Malware Analysis Report

2024-11-13 14:53

Sample ID 231122-qke7aacg29
Target 13016592545.zip
SHA256 a2fb0011e13f5c32cc13c95f954e6197373a68a7e724d719304021052374e659
Tags
darkgate discovery stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a2fb0011e13f5c32cc13c95f954e6197373a68a7e724d719304021052374e659

Threat Level: Known bad

The file 13016592545.zip was found to be: Known bad.

Malicious Activity Summary

darkgate discovery stealer

DarkGate

Suspicious use of NtCreateUserProcessOtherParentProcess

Drops startup file

Executes dropped EXE

Modifies file permissions

Loads dropped DLL

Enumerates connected drives

Drops file in Windows directory

Suspicious behavior: EnumeratesProcesses

Checks SCSI registry key(s)

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Uses Volume Shadow Copy service COM API

Modifies data under HKEY_USERS

Suspicious use of WriteProcessMemory

Checks processor information in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-11-22 13:18

Signatures

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2023-11-22 13:18

Reported

2023-11-22 13:21

Platform

win10v2004-20231023-en

Max time kernel

149s

Max time network

154s

Command Line

C:\Windows\System32\RuntimeBroker.exe -Embedding

Signatures

DarkGate

stealer darkgate

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 4780 created 2236 N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe C:\Windows\system32\backgroundTaskHost.exe
PID 4780 created 2508 N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe C:\Windows\system32\svchost.exe
PID 4780 created 2508 N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe C:\Windows\system32\svchost.exe
PID 5716 created 3880 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe C:\Windows\System32\RuntimeBroker.exe
PID 5716 created 2508 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe C:\Windows\system32\svchost.exe
PID 5716 created 2708 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe C:\Windows\system32\taskhostw.exe
PID 5716 created 3692 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe C:\Windows\system32\DllHost.exe
PID 5716 created 4008 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 5716 created 4592 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 5716 created 3880 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe C:\Windows\System32\RuntimeBroker.exe
PID 5716 created 5676 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe C:\Windows\system32\BackgroundTransferHost.exe
PID 5716 created 2708 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe C:\Windows\system32\taskhostw.exe
PID 5716 created 1676 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
PID 5716 created 4592 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
PID 5716 created 1676 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
PID 5716 created 1676 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ehdheeb.lnk C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A
N/A N/A C:\Windows\syswow64\MsiExec.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\ICACLS.EXE N/A
N/A N/A C:\Windows\SysWOW64\ICACLS.EXE N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Installer\e58aaa3.msi C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\inprogressinstallinfo.ipi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIE76E.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSIAC0A.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\LOGS\DPX\setupact.log C:\Windows\SysWOW64\EXPAND.EXE N/A
File opened for modification C:\Windows\LOGS\DPX\setuperr.log C:\Windows\SysWOW64\EXPAND.EXE N/A
File opened for modification C:\Windows\Installer\MSIE77F.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\e58aaa3.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log C:\Windows\system32\msiexec.exe N/A
File created C:\Windows\Installer\SourceHash{229FD164-E132-4ADB-8998-1DB40BF25484} C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\system32\vssvc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters C:\Windows\system32\vssvc.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters C:\Windows\system32\vssvc.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr C:\Windows\system32\vssvc.exe N/A
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000006f5277fd0b2376700000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800006f5277fd0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809006f5277fd000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d6f5277fd000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000006f5277fd00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\system32\vssvc.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe N/A
N/A N/A C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe N/A
N/A N/A C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\srtasks.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\srtasks.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\srtasks.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\srtasks.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\srtasks.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\srtasks.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\srtasks.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\srtasks.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2780 wrote to memory of 4456 N/A C:\Windows\system32\msiexec.exe C:\Windows\system32\srtasks.exe
PID 2780 wrote to memory of 4456 N/A C:\Windows\system32\msiexec.exe C:\Windows\system32\srtasks.exe
PID 2780 wrote to memory of 216 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2780 wrote to memory of 216 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2780 wrote to memory of 216 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 216 wrote to memory of 1900 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\ICACLS.EXE
PID 216 wrote to memory of 1900 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\ICACLS.EXE
PID 216 wrote to memory of 1900 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\ICACLS.EXE
PID 216 wrote to memory of 868 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\EXPAND.EXE
PID 216 wrote to memory of 868 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\EXPAND.EXE
PID 216 wrote to memory of 868 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\EXPAND.EXE
PID 216 wrote to memory of 4780 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe
PID 216 wrote to memory of 4780 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe
PID 216 wrote to memory of 4780 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe
PID 4780 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
PID 4780 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
PID 4780 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
PID 4780 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
PID 4780 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
PID 4780 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
PID 4780 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
PID 4780 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
PID 4780 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
PID 4780 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
PID 4780 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
PID 4780 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
PID 4780 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
PID 4780 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
PID 4780 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
PID 4780 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
PID 4780 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
PID 4780 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
PID 4780 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
PID 4780 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
PID 4780 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
PID 4780 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
PID 4780 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
PID 4780 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
PID 4780 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
PID 4780 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
PID 4780 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
PID 4780 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
PID 4780 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
PID 4780 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
PID 4780 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
PID 4780 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
PID 4780 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
PID 4780 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
PID 4780 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
PID 4780 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
PID 4780 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
PID 4780 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
PID 4780 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
PID 4780 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
PID 4780 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
PID 4780 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
PID 4780 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
PID 4780 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
PID 4780 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
PID 4780 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
PID 4780 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
PID 4780 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
PID 4780 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
PID 4780 wrote to memory of 1676 N/A C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe

"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca

C:\Windows\system32\msiexec.exe

msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\6e068b9dcd8df03fd6456faeb4293c036b91a130a18f86a945c8964a576c1c70.msi

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\srtasks.exe

C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding 52C4119E7F1F16209D4E9C3D49209179

C:\Windows\SysWOW64\ICACLS.EXE

"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\." /SETINTEGRITYLEVEL (CI)(OI)HIGH

C:\Windows\SysWOW64\EXPAND.EXE

"C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files

C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe

"C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe" UGtZgHHT.au3

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe"

C:\Windows\system32\BackgroundTransferHost.exe

"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe"

C:\Windows\SysWOW64\ICACLS.EXE

"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\." /SETINTEGRITYLEVEL (CI)(OI)LOW

C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe

"C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 2.136.104.51.in-addr.arpa udp
US 8.8.8.8:53 254.109.26.67.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 254.178.238.8.in-addr.arpa udp
US 8.8.8.8:53 98.142.81.104.in-addr.arpa udp
US 8.8.8.8:53 178.223.142.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
NL 80.66.88.145:9999 tcp
NL 80.66.88.145:7891 tcp
NL 80.66.88.145:9999 tcp
NL 80.66.88.145:7891 tcp
NL 80.66.88.145:7891 tcp
NL 80.66.88.145:7891 tcp
NL 80.66.88.145:7891 tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
NL 80.66.88.145:7891 tcp
NL 80.66.88.145:7891 tcp
NL 80.66.88.145:7891 tcp
NL 80.66.88.145:7891 tcp
NL 80.66.88.145:7891 tcp
NL 80.66.88.145:7891 tcp
NL 80.66.88.145:9999 tcp
NL 80.66.88.145:7891 tcp
NL 80.66.88.145:7891 tcp
NL 80.66.88.145:7891 tcp
US 8.8.8.8:53 23.173.189.20.in-addr.arpa udp
NL 80.66.88.145:7891 tcp
NL 80.66.88.145:7891 tcp

Files

C:\Windows\Installer\MSIAC0A.tmp

MD5 d82b3fb861129c5d71f0cd2874f97216
SHA1 f3fe341d79224126e950d2691d574d147102b18d
SHA256 107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c
SHA512 244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

C:\Windows\Installer\MSIAC0A.tmp

MD5 d82b3fb861129c5d71f0cd2874f97216
SHA1 f3fe341d79224126e950d2691d574d147102b18d
SHA256 107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c
SHA512 244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\msiwrapper.ini

MD5 2aa2f54e2d31aa68e4e7b3cfb5c8f959
SHA1 4e5b845aa437367380b3ab1b73c8d7f471b48461
SHA256 c99d5d86c98957cad153c3d6faaf5f822d0fd4fa890aa4ca162f4ba48e7e01d2
SHA512 0a90e0b4c69f77f51f32d24f9dfc790ffedfc9be486c63fb023a5e26aea81c53dd68a89fc4693eb27ea40e42f89e2f702af5bfe6ac0f8ce39b30834706e0f7a5

C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\msiwrapper.ini

MD5 a3fff3bd953f2b12c7e4f8116d40f81e
SHA1 4062c0254dad92b8d2f4efe782b40a31fbca0ac4
SHA256 d5145b6f4a56130970bf07561d920c2cbb65103967913659c384fbfd969dd296
SHA512 f40dd7295becb344c289c113ed672d4683e0b7aae7f3666663697b12ea22fb4b078f8a5854f1df0bff3904050b7665599efb6df87ec37a38ac21c50dfb2a0d3c

C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files.cab

MD5 e7c3b16ed93b760546ae6756b12644da
SHA1 99b3b1af70b45b4b815a814f61f9b6e509cd3bb6
SHA256 659733a584c52078ac6b568dfb34a089bef2b3835a5ea737d32c1623a468b743
SHA512 b6eeaaeeb1f7c8335076075bc8033d5d4744544f3937eeaddcbef5f7ba257a64c20a47f8388c1e8f10c5821da8abe0683be8fd60c3e1a9aea25e4a705e2f8b41

C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\msiwrapper.ini

MD5 a3fff3bd953f2b12c7e4f8116d40f81e
SHA1 4062c0254dad92b8d2f4efe782b40a31fbca0ac4
SHA256 d5145b6f4a56130970bf07561d920c2cbb65103967913659c384fbfd969dd296
SHA512 f40dd7295becb344c289c113ed672d4683e0b7aae7f3666663697b12ea22fb4b078f8a5854f1df0bff3904050b7665599efb6df87ec37a38ac21c50dfb2a0d3c

C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe

MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\Autoit3.exe

MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\files\UGtZgHHT.au3

MD5 1b524d03b27b94906c1a87b207e08179
SHA1 8fbad6275708a69b764992b05126e053134fb9e9
SHA256 1af981d9c5128b3657cdb5506d61563e0d1908b957e5dd6842059d6d3cfdc622
SHA512 1e0f2aea5daa40b6cb7df61ba86e0956356ab7b7ecfc9e2934bc85eec8d42d3aeb32858dd0ead24e82ef261a4120f6374263b7af9256eb79a294d51273cc4f6e

memory/4780-73-0x0000000000C10000-0x0000000001010000-memory.dmp

memory/4780-74-0x00000000037E0000-0x00000000038D5000-memory.dmp

memory/4780-79-0x0000000004000000-0x00000000041D9000-memory.dmp

memory/1676-81-0x00000000003D0000-0x00000000003D1000-memory.dmp

memory/1676-82-0x0000000000850000-0x0000000000851000-memory.dmp

memory/4780-102-0x0000000000C10000-0x0000000001010000-memory.dmp

memory/4780-428-0x0000000004000000-0x00000000041D9000-memory.dmp

\??\Volume{fd77526f-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{fdd120c8-3fb4-4060-adf8-65a1dc67dfc9}_OnDiskSnapshotProp

MD5 5725b01ebd0173a7adb42e02bd865edf
SHA1 6abedd046f23f9db20e214c13655b2c37b2de866
SHA256 d56da7b5880b5364277f05d64560cb9e31c86850575530b9bf4d61c93e0911ee
SHA512 ac6ff03b3506f9298d1236ee84a62f7b4d6dc4fdef6d7efad5d43bfdc36c56aedbbbafbb982b278dc76123a2534fc0d5fe084ae5faee9a9ebc4cae3d8fd2e469

\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

MD5 51cff6e392a77aff760278b3842e5d1e
SHA1 1dc7149cd0bdb1559effb3cff33e4135ab1993c9
SHA256 f33863a227d04ad47b7039203540e9d8fe1352cc05a0536363c2ddb10c767a81
SHA512 f7e5bb60cf55eb4a1ba1c9932a21c7be165ae3aa1bb957cc6197862d144bb2c593362848c01dacf33b97c94c2c314d4de351f89b68a0e148d015ed60f131259e

memory/4780-1190-0x0000000004000000-0x00000000041D9000-memory.dmp

memory/5716-1189-0x0000000010490000-0x000000001050E000-memory.dmp

\??\c:\temp\bcgbfbc.au3

MD5 1b524d03b27b94906c1a87b207e08179
SHA1 8fbad6275708a69b764992b05126e053134fb9e9
SHA256 1af981d9c5128b3657cdb5506d61563e0d1908b957e5dd6842059d6d3cfdc622
SHA512 1e0f2aea5daa40b6cb7df61ba86e0956356ab7b7ecfc9e2934bc85eec8d42d3aeb32858dd0ead24e82ef261a4120f6374263b7af9256eb79a294d51273cc4f6e

C:\ProgramData\aeehcfe\kedbbde\fahgehf

MD5 1f612e411a96db68297132b1c0c21e48
SHA1 b55dcc5b5c40bc4db8f5289214619bc003edf4c3
SHA256 393f979ca9506d4a5493c0d20e27a4d1b4f07dea96cbc94eb0afdb7b394fccf2
SHA512 dbde44274d609f9ce6b20e53c39cdcef1a20d4ce9e03f404c106bf45af1c34421bca2cf6083ddda934bd9fc83a171a6b5c315600d5d89cccae983718070a4da0

C:\Users\Admin\AppData\Local\Temp\MW-b2e3a0b2-9692-42ff-88f5-7c18b53f76a3\msiwrapper.ini

MD5 ce92fcbd8b833e755f61d396de97b826
SHA1 0339c5d0a175018d8e93d282eebbad590ed27b93
SHA256 94cb9de1006ead71ecf2420f970d910d637dbfbc80c94a5e181c75438ee06e29
SHA512 4cc6f39f8e1242394cc278206ac2e6165ef378ca585e98daa7062440797945801990c94b68bdb71d0ce0154d9295704021beba28860afd074bcaa487df7b4e5c

C:\Windows\Installer\MSIE77F.tmp

MD5 d82b3fb861129c5d71f0cd2874f97216
SHA1 f3fe341d79224126e950d2691d574d147102b18d
SHA256 107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c
SHA512 244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

C:\Windows\Installer\MSIE77F.tmp

MD5 d82b3fb861129c5d71f0cd2874f97216
SHA1 f3fe341d79224126e950d2691d574d147102b18d
SHA256 107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c
SHA512 244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

C:\ProgramData\aeehcfe\Autoit3.exe

MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

memory/6488-1227-0x0000000000740000-0x0000000000741000-memory.dmp

memory/6488-1228-0x00000000005C0000-0x00000000005C1000-memory.dmp

C:\ProgramData\aeehcfe\bcgbfbc.au3

MD5 688fa612182c6f8f22cb8371121f0526
SHA1 233bc0845fe799c6b2d50d5b7899f8118c3668f2
SHA256 7ba02940ead9a8f8e4c5c51fd27667447ffe2aeb8485cb594c8747c517fd8288
SHA512 176a23a5ba88b9ae067200346afb39f33c744982aa0ca8da017e9b88ca56bd4f5c065cce98962f29e530a6d7dce591cb02d10a4ce24bb5b0de7c4cf28746fc6e

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ehdheeb.lnk

MD5 7aed69fb8f87dc3f0db9235528913690
SHA1 f72dd15fa4d897f3021f2418529ed3d2331c0dca
SHA256 30c40dee7a81d9ec4baa91d2860b921b63e22877cf385d8ab261d4c428e0ea37
SHA512 4d715b8157bd9755d6170c159f8bdffaa635729e99cca09db476dc78ee14a39911c753daa86b144c3d58cdf14a33d66ba2f4057fb3ba9b44cd436e53a3e65476

memory/5716-1544-0x0000000010490000-0x000000001050E000-memory.dmp

memory/6488-1821-0x0000000010410000-0x000000001048E000-memory.dmp

C:\ProgramData\aeehcfe\bcgbfbc.au3

MD5 688fa612182c6f8f22cb8371121f0526
SHA1 233bc0845fe799c6b2d50d5b7899f8118c3668f2
SHA256 7ba02940ead9a8f8e4c5c51fd27667447ffe2aeb8485cb594c8747c517fd8288
SHA512 176a23a5ba88b9ae067200346afb39f33c744982aa0ca8da017e9b88ca56bd4f5c065cce98962f29e530a6d7dce591cb02d10a4ce24bb5b0de7c4cf28746fc6e

C:\ProgramData\aeehcfe\kedbbde\fahgehf

MD5 9c45402f68996114291fe559f24768b4
SHA1 f8e21106fce9da2fbcda78cf4c78173014bf2975
SHA256 e6e5cac1bafdebea0ed5cccfe4b13b3219515ba1477288c5f6107c19caeea8f4
SHA512 1e542eb0739ccf678e9a37fc72550feb95ec7f25edd81b6b3f74b38d801e1912c9cf60364576ef5117d416db9016d222658cede52ad47b6e32203ab0626ddfe1

memory/6488-1868-0x0000000010410000-0x000000001048E000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2023-11-22 13:18

Reported

2023-11-22 13:21

Platform

win7-20231020-en

Max time kernel

122s

Max time network

126s

Command Line

msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\6e068b9dcd8df03fd6456faeb4293c036b91a130a18f86a945c8964a576c1c70.msi

Signatures

DarkGate

stealer darkgate

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\MW-dbdd4774-2ad5-4609-9e70-1971c12ec37f\files\Autoit3.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\ICACLS.EXE N/A
N/A N/A C:\Windows\SysWOW64\ICACLS.EXE N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\B: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\R: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\W: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\J: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\I: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\M: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\T: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\V: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\E: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\P: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\U: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\H: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\L: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\N: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\S: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Y: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Z: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\Q: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\X: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\G: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\K: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\O: C:\Windows\system32\msiexec.exe N/A
File opened (read-only) \??\A: C:\Windows\system32\msiexec.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Installer\MSI9DF6.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\f768e4b.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\ C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\MSI901F.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Logs\DPX\setupact.log C:\Windows\SysWOW64\EXPAND.EXE N/A
File opened for modification C:\Windows\INF\setupapi.ev1 C:\Windows\system32\DrvInst.exe N/A
File created C:\Windows\Installer\f768e4c.ipi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Logs\DPX\setuperr.log C:\Windows\SysWOW64\EXPAND.EXE N/A
File opened for modification C:\Windows\Installer\MSI9DC6.tmp C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\Installer\f768e4c.ipi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\INF\setupapi.ev3 C:\Windows\system32\DrvInst.exe N/A
File created C:\Windows\Installer\f768e4b.msi C:\Windows\system32\msiexec.exe N/A
File opened for modification C:\Windows\INF\setupapi.dev.log C:\Windows\system32\DrvInst.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\system32\DrvInst.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\system32\DrvInst.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\system32\DrvInst.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateTokenPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeMachineAccountPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTcbPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreatePermanentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeChangeNotifyPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeSyncAgentPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeEnableDelegationPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeImpersonatePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\DrvInst.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\system32\msiexec.exe N/A
N/A N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 840 wrote to memory of 2124 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 840 wrote to memory of 2124 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 840 wrote to memory of 2124 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 840 wrote to memory of 2124 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 840 wrote to memory of 2124 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 840 wrote to memory of 2124 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 840 wrote to memory of 2124 N/A C:\Windows\system32\msiexec.exe C:\Windows\syswow64\MsiExec.exe
PID 2124 wrote to memory of 1860 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\ICACLS.EXE
PID 2124 wrote to memory of 1860 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\ICACLS.EXE
PID 2124 wrote to memory of 1860 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\ICACLS.EXE
PID 2124 wrote to memory of 1860 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\ICACLS.EXE
PID 2124 wrote to memory of 324 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\EXPAND.EXE
PID 2124 wrote to memory of 324 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\EXPAND.EXE
PID 2124 wrote to memory of 324 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\EXPAND.EXE
PID 2124 wrote to memory of 324 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\EXPAND.EXE
PID 2124 wrote to memory of 2640 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\MW-dbdd4774-2ad5-4609-9e70-1971c12ec37f\files\Autoit3.exe
PID 2124 wrote to memory of 2640 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\MW-dbdd4774-2ad5-4609-9e70-1971c12ec37f\files\Autoit3.exe
PID 2124 wrote to memory of 2640 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\MW-dbdd4774-2ad5-4609-9e70-1971c12ec37f\files\Autoit3.exe
PID 2124 wrote to memory of 2640 N/A C:\Windows\syswow64\MsiExec.exe C:\Users\Admin\AppData\Local\Temp\MW-dbdd4774-2ad5-4609-9e70-1971c12ec37f\files\Autoit3.exe
PID 2124 wrote to memory of 2236 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\ICACLS.EXE
PID 2124 wrote to memory of 2236 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\ICACLS.EXE
PID 2124 wrote to memory of 2236 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\ICACLS.EXE
PID 2124 wrote to memory of 2236 N/A C:\Windows\syswow64\MsiExec.exe C:\Windows\SysWOW64\ICACLS.EXE

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Windows\system32\msiexec.exe

msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\6e068b9dcd8df03fd6456faeb4293c036b91a130a18f86a945c8964a576c1c70.msi

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\DrvInst.exe

DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000004A0" "00000000000005BC"

C:\Windows\syswow64\MsiExec.exe

C:\Windows\syswow64\MsiExec.exe -Embedding DCA8D0205FF38529D703CEB118A486DB

C:\Windows\SysWOW64\ICACLS.EXE

"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-dbdd4774-2ad5-4609-9e70-1971c12ec37f\." /SETINTEGRITYLEVEL (CI)(OI)HIGH

C:\Windows\SysWOW64\EXPAND.EXE

"C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files

C:\Users\Admin\AppData\Local\Temp\MW-dbdd4774-2ad5-4609-9e70-1971c12ec37f\files\Autoit3.exe

"C:\Users\Admin\AppData\Local\Temp\MW-dbdd4774-2ad5-4609-9e70-1971c12ec37f\files\Autoit3.exe" UGtZgHHT.au3

C:\Windows\SysWOW64\ICACLS.EXE

"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-dbdd4774-2ad5-4609-9e70-1971c12ec37f\." /SETINTEGRITYLEVEL (CI)(OI)LOW

Network

N/A

Files

C:\Windows\Installer\MSI901F.tmp

MD5 d82b3fb861129c5d71f0cd2874f97216
SHA1 f3fe341d79224126e950d2691d574d147102b18d
SHA256 107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c
SHA512 244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

\Windows\Installer\MSI901F.tmp

MD5 d82b3fb861129c5d71f0cd2874f97216
SHA1 f3fe341d79224126e950d2691d574d147102b18d
SHA256 107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c
SHA512 244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

C:\Users\Admin\AppData\Local\Temp\MW-dbdd4774-2ad5-4609-9e70-1971c12ec37f\msiwrapper.ini

MD5 392061069d4e1ac2f932e1166aa92072
SHA1 823549932cc4c9ce57065205a3cca78fe679524c
SHA256 5b4a0c80c9cb484b343b94c7dce9ceb86446b3c9fe8a342e2fe023fbc32b9377
SHA512 e2bd003166f9b580e47f351154f778733106f9d55f7351a4dedfcce0be9d86a90e8b267fb3ef9626cbb1d1440821c2e796f4fc617bef1c7461e7ec768fd9d97d

C:\Users\Admin\AppData\Local\Temp\MW-dbdd4774-2ad5-4609-9e70-1971c12ec37f\files.cab

MD5 e7c3b16ed93b760546ae6756b12644da
SHA1 99b3b1af70b45b4b815a814f61f9b6e509cd3bb6
SHA256 659733a584c52078ac6b568dfb34a089bef2b3835a5ea737d32c1623a468b743
SHA512 b6eeaaeeb1f7c8335076075bc8033d5d4744544f3937eeaddcbef5f7ba257a64c20a47f8388c1e8f10c5821da8abe0683be8fd60c3e1a9aea25e4a705e2f8b41

C:\Users\Admin\AppData\Local\Temp\MW-dbdd4774-2ad5-4609-9e70-1971c12ec37f\msiwrapper.ini

MD5 392061069d4e1ac2f932e1166aa92072
SHA1 823549932cc4c9ce57065205a3cca78fe679524c
SHA256 5b4a0c80c9cb484b343b94c7dce9ceb86446b3c9fe8a342e2fe023fbc32b9377
SHA512 e2bd003166f9b580e47f351154f778733106f9d55f7351a4dedfcce0be9d86a90e8b267fb3ef9626cbb1d1440821c2e796f4fc617bef1c7461e7ec768fd9d97d

\Users\Admin\AppData\Local\Temp\MW-dbdd4774-2ad5-4609-9e70-1971c12ec37f\files\Autoit3.exe

MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

C:\Users\Admin\AppData\Local\Temp\MW-dbdd4774-2ad5-4609-9e70-1971c12ec37f\files\Autoit3.exe

MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

C:\Users\Admin\AppData\Local\Temp\MW-dbdd4774-2ad5-4609-9e70-1971c12ec37f\files\Autoit3.exe

MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

\Users\Admin\AppData\Local\Temp\MW-dbdd4774-2ad5-4609-9e70-1971c12ec37f\files\Autoit3.exe

MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

\Users\Admin\AppData\Local\Temp\MW-dbdd4774-2ad5-4609-9e70-1971c12ec37f\files\Autoit3.exe

MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

\Users\Admin\AppData\Local\Temp\MW-dbdd4774-2ad5-4609-9e70-1971c12ec37f\files\Autoit3.exe

MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

C:\Users\Admin\AppData\Local\Temp\MW-dbdd4774-2ad5-4609-9e70-1971c12ec37f\files\UGtZgHHT.au3

MD5 1b524d03b27b94906c1a87b207e08179
SHA1 8fbad6275708a69b764992b05126e053134fb9e9
SHA256 1af981d9c5128b3657cdb5506d61563e0d1908b957e5dd6842059d6d3cfdc622
SHA512 1e0f2aea5daa40b6cb7df61ba86e0956356ab7b7ecfc9e2934bc85eec8d42d3aeb32858dd0ead24e82ef261a4120f6374263b7af9256eb79a294d51273cc4f6e

memory/2640-77-0x00000000008C0000-0x0000000000CC0000-memory.dmp

memory/2640-76-0x00000000031E0000-0x00000000033B9000-memory.dmp

memory/2640-78-0x0000000002A00000-0x0000000002AF5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\MW-dbdd4774-2ad5-4609-9e70-1971c12ec37f\msiwrapper.ini

MD5 4db397462165166f21bd4e521d1452e3
SHA1 6f1cfb9e7581f4d9ac355cd04078d1f6d3513fc1
SHA256 ed2904514170881ed938f02ecb281ec2712f2c4222b10b8382b198cf1c39260b
SHA512 ae3a66dd811dd954b310e6769a8084a3f999d96a8ca0852be4b172fb250f8aea9a747c085b643c85f294dc6eb70bc91d9e5337c41db4217b8fc2c5054ad65615

C:\Windows\Installer\MSI9DF6.tmp

MD5 d82b3fb861129c5d71f0cd2874f97216
SHA1 f3fe341d79224126e950d2691d574d147102b18d
SHA256 107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c
SHA512 244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

\Windows\Installer\MSI9DF6.tmp

MD5 d82b3fb861129c5d71f0cd2874f97216
SHA1 f3fe341d79224126e950d2691d574d147102b18d
SHA256 107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c
SHA512 244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b