Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    02/02/2024, 01:54

General

  • Target

    mkreafr.msi

  • Size

    4.3MB

  • MD5

    4f238c2093606fc296f1f819c2f0fc67

  • SHA1

    f8535858fcee6b96e0f49e6156fa110fc0698880

  • SHA256

    58e2f786321d58631386654265c8fc5298e1e396c219a424de57a3623b4bd994

  • SHA512

    c2422db8871d6303b5903c4b11cca3debd62cb25a406655db5a0ba407f33c9fef739371d297e5ccad45efc99e040e6ae29079b4b9325f52d54c5e780f8c346f7

  • SSDEEP

    49152:jpUPN9qhCxzT+WKjSXcmNt6+XzP4BYIeBfCXqyfdo1DDDDDDDDDDPuDgO9hTnxA5:jpqCQbm+jg12f3yaiga6yU

Malware Config

Signatures

  • DarkGate

    DarkGate is an infostealer written in C++.

  • Detect DarkGate stealer 3 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 11 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 43 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 53 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\mkreafr.msi
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1712
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2340
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 1CA09951D4FCB24624B652E9F8D081A1
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2972
      • C:\Windows\SysWOW64\ICACLS.EXE
        "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-511e28aa-4797-4600-9c9d-893bf01abafb\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
        3⤵
        • Modifies file permissions
        PID:944
      • C:\Windows\SysWOW64\EXPAND.EXE
        "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
        3⤵
        • Drops file in Windows directory
        PID:1680
      • C:\Users\Admin\AppData\Local\Temp\MW-511e28aa-4797-4600-9c9d-893bf01abafb\files\vlc.exe
        "C:\Users\Admin\AppData\Local\Temp\MW-511e28aa-4797-4600-9c9d-893bf01abafb\files\vlc.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1772
        • \??\c:\temp\Autoit3.exe
          "c:\temp\Autoit3.exe" c:\temp\script.au3
          4⤵
          • Executes dropped EXE
          • Checks processor information in registry
          PID:1048
      • C:\Windows\SysWOW64\ICACLS.EXE
        "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-511e28aa-4797-4600-9c9d-893bf01abafb\." /SETINTEGRITYLEVEL (CI)(OI)LOW
        3⤵
        • Modifies file permissions
        PID:680
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\Admin\AppData\Local\Temp\MW-511e28aa-4797-4600-9c9d-893bf01abafb\files"
        3⤵
          PID:2148
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1852
    • C:\Windows\system32\DrvInst.exe
      DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000550" "0000000000000060"
      1⤵
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:2756

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\MW-511e28aa-4797-4600-9c9d-893bf01abafb\files.cab

      Filesize

      4.0MB

      MD5

      b617d565e52112548d239e32b05eecb4

      SHA1

      5e37585718e80f11c44537f21ecd6d1c45f44c6b

      SHA256

      96146d2cb6aa614ffe3aac47f5e0d8a3bcf28bacb3f27bc9a80a18ede73ac607

      SHA512

      23f2b21f4bb19eba68c39bd93964160f55611686546aee904cac925ee058a6f8f6c6e1f113cdeb7c42ca5375d83de1169051c9a001aeb1f48f322dbe5d6bcd7d

    • C:\Users\Admin\AppData\Local\Temp\MW-511e28aa-4797-4600-9c9d-893bf01abafb\files\libvlc.dll

      Filesize

      958KB

      MD5

      39cab6c9821da8da3963bf66ad6ec03d

      SHA1

      626905d2dfd433a50ef5921c7cb11319d5ca466b

      SHA256

      9892206b147f0d78258a3a632f104c02e4af8a38e70669d8fcc0dfb9a62f91cb

      SHA512

      679eef507be56cfccf63291438290260ae44bb32793fac2731b50f93cb94380178204cca5637e710a76ce1ef64aed678dc497368e162f6bc81eab71bd64578f5

    • C:\Users\Admin\AppData\Local\Temp\MW-511e28aa-4797-4600-9c9d-893bf01abafb\files\sqlite3.dll

      Filesize

      914KB

      MD5

      6a504ba40868b6e1b0973ca37ef690d6

      SHA1

      86c82afa8da7838fd333f3547cf269755c5abf4c

      SHA256

      2e5561fb8d96dbcbffe563e21b7b763521380123b84c3badc42c2f6e69a4cae7

      SHA512

      64dc2062985a087aa21a2c8b40ad53e862c8baf243469e30c731d9986dbeb1d292d3b380a8d17902549d629586a5497da018f4bac6ef0af591f908af1289f4ed

    • C:\Users\Admin\AppData\Local\Temp\MW-511e28aa-4797-4600-9c9d-893bf01abafb\files\vlc.exe

      Filesize

      947KB

      MD5

      af5fbc397ff3268926e9d9eb13d9e89a

      SHA1

      90d1ab2d9ef2d926c0d380747bd17d6e5e8a7836

      SHA256

      9ce2c2d5bfbfe0c37ec78ccd5299be174898eb56de4ea24b60803b497129b8cc

      SHA512

      9468b32c34be6baad198de637304665f571d6babb5fec15698e78c2149c0b5b25b70bcd418975c766ff8ec1deb3f8712b88800bff80bd0ec13fd9125e06ff9dc

    • C:\Users\Admin\AppData\Local\Temp\MW-511e28aa-4797-4600-9c9d-893bf01abafb\files\vlc.exe

      Filesize

      430KB

      MD5

      fe0eebd9b6ef5008e71866e8c2d15614

      SHA1

      7e2bba559aa3e136a092ba7b947165a0c27c7cf7

      SHA256

      59ae2ec9dd0a46fe510ed2b18f790c300f40b9f69be9ad3cf19fbf3504902b55

      SHA512

      38a807305200c6b6e7373d59398d7d53a12571a5b279591b68ab98951cf2efebb5e389da149d828e2e615f83f67bce0d201e0d5fd59849cb801d58abd06ddb60

    • C:\Users\Admin\AppData\Local\Temp\MW-511e28aa-4797-4600-9c9d-893bf01abafb\msiwrapper.ini

      Filesize

      1KB

      MD5

      7c0931e7f41b9e1670beb5055a71b91b

      SHA1

      180504688c4850178d62fa0891be03292f63e2f2

      SHA256

      0b514a82494f412ccf3843a99f5a3ef05babd198e6303f989e27fa2b550da337

      SHA512

      faee392c750170af5b61c3bc719f5f86d9b55888d53d7ae0322169c043ccedff038a7ac79c666f6419466d63392474a3202859d287cf70542634fef6f6489c83

    • C:\temp\Autoit3.exe

      Filesize

      489KB

      MD5

      eab2b2c10cb5be08810ddaac484c8324

      SHA1

      fd1246b4383378774d770d7f20f3deceff7f0d1d

      SHA256

      b95f01afe20639d3cf33847322e4ccfb010a2e6734c680bf24dcb1b432f812a5

      SHA512

      8de2f1216566aaaab3ce429e8bf92b00426a9f31655f26210f62b5ffc5e5a2cbaf7419ea44d82a92c4c30c378ba685a45135987da968f08440dc4f06bf529346

    • \??\c:\temp\script.au3

      Filesize

      126KB

      MD5

      84f7e775b7ab1a35f62f1849d8e623af

      SHA1

      0800e13359e797d63a235ccf53d618db0c24e920

      SHA256

      67f9acd1705d80000bac814c4a16528c6f9d8507057144b299f12a34876fb537

      SHA512

      830e915473da92cfda39d63d8f5a2f7de08f270498f70169f47b8e1b2f460aca7730a8fe5e916365434b0d8eff44cc694552054f1bc2f224c85798f58a79a846

    • \??\c:\temp\test.txt

      Filesize

      76B

      MD5

      eb493e70c279b059272d93eb86156a25

      SHA1

      cc6d75663d2647ce59741958b9334d9319dc1e40

      SHA256

      c5c350d106264a59acb4049244933261da379b6fc5577b519cfc113c83fb1e31

      SHA512

      c4617f8d45d00bf3fbe6a1ab4b25052e2012e2f2783022528d625618956814ab6497a82800f14592eda1886903d88a075ffeff29d72bec8c4817927b9dcac514

    • \Users\Admin\AppData\Local\Temp\MW-511e28aa-4797-4600-9c9d-893bf01abafb\files\libvlc.dll

      Filesize

      495KB

      MD5

      7ba97cea9f8e2865cd9c64443947c6a9

      SHA1

      5d0ce363614a8a8c2518f6a838f7f34b192c752b

      SHA256

      c909f161533fb290e917f587f95f39de6203ae79a4ea66aba5e4a425ae2d4cd0

      SHA512

      a718c0d62957b017407eada86dc05b5e57e4aa72b9a3041ba03bc9a0bff43b9027171a9dc2f346dc13f5e9c0ed9f11b9df4254ce48dbfe856e2ee22dd3b44544

    • \Users\Admin\AppData\Local\Temp\MW-511e28aa-4797-4600-9c9d-893bf01abafb\files\vlc.exe

      Filesize

      639KB

      MD5

      2dc87828e00100c3414871109ab0f930

      SHA1

      907342892ee145a532d09f0f49fff7d13e9d59ba

      SHA256

      9063c509372aeb708d38df987f6be29d544b2a001d5b908ab3202c18165c2326

      SHA512

      64346498a3ae9fd0a599ebca9984906e25e18f23163b57e26f2c80f103eb00779f554e1d5cf32017bff2fabeb4ff07ce32e1bef6bd4af7c9bbb188c3bf272fe5

    • \Windows\Installer\MSI2146.tmp

      Filesize

      208KB

      MD5

      d82b3fb861129c5d71f0cd2874f97216

      SHA1

      f3fe341d79224126e950d2691d574d147102b18d

      SHA256

      107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c

      SHA512

      244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

    • memory/1048-91-0x00000000035F0000-0x00000000045C0000-memory.dmp

      Filesize

      15.8MB

    • memory/1048-94-0x0000000004A70000-0x0000000004DBE000-memory.dmp

      Filesize

      3.3MB

    • memory/1048-92-0x0000000004A70000-0x0000000004DBE000-memory.dmp

      Filesize

      3.3MB

    • memory/1772-78-0x0000000002080000-0x000000000221E000-memory.dmp

      Filesize

      1.6MB

    • memory/1772-86-0x0000000073FC0000-0x000000007414D000-memory.dmp

      Filesize

      1.6MB

    • memory/1772-87-0x0000000002080000-0x000000000221E000-memory.dmp

      Filesize

      1.6MB

    • memory/1772-84-0x000000013F1F0000-0x000000013F2E8000-memory.dmp

      Filesize

      992KB