Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
25/10/2023, 20:03
231025-ys373sfb27 1025/10/2023, 19:57
231025-ypm2pafa43 1025/10/2023, 19:53
231025-yl4v2aeh84 10Analysis
-
max time kernel
339s -
max time network
400s -
platform
windows10-1703_x64 -
resource
win10-20231020-en -
resource tags
arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system -
submitted
25/10/2023, 20:03
Static task
static1
Behavioral task
behavioral1
Sample
peopledie.msi
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
peopledie.msi
Resource
win10-20231020-en
Behavioral task
behavioral3
Sample
peopledie.msi
Resource
win10v2004-20231020-en
General
-
Target
peopledie.msi
-
Size
7.6MB
-
MD5
377d8d910f7d6747727ca413967d6395
-
SHA1
36aa20471f41b5814e3c1436cd0de3396267a623
-
SHA256
68952e8c311d1573b62d02c60a189e8c248530d4584eef1c7f0ff5ee20d730ab
-
SHA512
15a43cc07fc4b0deb267f8b243e0b23eee8a63d1178b1a23b8cfcfe52fa8a7ebd04a8b588ca19adabfc8ea198166350f3b78765fd1736ca844fd83e93b306c98
-
SSDEEP
98304:kpMKjsEZcgsdUqakFRFawTV82ASqQBW9vpWzxjFycvniqy33XglSB2CiU39XdiC9:M1NsUqai/pTOryNnxyXxBTi4iCo4N
Malware Config
Extracted
darkgate
user_871236672
http://taochinashowwers.com
-
alternative_c2_port
8080
-
anti_analysis
true
-
anti_debug
true
-
anti_vm
true
-
c2_port
2351
-
check_disk
true
-
check_ram
true
-
check_xeon
true
-
crypter_au3
false
-
crypter_dll
false
-
crypter_rawstub
true
-
crypto_key
nOuJEtbQBOlJBY
-
internal_mutex
txtMut
-
minimum_disk
40
-
minimum_ram
7000
-
ping_interval
4
-
rootkit
true
-
startup_persistence
true
-
username
user_871236672
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 4552 windbg.exe 2268 Autoit3.exe -
Loads dropped DLL 3 IoCs
pid Process 2616 MsiExec.exe 4552 windbg.exe 2616 MsiExec.exe -
Modifies file permissions 1 TTPs 2 IoCs
pid Process 2088 ICACLS.EXE 4988 ICACLS.EXE -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\SourceHash{96D4BD60-7079-4480-896B-0B7B3E0C4FDE} msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Logs\DPX\setuperr.log EXPAND.EXE File opened for modification C:\Windows\Installer\MSI5050.tmp msiexec.exe File created C:\Windows\Installer\e58406f.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI4205.tmp msiexec.exe File opened for modification C:\Windows\Logs\DPX\setupact.log EXPAND.EXE File opened for modification C:\Windows\Installer\MSI504F.tmp msiexec.exe File opened for modification C:\Windows\Installer\e58406f.msi msiexec.exe -
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Mfg svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\ svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0052 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceDesc svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\ svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Mfg svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0002 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceDesc svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Capabilities svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\DeviceDesc svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2003 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0064 svchost.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Autoit3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Autoit3.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache svchost.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3744 msiexec.exe 3744 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 53 IoCs
description pid Process Token: SeShutdownPrivilege 5040 msiexec.exe Token: SeIncreaseQuotaPrivilege 5040 msiexec.exe Token: SeSecurityPrivilege 3744 msiexec.exe Token: SeCreateTokenPrivilege 5040 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 5040 msiexec.exe Token: SeLockMemoryPrivilege 5040 msiexec.exe Token: SeIncreaseQuotaPrivilege 5040 msiexec.exe Token: SeMachineAccountPrivilege 5040 msiexec.exe Token: SeTcbPrivilege 5040 msiexec.exe Token: SeSecurityPrivilege 5040 msiexec.exe Token: SeTakeOwnershipPrivilege 5040 msiexec.exe Token: SeLoadDriverPrivilege 5040 msiexec.exe Token: SeSystemProfilePrivilege 5040 msiexec.exe Token: SeSystemtimePrivilege 5040 msiexec.exe Token: SeProfSingleProcessPrivilege 5040 msiexec.exe Token: SeIncBasePriorityPrivilege 5040 msiexec.exe Token: SeCreatePagefilePrivilege 5040 msiexec.exe Token: SeCreatePermanentPrivilege 5040 msiexec.exe Token: SeBackupPrivilege 5040 msiexec.exe Token: SeRestorePrivilege 5040 msiexec.exe Token: SeShutdownPrivilege 5040 msiexec.exe Token: SeDebugPrivilege 5040 msiexec.exe Token: SeAuditPrivilege 5040 msiexec.exe Token: SeSystemEnvironmentPrivilege 5040 msiexec.exe Token: SeChangeNotifyPrivilege 5040 msiexec.exe Token: SeRemoteShutdownPrivilege 5040 msiexec.exe Token: SeUndockPrivilege 5040 msiexec.exe Token: SeSyncAgentPrivilege 5040 msiexec.exe Token: SeEnableDelegationPrivilege 5040 msiexec.exe Token: SeManageVolumePrivilege 5040 msiexec.exe Token: SeImpersonatePrivilege 5040 msiexec.exe Token: SeCreateGlobalPrivilege 5040 msiexec.exe Token: SeBackupPrivilege 3488 vssvc.exe Token: SeRestorePrivilege 3488 vssvc.exe Token: SeAuditPrivilege 3488 vssvc.exe Token: SeBackupPrivilege 3744 msiexec.exe Token: SeRestorePrivilege 3744 msiexec.exe Token: SeRestorePrivilege 3744 msiexec.exe Token: SeTakeOwnershipPrivilege 3744 msiexec.exe Token: SeRestorePrivilege 3744 msiexec.exe Token: SeTakeOwnershipPrivilege 3744 msiexec.exe Token: SeRestorePrivilege 3744 msiexec.exe Token: SeTakeOwnershipPrivilege 3744 msiexec.exe Token: SeRestorePrivilege 3744 msiexec.exe Token: SeTakeOwnershipPrivilege 3744 msiexec.exe Token: SeBackupPrivilege 1808 srtasks.exe Token: SeRestorePrivilege 1808 srtasks.exe Token: SeSecurityPrivilege 1808 srtasks.exe Token: SeTakeOwnershipPrivilege 1808 srtasks.exe Token: SeBackupPrivilege 1808 srtasks.exe Token: SeRestorePrivilege 1808 srtasks.exe Token: SeSecurityPrivilege 1808 srtasks.exe Token: SeTakeOwnershipPrivilege 1808 srtasks.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 5040 msiexec.exe 5040 msiexec.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 3744 wrote to memory of 1808 3744 msiexec.exe 76 PID 3744 wrote to memory of 1808 3744 msiexec.exe 76 PID 3744 wrote to memory of 2616 3744 msiexec.exe 78 PID 3744 wrote to memory of 2616 3744 msiexec.exe 78 PID 3744 wrote to memory of 2616 3744 msiexec.exe 78 PID 2616 wrote to memory of 2088 2616 MsiExec.exe 79 PID 2616 wrote to memory of 2088 2616 MsiExec.exe 79 PID 2616 wrote to memory of 2088 2616 MsiExec.exe 79 PID 2616 wrote to memory of 3200 2616 MsiExec.exe 81 PID 2616 wrote to memory of 3200 2616 MsiExec.exe 81 PID 2616 wrote to memory of 3200 2616 MsiExec.exe 81 PID 2616 wrote to memory of 4552 2616 MsiExec.exe 83 PID 2616 wrote to memory of 4552 2616 MsiExec.exe 83 PID 2616 wrote to memory of 4552 2616 MsiExec.exe 83 PID 4552 wrote to memory of 2268 4552 windbg.exe 84 PID 4552 wrote to memory of 2268 4552 windbg.exe 84 PID 4552 wrote to memory of 2268 4552 windbg.exe 84 PID 2616 wrote to memory of 4988 2616 MsiExec.exe 86 PID 2616 wrote to memory of 4988 2616 MsiExec.exe 86 PID 2616 wrote to memory of 4988 2616 MsiExec.exe 86 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\peopledie.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5040
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:1808
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 17933015E86F6C59CF8F78EC783652D82⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-0d8497e3-6735-4e2e-b666-a21f0587724f\." /SETINTEGRITYLEVEL (CI)(OI)HIGH3⤵
- Modifies file permissions
PID:2088
-
-
C:\Windows\SysWOW64\EXPAND.EXE"C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files3⤵
- Drops file in Windows directory
PID:3200
-
-
C:\Users\Admin\AppData\Local\Temp\MW-0d8497e3-6735-4e2e-b666-a21f0587724f\files\windbg.exe"C:\Users\Admin\AppData\Local\Temp\MW-0d8497e3-6735-4e2e-b666-a21f0587724f\files\windbg.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4552 -
\??\c:\tmpa\Autoit3.exec:\tmpa\Autoit3.exe c:\tmpa\script.au34⤵
- Executes dropped EXE
- Checks processor information in registry
PID:2268
-
-
-
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-0d8497e3-6735-4e2e-b666-a21f0587724f\." /SETINTEGRITYLEVEL (CI)(OI)LOW3⤵
- Modifies file permissions
PID:4988
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3488
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4888
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.4MB
MD5fd55268461849507861a1343fa82b973
SHA1c2ace65d364c0ac66c5b2fe880a613c66c00f35c
SHA2564cf5e9b1cc80a543ae684a863feb93aed225a9e096985fc61ac5b02315e4e4c9
SHA5122fc1481de5b0acce57cb90450142ecd2cfde4e89dd0dc910947587c9306774c41b4c503494910324c50ff802b5b38b9be83803d5ce36ccf358699c67e1f87bef
-
C:\Users\Admin\AppData\Local\Temp\MW-0d8497e3-6735-4e2e-b666-a21f0587724f\files\00147-1040811655.png
Filesize1.3MB
MD57ec930b1536750116c13b06313286cf5
SHA1adc543581e4acbaffd5593d07346296bbda1ede5
SHA2561d18677415ff9d03c8e3accde3ab0786d33985f3d6b3855eca632c07fc4de547
SHA512531887e99339aa19cef104226074cdbfb74d8e31cb535cf232b241f4cb05550ac33504ad58dc9b3eaa2c5dbb0a2eb32e9cc06a754b00618485d625ca4c3415db
-
C:\Users\Admin\AppData\Local\Temp\MW-0d8497e3-6735-4e2e-b666-a21f0587724f\files\00148-1040811656.png
Filesize1.2MB
MD5bb581ea56d0940dc4d002a902e0fb0c9
SHA1226afeb98300bc51a4e80e112b38bfbf9ef8f706
SHA25684e19377a78d441de940eb1943edddc5720aafb67aed7dc30c281b98c3d0a201
SHA5123237d3a234549704af058e64c4e190f07023e44164bae66e31c87a733ed215c827d2c29facce53a1dc781cc31f538f8f17e4a389ca21354c111ed9da04429511
-
Filesize
1.2MB
MD55cf577304c7231e35ab9296db1207993
SHA16deec1a72be8e657dcb484d58e81d138cfd8f25d
SHA256ad7544c407ec1655adc699e70b75b5d75c3a7f28538a9738925b5f020b5e571c
SHA512e1615432911024c9ad9abca3f851a94647f22b2600160dca9ad6ac18c2830d78e6e87f96cc4ecb2d9b597b66b0a7ddf5774299415cc0bd40d4e19741352aa37f
-
Filesize
1.2MB
MD509f104f5af838fc714ba3d17623008b9
SHA1842bcd3e250ab2ee598947ba241cafb274dda591
SHA256caf1252510b1be93214fc9d464a20fdbf81a89839f7e0bc9156190762af3714f
SHA512c37105eeaf8659546922066ffc712f88527adb59954c74381a53afa3623b8bedbdad548f26d3ecfd43cb0f0eca7f052ddf953358ece96d1199ff1e5e76e5604c
-
Filesize
1.1MB
MD564d144051485b81b8a7c83476ba59427
SHA1044bd6b794414b82d1579d309d3762d02e39d292
SHA256f63482d06fbe08336aa1b7b7ec813bad196bba9f60a6a27363a82c9da9cc17f0
SHA512d38f9ca097277cf6500258e16cb183deaa07b10e2060d93810af3eb97e8c97285817b32ab5876d5f42b0ca504dd5b562f421b7eb2ad65be5d950eb52f6ead1db
-
Filesize
92KB
MD58b305b67e45165844d2f8547a085d782
SHA192b8ed7652e61fdf3acb4ce74f48bcc9ed14b722
SHA256776622a88a71b989ae022dae2bfbe52d5f00024970548a465046b742089aa50b
SHA5122bd688ab072464ed54ea111a07e44f130a6db2c51e6f5ede1d8583b31791ad3eb2ea51114e6ac624a50118f17dfd3ec3d72c7df00d8be3b4ef4dcd7b72a0dfe6
-
Filesize
1.8MB
MD5041ffcecc589583aa15167c80b870dca
SHA1edef701de3dcf4202eedb184cacd95e469d50096
SHA256f7acfe746105d694caea7c93feeebb93bb488884988beede93fe3144024361db
SHA5121f45c84375e3c3abeaf03fc1e2806b65d9b27b51e29d587d1ca9ca1e7f7e88feff06c7ae9b85627ec41b8249a95bf9b8f3eb66a097c805b1319874835707c961
-
Filesize
736KB
MD50e15cf36767154814fb8e6b61c726e19
SHA11f7bae6cb38aa8da60723ead126840f49e7af07d
SHA256036ba93b0ffb331a11ce1ddabc19fc6fd41824dd053fdce3c1d3942910480f7b
SHA5124135b5d3f3081369060ee915f8595fd86353277c2910cedd524b1df3494a51d56ef11247efac01770c3d4be43e6911ee1f2f77495d7250dd170c3965a8cd3d58
-
Filesize
474KB
MD504ec4f58a1f4a87b5eeb1f4b7afc48e0
SHA158dcb1cbbec071d036a07f0e8feb858e4c5b96e7
SHA256bd1af3dba56b129e6c624297eeed40c898fa2981fce5caafe467d88a748988a4
SHA5125b572a504fac599e7e3f726d391e8ffdc2d083745609315a203000e8dc79b94d777fc520eb6530444d84f1ac9aad51406b91b527d8434077a58524feeccbbd80
-
Filesize
474KB
MD504ec4f58a1f4a87b5eeb1f4b7afc48e0
SHA158dcb1cbbec071d036a07f0e8feb858e4c5b96e7
SHA256bd1af3dba56b129e6c624297eeed40c898fa2981fce5caafe467d88a748988a4
SHA5125b572a504fac599e7e3f726d391e8ffdc2d083745609315a203000e8dc79b94d777fc520eb6530444d84f1ac9aad51406b91b527d8434077a58524feeccbbd80
-
Filesize
1KB
MD58fbca0757cadde5fbfb4a6971a1b34b7
SHA1ffe06ab6b9964af7f3e184d9ce44cf310fc7b3e3
SHA25646baffac48663804991f287ed7ce9cfea6395b43d6c50c56bd198f26324427de
SHA51284330f5af6720dcabea82522a9e1b4ce6789a750215f11f3847bb829c5a66ff201622404e8a1d4dac1467ca6962a5fcc3494d7c94fb0899edd593328f1adfc90
-
Filesize
330B
MD550e94629df9a5fbb9f40b8a8d0943886
SHA1038d38e6117e38d8b9fc63b39077f1541c1cf8bf
SHA2562640ca269c0f231ebf463dc3ce38d49e2ba9c63065eb0772613dd82db943aa6f
SHA512106c8b224aac26f22117d728bdae7d078ea5484c234f806cd5bf2313c7c854e91b0d54e6c0dbd84a2fdb596d57410efff5c50467c36a59e9bad6bab3d76fac14
-
Filesize
1KB
MD56d6d7ecc57cce080875980c4d121a50d
SHA1d779a461f245adfb5ec767ffab2e1286f02fe0c2
SHA2568b4cef80fbf5c2dbe6378a0fcd1f395a0088ce92c2d55a942559545094e24956
SHA5125c6732c4811a1f5a3ac221d919bc70aced3041c4193c383ed76c23594fccd9692bb99e87b521bafc8308de8173c968334e4054e1e2bd87df7ac03e081597d12a
-
Filesize
1KB
MD56d6d7ecc57cce080875980c4d121a50d
SHA1d779a461f245adfb5ec767ffab2e1286f02fe0c2
SHA2568b4cef80fbf5c2dbe6378a0fcd1f395a0088ce92c2d55a942559545094e24956
SHA5125c6732c4811a1f5a3ac221d919bc70aced3041c4193c383ed76c23594fccd9692bb99e87b521bafc8308de8173c968334e4054e1e2bd87df7ac03e081597d12a
-
Filesize
208KB
MD5d82b3fb861129c5d71f0cd2874f97216
SHA1f3fe341d79224126e950d2691d574d147102b18d
SHA256107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c
SHA512244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b
-
Filesize
208KB
MD5d82b3fb861129c5d71f0cd2874f97216
SHA1f3fe341d79224126e950d2691d574d147102b18d
SHA256107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c
SHA512244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b
-
Filesize
872KB
MD5c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
Filesize
25.0MB
MD57a26020990d253411cce2bededaf6e2f
SHA10e0787a74b65f70ae3bc0fc3d7e5ef3bb98ea92f
SHA2562c450e8adb98cb3cd39b00a6ba2751ea41e3d1f0d3041ac8f1c002f950782af2
SHA5125f869755cdfd92efc4235f07e401399c18d7391d12fd50f2dfeee5870fab8129aaec045b3cace19f19a1fa7036b002824cd5d267c22109af752ed9e57561184b
-
\??\Volume{626007f7-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{dea70a67-72e4-4ab6-b53d-d1e6ab477dfc}_OnDiskSnapshotProp
Filesize5KB
MD5407853665ce387eebe3c973b3479bd26
SHA19fafc83c6d8ad6a41b32578997d15bc0d3f2a8de
SHA2563edbfd3ded071bf4e3d5efa01c872afdbe3a8c2275a32d6facf804852d03c637
SHA5126d3870707a053c1e7aff204fdb57eb38a9fa03d705ef0f6cc0f5e5769d56dd2114606349dd54c042d162c037a18bc6e5789f6448696ce05722b611a6e1628e3c
-
Filesize
489KB
MD5698d299b604f8750aadc3362290ad13e
SHA1117f5e98644c5e905f9f966d9815bd874d23d6b8
SHA256b13b795f369654dd25bc0ffa2bc26b3d2eb07270df04cfd197ffdf8a6c61cde8
SHA512b1190912eafba8a50f39718bbe2197cbdf2743e3961f9da49f68449d87f0660151129c5ad6c9d9841ef53644cf75916abf5df8dba8e7f2d97bd46fa0bf38e69c
-
Filesize
736KB
MD50e15cf36767154814fb8e6b61c726e19
SHA11f7bae6cb38aa8da60723ead126840f49e7af07d
SHA256036ba93b0ffb331a11ce1ddabc19fc6fd41824dd053fdce3c1d3942910480f7b
SHA5124135b5d3f3081369060ee915f8595fd86353277c2910cedd524b1df3494a51d56ef11247efac01770c3d4be43e6911ee1f2f77495d7250dd170c3965a8cd3d58
-
Filesize
208KB
MD5d82b3fb861129c5d71f0cd2874f97216
SHA1f3fe341d79224126e950d2691d574d147102b18d
SHA256107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c
SHA512244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b
-
Filesize
208KB
MD5d82b3fb861129c5d71f0cd2874f97216
SHA1f3fe341d79224126e950d2691d574d147102b18d
SHA256107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c
SHA512244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b