darkgate | 14ca3dc03e22d3794c7f7c133426128ad4f4fdcc907febcf3954e53b1acb1e9f

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
02-02-2024 01:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mkreafr.msi
Size

4.3MB
MD5

4f238c2093606fc296f1f819c2f0fc67
SHA1

f8535858fcee6b96e0f49e6156fa110fc0698880
SHA256

58e2f786321d58631386654265c8fc5298e1e396c219a424de57a3623b4bd994
SHA512

c2422db8871d6303b5903c4b11cca3debd62cb25a406655db5a0ba407f33c9fef739371d297e5ccad45efc99e040e6ae29079b4b9325f52d54c5e780f8c346f7
SSDEEP

49152:jpUPN9qhCxzT+WKjSXcmNt6+XzP4BYIeBfCXqyfdo1DDDDDDDDDDPuDgO9hTnxA5:jpqCQbm+jg12f3yaiga6yU

Score

10^/10

darkgate discovery persistence stealer

Malware Config

Signatures

DarkGate
DarkGate is an infostealer written in C++.
stealer darkgate

Detect DarkGate stealer 38 IoCs

resource	yara_rule
behavioral2/memory/4304-102-0x0000000005A70000-0x0000000005DBE000-memory.dmp	family_darkgate_v6
behavioral2/memory/2156-110-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/2156-111-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/2156-114-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/2156-109-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/4304-115-0x0000000005A70000-0x0000000005DBE000-memory.dmp	family_darkgate_v6
behavioral2/memory/2156-122-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/2156-120-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/2156-125-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/3908-128-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/3908-130-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/2156-127-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/2156-131-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/3908-132-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/2156-133-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/3908-134-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/2156-135-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/3908-136-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/2156-137-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/3908-138-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/2156-142-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/3908-143-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/2156-144-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/3908-145-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/2156-146-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/3908-147-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/2156-148-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/3908-149-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/2156-150-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/3908-151-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/2156-152-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/3908-153-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/2156-154-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/3908-155-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/2156-156-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/3908-157-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/2156-158-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6
behavioral2/memory/3908-159-0x0000000000400000-0x0000000000470000-memory.dmp	family_darkgate_v6

Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs

description	pid	Process	procid_target
PID 4304 created 3848	4304	Autoit3.exe	24
PID 4304 created 4004	4304	Autoit3.exe	37
PID 4304 created 2676	4304	Autoit3.exe	20
PID 2156 created 3848	2156	vbc.exe	24
PID 2156 created 2608	2156	vbc.exe	58

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4532	ICACLS.EXE
4492	ICACLS.EXE

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ecehEhD = "C:\\ProgramData\\kebedkh\\Autoit3.exe C:\\ProgramData\\kebedkh\\ggadfbe.au3"	vbc.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4304 set thread context of 2156	4304	Autoit3.exe	113
PID 2156 set thread context of 3908	2156	vbc.exe	114

Drops file in Windows directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI7EE5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e577956.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C981FA65-5B96-43D1-A20F-242E2E4BB3E1}	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7A02.tmp	msiexec.exe
File created	C:\Windows\Installer\e577956.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\LOGS\DPX\setupact.log	EXPAND.EXE
File opened for modification	C:\Windows\LOGS\DPX\setuperr.log	EXPAND.EXE
File opened for modification	C:\Windows\Installer\MSI7EE6.tmp	msiexec.exe

Executes dropped EXE 2 IoCs

pid	Process
4032	vlc.exe
4304	Autoit3.exe

Loads dropped DLL 3 IoCs

pid	Process
1528	MsiExec.exe
4032	vlc.exe
1528	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000da362e54a03ebf190000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000da362e540000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900da362e54000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dda362e54000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000da362e5400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	vbc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Autoit3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Autoit3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	vbc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	vbc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	vbc.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
4960	msiexec.exe
4960	msiexec.exe
4304	Autoit3.exe
4304	Autoit3.exe
4304	Autoit3.exe
4304	Autoit3.exe
4304	Autoit3.exe
4304	Autoit3.exe
4304	Autoit3.exe
4304	Autoit3.exe
4304	Autoit3.exe
4304	Autoit3.exe
2156	vbc.exe
2156	vbc.exe
2156	vbc.exe
2156	vbc.exe
2156	vbc.exe
2156	vbc.exe
3908	vbc.exe
3908	vbc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2156	vbc.exe

Suspicious use of AdjustPrivilegeToken 53 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2288	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2288	msiexec.exe
Token: SeSecurityPrivilege	4960	msiexec.exe
Token: SeCreateTokenPrivilege	2288	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2288	msiexec.exe
Token: SeLockMemoryPrivilege	2288	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2288	msiexec.exe
Token: SeMachineAccountPrivilege	2288	msiexec.exe
Token: SeTcbPrivilege	2288	msiexec.exe
Token: SeSecurityPrivilege	2288	msiexec.exe
Token: SeTakeOwnershipPrivilege	2288	msiexec.exe
Token: SeLoadDriverPrivilege	2288	msiexec.exe
Token: SeSystemProfilePrivilege	2288	msiexec.exe
Token: SeSystemtimePrivilege	2288	msiexec.exe
Token: SeProfSingleProcessPrivilege	2288	msiexec.exe
Token: SeIncBasePriorityPrivilege	2288	msiexec.exe
Token: SeCreatePagefilePrivilege	2288	msiexec.exe
Token: SeCreatePermanentPrivilege	2288	msiexec.exe
Token: SeBackupPrivilege	2288	msiexec.exe
Token: SeRestorePrivilege	2288	msiexec.exe
Token: SeShutdownPrivilege	2288	msiexec.exe
Token: SeDebugPrivilege	2288	msiexec.exe
Token: SeAuditPrivilege	2288	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2288	msiexec.exe
Token: SeChangeNotifyPrivilege	2288	msiexec.exe
Token: SeRemoteShutdownPrivilege	2288	msiexec.exe
Token: SeUndockPrivilege	2288	msiexec.exe
Token: SeSyncAgentPrivilege	2288	msiexec.exe
Token: SeEnableDelegationPrivilege	2288	msiexec.exe
Token: SeManageVolumePrivilege	2288	msiexec.exe
Token: SeImpersonatePrivilege	2288	msiexec.exe
Token: SeCreateGlobalPrivilege	2288	msiexec.exe
Token: SeBackupPrivilege	3564	vssvc.exe
Token: SeRestorePrivilege	3564	vssvc.exe
Token: SeAuditPrivilege	3564	vssvc.exe
Token: SeBackupPrivilege	4960	msiexec.exe
Token: SeRestorePrivilege	4960	msiexec.exe
Token: SeRestorePrivilege	4960	msiexec.exe
Token: SeTakeOwnershipPrivilege	4960	msiexec.exe
Token: SeRestorePrivilege	4960	msiexec.exe
Token: SeTakeOwnershipPrivilege	4960	msiexec.exe
Token: SeBackupPrivilege	3512	srtasks.exe
Token: SeRestorePrivilege	3512	srtasks.exe
Token: SeSecurityPrivilege	3512	srtasks.exe
Token: SeTakeOwnershipPrivilege	3512	srtasks.exe
Token: SeBackupPrivilege	3512	srtasks.exe
Token: SeRestorePrivilege	3512	srtasks.exe
Token: SeSecurityPrivilege	3512	srtasks.exe
Token: SeTakeOwnershipPrivilege	3512	srtasks.exe
Token: SeRestorePrivilege	4960	msiexec.exe
Token: SeTakeOwnershipPrivilege	4960	msiexec.exe
Token: SeRestorePrivilege	4960	msiexec.exe
Token: SeTakeOwnershipPrivilege	4960	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2288	msiexec.exe
2288	msiexec.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 3512	4960	msiexec.exe	102
PID 4960 wrote to memory of 3512	4960	msiexec.exe	102
PID 4960 wrote to memory of 1528	4960	msiexec.exe	104
PID 4960 wrote to memory of 1528	4960	msiexec.exe	104
PID 4960 wrote to memory of 1528	4960	msiexec.exe	104
PID 1528 wrote to memory of 4532	1528	MsiExec.exe	105
PID 1528 wrote to memory of 4532	1528	MsiExec.exe	105
PID 1528 wrote to memory of 4532	1528	MsiExec.exe	105
PID 1528 wrote to memory of 1384	1528	MsiExec.exe	108
PID 1528 wrote to memory of 1384	1528	MsiExec.exe	108
PID 1528 wrote to memory of 1384	1528	MsiExec.exe	108
PID 1528 wrote to memory of 4032	1528	MsiExec.exe	109
PID 1528 wrote to memory of 4032	1528	MsiExec.exe	109
PID 4032 wrote to memory of 4304	4032	vlc.exe	112
PID 4032 wrote to memory of 4304	4032	vlc.exe	112
PID 4032 wrote to memory of 4304	4032	vlc.exe	112
PID 1528 wrote to memory of 4492	1528	MsiExec.exe	111
PID 1528 wrote to memory of 4492	1528	MsiExec.exe	111
PID 1528 wrote to memory of 4492	1528	MsiExec.exe	111
PID 4304 wrote to memory of 2156	4304	Autoit3.exe	113
PID 4304 wrote to memory of 2156	4304	Autoit3.exe	113
PID 4304 wrote to memory of 2156	4304	Autoit3.exe	113
PID 4304 wrote to memory of 2156	4304	Autoit3.exe	113
PID 4304 wrote to memory of 2156	4304	Autoit3.exe	113
PID 2156 wrote to memory of 3908	2156	vbc.exe	114
PID 2156 wrote to memory of 3908	2156	vbc.exe	114
PID 2156 wrote to memory of 3908	2156	vbc.exe	114
PID 2156 wrote to memory of 3908	2156	vbc.exe	114
PID 2156 wrote to memory of 3908	2156	vbc.exe	114

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2676
- \??\c:\windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  c:\windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:2156

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3848

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:4004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2608
- \??\c:\windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  c:\windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  2⤵
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:3908

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\mkreafr.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2288

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3512
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding D38109A02F684A8267E1567F98A71D74
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1528
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-f1e5de13-6775-4513-92ea-239e7ef0abde\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
    3⤵
    - Modifies file permissions
    PID:4532
- - C:\Windows\SysWOW64\EXPAND.EXE
    "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
    3⤵
    - Drops file in Windows directory
    PID:1384
- - C:\Users\Admin\AppData\Local\Temp\MW-f1e5de13-6775-4513-92ea-239e7ef0abde\files\vlc.exe
    "C:\Users\Admin\AppData\Local\Temp\MW-f1e5de13-6775-4513-92ea-239e7ef0abde\files\vlc.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:4032
  - - \??\c:\temp\Autoit3.exe
      "c:\temp\Autoit3.exe" c:\temp\script.au3
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Suspicious use of SetThreadContext
      Executes dropped EXE
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4304
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-f1e5de13-6775-4513-92ea-239e7ef0abde\." /SETINTEGRITYLEVEL (CI)(OI)LOW
    3⤵
    - Modifies file permissions
    PID:4492

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\kebedkh\efeeaae

Filesize
1KB

MD5
33efe0234cfff17d594873e8b635884d

SHA1
0151b3d0572eaa43d67407fbc7a782f15652805f

SHA256
7ac90d9d6671c689180d9360c28d9f98e042b445b329e7f9d5f1986cf474cb52

SHA512
b302b0c99156dfbbc38ad0bd8f1d8c7f4ca87d2406a7160bd752c4415c6920464abe6627f00e4f39eee9194c806aa8243c32d638f23517fbe8917d07218d14f0

Download Submit
C:\ProgramData\kebedkh\ggadfbe.au3

Filesize
466KB

MD5
caf6d14ee91108f878d6108071d72b7a

SHA1
6166b2db78c93bdb24dc693b18a8bc6f1cd96fe6

SHA256
3182937fdba31b1fe9f18f78e0901fe8d3bac7ed72b87f8409dcd19e2e1f4184

SHA512
74b46ffd50acf54055e05ac12b8167b8f4976de345f478b648f71c05cf8f1f9cb584cdc2711d605aaea05c1f0fb643028ef8524e0f9144b0ab2975792c9681c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-f1e5de13-6775-4513-92ea-239e7ef0abde\files.cab

Filesize
425KB

MD5
cd05e846f193c3d992c10f6baebb2a5f

SHA1
f2f40e1fa4aa566a1e4ef6d224756653366956d4

SHA256
ed366750ecc3c84a595b55d224117f0717a2bbf142a264149a1c9716a794f8e8

SHA512
0181aa3530f38b507f856d825a1739d6bcb78ef02664e87ee97bb912cfb10bea97f247c364708896dd20011772783c1b4413e81100689e27ec280e41415f369b

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-f1e5de13-6775-4513-92ea-239e7ef0abde\files\libvlc.dll

Filesize
460KB

MD5
d71e08eedc3438c9cefae58c06a316f6

SHA1
fc7b57305cdbf9bd7cf72e5e64f1ff4d829dfe84

SHA256
8096cf50fa6ca37f5c864e8e021ca9bcf633cf2c7a6ce2ecce1629063090d505

SHA512
f6c187d9bfdc20cefd0a7fa8d2d87e5e9de0d7b54aa113ab13a4cff8d635e2cc64e97d4a6300ec99c4906aed9badce627daa5402c34443f200c748d4ed5f6976

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-f1e5de13-6775-4513-92ea-239e7ef0abde\files\libvlc.dll

Filesize
276KB

MD5
d389617aa8db0590de74236151dcb03e

SHA1
314233cab4cb60b6d50f1f9218813ab021c454c2

SHA256
0600cdce037d32e985fc74895c158de8581caf5a6d4c132a0a5d37519243af38

SHA512
07165de238fb50c43711bbecbe88a73c491319714bc0a3b5239a3a0f927ceb37ce3add8a49f578928d4c0c28e964647df2e2c3fe74102f347bd1c1adec7ebaf3

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-f1e5de13-6775-4513-92ea-239e7ef0abde\files\sqlite3.dll

Filesize
284KB

MD5
cf9c52325994c4b11107018778d8d35c

SHA1
2b81003101a1367605a40045e390d44ef28fb381

SHA256
d2b91364078edbd3b32b229e4c15326cbb8d4a14c56fd272e61e237fb326cb91

SHA512
f6640ad17125eb9d25cff034f40c23dd6e21e33e68b7c89f525a676b6feaf7b485472ea93e3fb0e3a0c4889f337dba20ee9e395638e44dafa90166c59e83aea4

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-f1e5de13-6775-4513-92ea-239e7ef0abde\files\vlc.exe

Filesize
411KB

MD5
74e6732323ffe1648b6225c962ce0ed0

SHA1
78fa5a36bc0a5cabd318f7696baf17384223862f

SHA256
0c15f643da97fe3ecdd2e9a0e64687fd9c2cf7605dc37363a366a8e7b0e1098d

SHA512
365f1f727ff362e63ee0e6cf141bc32a6e56dccef1d460bf13bde7636265fbac7a3b52044a1ebc1add0c49ffe4feb3c84909326abf90b9a6f9ee40f6d9d08b3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-f1e5de13-6775-4513-92ea-239e7ef0abde\files\vlc.exe

Filesize
252KB

MD5
1b01b65f562a83062e9debef902ba14c

SHA1
bb80ece2faaecc8deff3f0eeb804270a58200dd8

SHA256
6ecc90da9c9803ef99715ec4664fa22252aaa2a693a147e26830132a258f49aa

SHA512
3f26371ddfbcd05e8ec8472bbe7727b4f00c97dbcd37e4f963ddcc0990701de694de88082d369024d4a4d808a589ec795b9ac9fb67093e919bf3f957d531aca5

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-f1e5de13-6775-4513-92ea-239e7ef0abde\msiwrapper.ini

Filesize
1KB

MD5
ccd21a751b36cb266235f72b5a835d1d

SHA1
a3fc7c35c7db22ab07834043228645a9dd12439f

SHA256
c529c92e33c5346be87d9a5daa6fe82ced083927b0692c1e91d87457a7c1e9de

SHA512
95ff855aa2ed7e018f6e13df3589d583d899ed0042ccc306cc67d7aa80138e3c24a02b1d1abf8fefee643297eff85817ca2c3d53c4d9967a3995a7274d0cf007

Download Submit
C:\Users\Admin\AppData\Local\Temp\MW-f1e5de13-6775-4513-92ea-239e7ef0abde\msiwrapper.ini

Filesize
1KB

MD5
f30d8915db7bffaa831e90f27dd2bc3a

SHA1
000450e76de1b848c1ad305a3a789a71412935fb

SHA256
3e74cdffcc246173677f685c6555ff5cee8e78105b82151b6cdfc440203115bb

SHA512
cf094ff4006155361bf6359befbee251ec8fd5e941f952126997cd4d1c0c934c8fc66c241cb7208124cb1d003005e56cacfaba6fd472b0508f566787b75c6f08

Download Submit
C:\Users\Admin\AppData\Roaming\ecehEhD

Filesize
32B

MD5
94830daf2ae7b62846a681285c8af545

SHA1
0700f0696b09e4135721888f558551c1b8d43937

SHA256
dcdbc9ad0741d9d52cbcd21ccd7fdd8afdb06d7fa528c61231d6653c9fc6c1dd

SHA512
8b95a91a04c3191680373d0b291e3d2f977729f206b74e0f7d8ca1cb2fff307a1cda678958b5f5aa54eca9105c76a36ae4b89e2ded2c95c22245f4b0efcc4558

Download Submit
C:\Windows\Installer\MSI7A02.tmp

Filesize
208KB

MD5
d82b3fb861129c5d71f0cd2874f97216

SHA1
f3fe341d79224126e950d2691d574d147102b18d

SHA256
107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c

SHA512
244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b

Download Submit
C:\Windows\Installer\MSI7EE6.tmp

Filesize
77KB

MD5
bfc82eafa5253dcfc2f18d19dad81ba6

SHA1
2da5ef81a3ad41a4820863db64856da79443d498

SHA256
d4145bf93453fb90445c65a95d9c6b2d54df09273234a8250c835a36737fddab

SHA512
3ddbbc926c726fb0db2ec9386f32906315210d5dd6d86d83b44696ef2227e2462237483813dd30ebcc18a091fa9ed037753474026c0a623b03741679a7b80c77

Download Submit
C:\Windows\Installer\MSI7EE6.tmp

Filesize
72KB

MD5
94986033495e23e165fbe13e21f7f022

SHA1
d6ebcccfea68852ba7917aa2c873a26769cda6de

SHA256
b9c2e429ab756c3889f3b990429c2948be57b9ee37b4b7db600955d7590520e9

SHA512
e07d368ead4cd4f8a39cff27ed931f933c682b15f1fc830bc29318d232aae8c6ff31f961424d70b4e1ff3739950054ba7a4035695c40881dc973c24c68017a3a

Download Submit
C:\temp\Autoit3.exe

Filesize
275KB

MD5
db8705e44706d0c8d49f961a51800d91

SHA1
7160fa818d056835fa7da66ed74ea99a260cef3f

SHA256
691902fd90067e3dbb2790f108f266186414ab23bd85869a30fbae52319f3f59

SHA512
6a8a88185c8e891063c66e70c1d5a80dd13658139e6ea5317ad7c6f2e849756581dac4f5698d3c26a97e16461a944252b3c96c5bd87c5e653d5ab51b59149b60

Download Submit
C:\temp\cc.txt

Filesize
4B

MD5
1555887dcd5a4c47f27eb96a96dc7991

SHA1
958e46b77c6a53158d696e3ee354c10c8fefaeb8

SHA256
2f8cf229e93dee95b98e97153c672af07a8452d0a24f58bb289e8217038747a6

SHA512
68aa3759fbbc7a7b40073961b037949811b1cbd2452c23646b28105e6e5b1075e39671dc9ef4317adc293330492fbcb3c7e5a1f29541530542d366935aad3ee6

Download Submit
C:\temp\fs.txt

Filesize
4B

MD5
0a84edc0020e2c45abda89158a184c39

SHA1
186a0290cf2a064804cc8c6b218ad5eda43d8e08

SHA256
c7e863057017d79df46913aa2a72fc26a59076ea5b7aa177f0c49182e214c1c0

SHA512
1fc7ecc03faf0c786d22361c67debe66282e2a8d7454a8c4b559dfbab722042d2b2e774cf76bf29e147e6d4f76f3eb3dc5ed3e91b4bca96488d52885313f70ff

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
3.0MB

MD5
6909d7a200a48d1798cf80c9118f380c

SHA1
fa40130095f44cc450583a05632883bc9743b961

SHA256
a48fb544d818345a099300ce50a133c0c768578816dec28f6947bec3de174a7a

SHA512
4adb5a90e863c794e2176369e31ac83ef73976d2de762519326ed3da20ba9fdbd90a5a7fb133a9d93c11a545e83099334fd6a5507f1ac7380ee52627121031a8

Download Submit
\??\Volume{542e36da-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{16510f55-8978-459b-acf5-b2082413f85a}_OnDiskSnapshotProp

Filesize
6KB

MD5
709d9ea776ce63038ff0d02eddbdd44a

SHA1
cc09890c156cacd890502d9572a99213f950c001

SHA256
3e214247bf175896dc9e379a38da0b8a90c1db69cb5f1521671a75b772b265f9

SHA512
212d968657a1968899da07c312a2afac65e4ad9b523481312cf4c6afcf76ab89c0bd022749f038db03fa0f4e6452b07542e4b12795c28acc1293e25a5426a3ca

Download Submit
\??\c:\temp\Autoit3.exe

Filesize
162KB

MD5
2eb15cded95a860fd386a7c7fc6aa537

SHA1
04e6612ec0b78d284436b532ed0417ebe040be8b

SHA256
4c8d76a65f18d55fef5961e375f493aa597b74e7d350a9afb5130817a6df739a

SHA512
cba763c8ef5cf1bc197c1046181e78cb09de6236d4d0a877576a26e5a11a0be00e08926eed3a8c39e228ffe4d2fe166a0171e111dfd1c097402030a445535707

Download Submit
\??\c:\temp\script.au3

Filesize
322KB

MD5
bece66571aeb95a56f7e4aab9fe38cb3

SHA1
5fa9de1fd3eabf283b4b8de08e781bf6c7ce8354

SHA256
7541b9d87486a41c5dd785240c16b864a614e0c65f104891786bf76a74f6c72d

SHA512
02eb779238fc385102ec029c7339a48096f0ba4b803ead6254c77d528f5c146859349aef9639607a2868282385ceb813738bc774616738c92ff1c3544de424fb

Download Submit
\??\c:\temp\test.txt

Filesize
76B

MD5
eb493e70c279b059272d93eb86156a25

SHA1
cc6d75663d2647ce59741958b9334d9319dc1e40

SHA256
c5c350d106264a59acb4049244933261da379b6fc5577b519cfc113c83fb1e31

SHA512
c4617f8d45d00bf3fbe6a1ab4b25052e2012e2f2783022528d625618956814ab6497a82800f14592eda1886903d88a075ffeff29d72bec8c4817927b9dcac514

Download Submit
memory/2156-125-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2156-148-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2156-111-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2156-114-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2156-158-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2156-109-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2156-156-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2156-154-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2156-122-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2156-120-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2156-152-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2156-150-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2156-110-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2156-146-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2156-127-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2156-144-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2156-142-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2156-131-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2156-137-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2156-133-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/2156-135-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/3908-130-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/3908-145-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/3908-149-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/3908-138-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/3908-134-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/3908-143-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/3908-136-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/3908-153-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/3908-128-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/3908-147-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/3908-159-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/3908-132-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/3908-157-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/3908-151-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/3908-155-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/4032-88-0x0000025CD2570000-0x0000025CD270E000-memory.dmp

Filesize
1.6MB

Download
memory/4032-85-0x00007FF70EB00000-0x00007FF70EBF8000-memory.dmp

Filesize
992KB

Download
memory/4032-86-0x0000000067B80000-0x0000000067D0D000-memory.dmp

Filesize
1.6MB

Download
memory/4032-80-0x0000025CD2570000-0x0000025CD270E000-memory.dmp

Filesize
1.6MB

Download
memory/4304-100-0x0000000004580000-0x0000000005550000-memory.dmp

Filesize
15.8MB

Download
memory/4304-115-0x0000000005A70000-0x0000000005DBE000-memory.dmp

Filesize
3.3MB

Download
memory/4304-102-0x0000000005A70000-0x0000000005DBE000-memory.dmp

Filesize
3.3MB

Download