f455c0e7eaed0a745e73daba143ae288e442de0de7a2f55a3ab1978bc.exe 29 PID 2072 wrote to memory of 2648 2072 f1178b4f455c0e7eaed0a745e73daba143ae288e442de0de7a2f55a3ab1978bc.exe 29 PID 2072 wrote to memory of 2648 2072 f1178b4f455c0e7eaed0a745e73daba143ae288e442de0de7a2f55a3ab1978bc.exe 29 PID 2072 wrote to memory of 2648 2072 f1178b4f455c0e7eaed0a745e73daba143ae288e442de0de7a2f55a3ab1978bc.exe 29 PID 2648 wrote to memory of 2784 2648 winupd.exe 30 PID 2648 wrote to memory of 2784 2648 winupd.exe 30 PID 2648 wrote to memory of 2784 2648 winupd.exe 30 PID 2648 wrote to memory of 2784 2648 winupd.exe 30 PID 2648 wrote to memory of 2784 2648 winupd.exe 30 PID 2648 wrote to memory of 2784 2648 winupd.exe 30 PID 2648 wrote to memory of 2784 2648 winupd.exe 30 PID 2648 wrote to memory of 2784 2648 winupd.exe 30 PID 2648 wrote to memory of 2784 2648 winupd.exe 30 PID 2648 wrote to memory of 2636 2648 winupd.exe 31 PID 2648 wrote to memory of 2636 2648 winupd.exe 31 PID 2648 wrote to memory of 2636 2648 winupd.exe 31 PID 2648 wrote to memory of 2636 2648 winupd.exe 31 PID 2648 wrote to memory of 2636 2648 winupd.exe 31 PID 2648 wrote to memory of 2636 2648 winupd.exe 31 PID 2784 wrote to memory of 2552 2784 winupd.exe 32 PID 2784 wrote to memory of 2552 2784 winupd.exe 32 PID 2784 wrote to memory of 2552 2784 winupd.exe 32 PID 2784 wrote to memory of 2552 2784 winupd.exe 32 PID 2784 wrote to memory of 2552 2784 winupd.exe 32 PID 2784 wrote to memory of 2552 2784 winupd.exe 32 PID 2648 wrote to memory of 2636 2648 winupd.exe 31 PID 2648 wrote to memory of 2636 2648 winupd.exe 31 PID 2552 wrote to memory of 1384 2552 ipconfig.exe 34 PID 2552 wrote to memory of 1384 2552 ipconfig.exe 34 PID 2552 wrote to memory of 1384 2552 ipconfig.exe 34 PID 2552 wrote to memory of 1384 2552 ipconfig.exe 34 PID 1384 wrote to memory of 2832 1384 cmd.exe 36 PID 1384 wrote to memory of 2832 1384 cmd.exe 36 PID 1384 wrote to memory of 2832 1384 cmd.exe 36 PID 1384 wrote to memory of 2832 1384 cmd.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\f1178b4f455c0e7eaed0a745e73daba143ae288e442de0de7a2f55a3ab1978bc.exe"C:\Users\Admin\AppData\Local\Temp\f1178b4f455c0e7eaed0a745e73daba143ae288e442de0de7a2f55a3ab1978bc.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\f1178b4f455c0e7eaed0a745e73daba143ae288e442de0de7a2f55a3ab1978bc.exe"C:\Users\Admin\AppData\Local\Temp\f1178b4f455c0e7eaed0a745e73daba143ae288e442de0de7a2f55a3ab1978bc.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exeC:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe -notray3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe"C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\system32\ipconfig.exe"5⤵
- System Location Discovery: System Language Discovery
- Gathers network information
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\MPEXVEXN.bat" "6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Windows\SysWOW64\reg.exeREG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WinUpdate /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe -notray" /f7⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2832
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe"C:\Users\Admin\AppData\Roaming\Microsoft\winupd.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2636
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
151B
MD5cac890d00365d07b9ca89def17cc3a36
SHA16fa99679ede791c16b5d3e6d243a98e8bbdb7eab
SHA2564f98ddee89760080a5c8a93666d2f5c97be52b741265ef4d1ce9aaebf05f12da
SHA512124dc0b18e13425bde43bcbbe2a99005928e398bffcb458d498aac9e754bc5b92b703270667800876c60b0801343f2de8c6b9a1eebafd80bb4f6d5dc295dd9f1
-
Filesize
520KB
MD5fc440934dbc299706903f69f95cd5c59
SHA10f742052749c129a88cba18125d0b2ea6f26818d
SHA256c1a678e6a1803732eb1433a02827a5d5b1ba9e020185e06ef497f2831f6f2d42
SHA5120e67c4dfafd08bfe9ca5db3afc6f74443cf4e733f711ba6affc4cc3472132c09817e25e9166fef6aabea6c88b99017a331fec578369178eb08717940ec08543c