Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
03/01/2025, 13:45
Behavioral task
behavioral1
Sample
b6a28bc8e0b60a4c9fcc7978755bf9a2085bdcca025e13d04b21beea4f7096ceN.exe
Resource
win7-20241010-en
General
-
Target
b6a28bc8e0b60a4c9fcc7978755bf9a2085bdcca025e13d04b21beea4f7096ceN.exe
-
Size
576KB
-
MD5
c98a496cbab8c3521abcd832dcf368c0
-
SHA1
38b0b63ed6bdbadb4cc0682a1be2901d23a03cc8
-
SHA256
b6a28bc8e0b60a4c9fcc7978755bf9a2085bdcca025e13d04b21beea4f7096ce
-
SHA512
d4ff9c0cc2447a22e47f4c63e6b887505300dfb752a8dc688c72ccc39196e43f4a86bd86a1a4efbfef5a8012584cf76b1c69ff9071d814860156ed9ebd0e1156
-
SSDEEP
12288:+NWPkHlUkErBuxQ4uzi6d6dL/yiXLzeMdK6io8levy0FhVlpzkzDDoSA:+NWPkHlUfBgpuPdWzyuDTifgyWlX
Malware Config
Signatures
-
Darkcomet family
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate mcsft.exe -
Executes dropped EXE 2 IoCs
pid Process 2940 mcsft.exe 2996 mcsft.exe -
Loads dropped DLL 6 IoCs
pid Process 524 b6a28bc8e0b60a4c9fcc7978755bf9a2085bdcca025e13d04b21beea4f7096ceN.exe 524 b6a28bc8e0b60a4c9fcc7978755bf9a2085bdcca025e13d04b21beea4f7096ceN.exe 524 b6a28bc8e0b60a4c9fcc7978755bf9a2085bdcca025e13d04b21beea4f7096ceN.exe 524 b6a28bc8e0b60a4c9fcc7978755bf9a2085bdcca025e13d04b21beea4f7096ceN.exe 524 b6a28bc8e0b60a4c9fcc7978755bf9a2085bdcca025e13d04b21beea4f7096ceN.exe 2940 mcsft.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Mcrosoft = "C:\\Users\\Admin\\AppData\\Roaming\\mcsft.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2940 set thread context of 2996 2940 mcsft.exe 35 -
resource yara_rule behavioral1/memory/524-0-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral1/files/0x0009000000016ace-42.dat upx behavioral1/memory/524-44-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral1/memory/2940-46-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral1/memory/2940-56-0x0000000000400000-0x00000000007C8000-memory.dmp upx behavioral1/memory/2996-57-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2996-55-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2996-52-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2996-58-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2996-59-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2996-60-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2996-63-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2996-62-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2996-61-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2996-64-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/524-65-0x0000000003510000-0x00000000038D8000-memory.dmp upx behavioral1/memory/2996-66-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2996-67-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2996-68-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2996-69-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2996-70-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2996-71-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2996-72-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2996-73-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2996-74-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2996-75-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2996-76-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2996-77-0x0000000000400000-0x00000000004B5000-memory.dmp upx behavioral1/memory/2996-78-0x0000000000400000-0x00000000004B5000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b6a28bc8e0b60a4c9fcc7978755bf9a2085bdcca025e13d04b21beea4f7096ceN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mcsft.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mcsft.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier mcsft.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier mcsft.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 mcsft.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier mcsft.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2996 mcsft.exe Token: SeSecurityPrivilege 2996 mcsft.exe Token: SeTakeOwnershipPrivilege 2996 mcsft.exe Token: SeLoadDriverPrivilege 2996 mcsft.exe Token: SeSystemProfilePrivilege 2996 mcsft.exe Token: SeSystemtimePrivilege 2996 mcsft.exe Token: SeProfSingleProcessPrivilege 2996 mcsft.exe Token: SeIncBasePriorityPrivilege 2996 mcsft.exe Token: SeCreatePagefilePrivilege 2996 mcsft.exe Token: SeBackupPrivilege 2996 mcsft.exe Token: SeRestorePrivilege 2996 mcsft.exe Token: SeShutdownPrivilege 2996 mcsft.exe Token: SeDebugPrivilege 2996 mcsft.exe Token: SeSystemEnvironmentPrivilege 2996 mcsft.exe Token: SeChangeNotifyPrivilege 2996 mcsft.exe Token: SeRemoteShutdownPrivilege 2996 mcsft.exe Token: SeUndockPrivilege 2996 mcsft.exe Token: SeManageVolumePrivilege 2996 mcsft.exe Token: SeImpersonatePrivilege 2996 mcsft.exe Token: SeCreateGlobalPrivilege 2996 mcsft.exe Token: 33 2996 mcsft.exe Token: 34 2996 mcsft.exe Token: 35 2996 mcsft.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 524 b6a28bc8e0b60a4c9fcc7978755bf9a2085bdcca025e13d04b21beea4f7096ceN.exe 2940 mcsft.exe 2996 mcsft.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 524 wrote to memory of 2388 524 b6a28bc8e0b60a4c9fcc7978755bf9a2085bdcca025e13d04b21beea4f7096ceN.exe 31 PID 524 wrote to memory of 2388 524 b6a28bc8e0b60a4c9fcc7978755bf9a2085bdcca025e13d04b21beea4f7096ceN.exe 31 PID 524 wrote to memory of 2388 524 b6a28bc8e0b60a4c9fcc7978755bf9a2085bdcca025e13d04b21beea4f7096ceN.exe 31 PID 524 wrote to memory of 2388 524 b6a28bc8e0b60a4c9fcc7978755bf9a2085bdcca025e13d04b21beea4f7096ceN.exe 31 PID 2388 wrote to memory of 2768 2388 cmd.exe 33 PID 2388 wrote to memory of 2768 2388 cmd.exe 33 PID 2388 wrote to memory of 2768 2388 cmd.exe 33 PID 2388 wrote to memory of 2768 2388 cmd.exe 33 PID 524 wrote to memory of 2940 524 b6a28bc8e0b60a4c9fcc7978755bf9a2085bdcca025e13d04b21beea4f7096ceN.exe 34 PID 524 wrote to memory of 2940 524 b6a28bc8e0b60a4c9fcc7978755bf9a2085bdcca025e13d04b21beea4f7096ceN.exe 34 PID 524 wrote to memory of 2940 524 b6a28bc8e0b60a4c9fcc7978755bf9a2085bdcca025e13d04b21beea4f7096ceN.exe 34 PID 524 wrote to memory of 2940 524 b6a28bc8e0b60a4c9fcc7978755bf9a2085bdcca025e13d04b21beea4f7096ceN.exe 34 PID 2940 wrote to memory of 2996 2940 mcsft.exe 35 PID 2940 wrote to memory of 2996 2940 mcsft.exe 35 PID 2940 wrote to memory of 2996 2940 mcsft.exe 35 PID 2940 wrote to memory of 2996 2940 mcsft.exe 35 PID 2940 wrote to memory of 2996 2940 mcsft.exe 35 PID 2940 wrote to memory of 2996 2940 mcsft.exe 35 PID 2940 wrote to memory of 2996 2940 mcsft.exe 35 PID 2940 wrote to memory of 2996 2940 mcsft.exe 35 PID 2940 wrote to memory of 2996 2940 mcsft.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\b6a28bc8e0b60a4c9fcc7978755bf9a2085bdcca025e13d04b21beea4f7096ceN.exe"C:\Users\Admin\AppData\Local\Temp\b6a28bc8e0b60a4c9fcc7978755bf9a2085bdcca025e13d04b21beea4f7096ceN.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:524 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\YHdRA.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Mcrosoft" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\mcsft.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2768
-
-
-
C:\Users\Admin\AppData\Roaming\mcsft.exe"C:\Users\Admin\AppData\Roaming\mcsft.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Roaming\mcsft.exeC:\Users\Admin\AppData\Roaming\mcsft.exe3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2996
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135B
MD5a5feca573884d76f559b996d45e8ad9a
SHA10e81a993f3af4e31d60653dc2513186f0495f1c8
SHA256c98e20d46d6465febb5d29cfab51241521ea5d6cd621f5e18b9b7d6fbfac3f0f
SHA512a9239648b5f15eac4d4151b6e1bdc81065eeaeb101404c2a0126f03bc87f1e6a57206bfa07a44379e9d3bba889e4497a9991ff41fb109099b01512df3dc3cbda
-
Filesize
576KB
MD5f82d1ee070d71fbce51ddc3f1792efc7
SHA1dd531188d42a069d9b6ae01fab447244e8085cea
SHA25611bb853b2141932b2c557bd122f865852d918a8cdffeda672a6832a64616d2fa
SHA5120700226823c39f6d6c0081677ad991cccc7efd0830ae253c59f03fcdcb4a3e218671978180c54c33b7bf838e2246c8f6aae1a774d318ee5238ad46af402987a2