Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
263s -
max time network
306s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
12/02/2024, 17:33
General
-
Target
build-x64.msi
-
Size
5.8MB
-
MD5
9c02a9298b97fcfc5a75fbedf08002bd
-
SHA1
2d3bc2856c015914f2856331a0315298f3c34b0c
-
SHA256
693ff5db0a085db5094bb96cd4c0ce1d1d3fdc2fbf6b92c32836f3e61a089e7a
-
SHA512
fafe5dddb610068cb1044c803a6d681d1739904d8e0c4b2b0fc05bcd55cf9344f69e77c8627ae73713f759117d81a78855ff937ee8650b47ab18d37cb9ca34bc
-
SSDEEP
49152:ppUP3UhtSTK+0THkWsN8SDYdvH5eoQDWhbHHhZgWEF94FJy5jvrgFdbBUleY82cp:pp6nFDkEWoyvy5jvcdbBUkYC+XCFmpC
Malware Config
Signatures
-
DarkGate
DarkGate is an infostealer written in C++.
-
Detect DarkGate stealer 2 IoCs
-
Modifies file permissions 1 TTPs 2 IoCs
-
Blocklisted process makes network request 3 IoCs
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Windows directory 9 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 2 IoCs
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 49 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 22 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\build-x64.msi1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5C73163418AF625678EA51C0900FAD282⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-01da1887-5d3d-4514-a25a-5c903b48afa3\." /SETINTEGRITYLEVEL (CI)(OI)HIGH3⤵
- Modifies file permissions
-
-
C:\Windows\SysWOW64\EXPAND.EXE"C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files3⤵
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\MW-01da1887-5d3d-4514-a25a-5c903b48afa3\files\iTunesHelper.exe"C:\Users\Admin\AppData\Local\Temp\MW-01da1887-5d3d-4514-a25a-5c903b48afa3\files\iTunesHelper.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
\??\c:\temp\Autoit3.exe"c:\temp\Autoit3.exe" c:\temp\script.a3x4⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\Admin\AppData\Local\Temp\MW-01da1887-5d3d-4514-a25a-5c903b48afa3\files"3⤵
-
-
C:\Windows\SysWOW64\ICACLS.EXE"C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-01da1887-5d3d-4514-a25a-5c903b48afa3\." /SETINTEGRITYLEVEL (CI)(OI)LOW3⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD58aab10decc2b42dfc57c4dbb861e2897
SHA1f63549c960dbfd77c65f73d5d364d7b75e839f8e
SHA2565c6b76cdbcf198cd8c9cc32c0b6c23c542d413423c8f269cac55831d1fbf93e9
SHA512a4e4d595bd33030631b08e833fcacb90085398646c4f40ed98a3f9e1bfc08edb13e94c9fe4946811017b5a89d37a9e779f5e1afddf45379754cdbb09143a63f3
-
Filesize
1KB
MD5c6617d02633f1cf8780fdf9178bb62b0
SHA19da1d5884ef47d8dbd27b1bf9d78eb0beca31033
SHA2564c03595f61412f2b4a8f0152b099db02102a8be4d0310977920bb602df299efc
SHA5126efb21c5783d16d1a0be994461a2048943ab5f3033d4aef33e2634b68a3ca216266a861b6c932171315b886cf5176fb51208f724a01f72d937f900fd31621d18
-
Filesize
540B
MD5dbb94c8b7ad6b72c104dd1528cad72ac
SHA11f904f9da313d98e6f44c6bd7ad9a004f45056d1
SHA2569ee0217a9ee53d67cff82085f56563583f9a1801fa37d1294a69119941099637
SHA512d6d28fa677615a5e9d0590fcec1cfa90e3dd92fb5aa2d16047cacd3dc7afa231cfd7d79157835e78dd273a0a91e07738a3583d3a43ba7c699c09653c334b06df
-
Filesize
536B
MD50a9b5a91bb8246d40744e610843809cd
SHA1d5a35cce97882f378132d5bd0aa1cf6befe77c15
SHA2564ebe8e8627d5f14efa81e1db1da5821042f8f785ee194304a88d984942dfc21d
SHA512772d80982427df54c151dc1b81db51bbb5aae258d227382a17b7e8c58a637eefa54940570b55b3fbed3534a977abd25368e92110c2cabd33cb1c6630543f6602
-
Filesize
3.7MB
MD5eae2ce9d1209a26f242f23ee8dafc185
SHA1ae80b2ccd62eb33d1de1e5615344a13f6c30067e
SHA256409ac0d02bddcc70fe6e238b62d0ab39d25add7c22ce2f187591ac7ee8190cce
SHA5129bbb7e63bd6b13dc436687f3888c70ea1b929249cf3519fd93e209bcf8dbd4e996a701d23a8f8716415b22b12eff8a2eb84e0c1c774b16b5fcb8142896727201
-
Filesize
843KB
MD5c15490b8ffcfad44d8091a75d0cb6b84
SHA17c07743b24cff14c000fa2a6aab9e013dbb52876
SHA25636c8c2587db842a75b31c450b6a6a1c13782d5d002629bed954b9cb3be3e9300
SHA512ff66d86c881b7294fdf7dace343c126b65a36ff9871dbd25ae744dea3ac9c64432f77549b0ee712b476eda3a21cc94f2a7992cbe9fb73711abab7aa43817617e
-
Filesize
927KB
MD575bf7bea5b70220f132acbd4b27e77ee
SHA18130fc9a48f4f08a108d3a767625537824782f85
SHA256df67a200f7243c5fba5120f465591cfc603aaac889c7b3107423818457286ce6
SHA5127ce6342a702332822acc489da08804fcf7ab868087319485df2f810288b3fbdcfebbd55983d121ff411a0ce3da2705feb4c1c49e9ec5e780757fcc9f2859941d
-
Filesize
358KB
MD5ed6a1c72a75dee15a6fa75873cd64975
SHA167a15ca72e3156f8be6c46391e184087e47f4a0d
SHA2560d8878cca08903777888b3681f90e4a07c7aef7d9600a67dfa985844d4bf5eda
SHA512256c2ebfeb42c2d3340d8bb423ef0ae48d5fb9fe5ca09c363595f51a03007482b67a777e4cae7a8194f69bc3a3fbcdb9abb5c9f92097925272431bb9d50f5c03
-
Filesize
236KB
MD5908c8a0dfcc016d565c6ec6d931b809e
SHA16d1e97e7cd7229fe8f5ca1f27ff662a6f73eed6d
SHA256cb30df6fae4a2917263fa276d620e99130a8abe350b10b313c79fc1cd186626d
SHA512a38252265eef5a54a2411006005271bac915098a14f25f3873bc0d5f4eb25558c9e74849aebdf6bb4f1f9ef0443e2b015a9cffe3394f306deef4dfc26c691437
-
Filesize
1KB
MD56db9cdd449815e83f4f2a6bdd7cebc79
SHA14af2e5e4f4465c477b49366c7dcab867e8fa1946
SHA256a48497d3e96284e022627cf2fff5d5de9d0492c2fee91f4e598591186d31464a
SHA512c008e0aa8f11339869ad93a84ef1bdf787a25d10936986d57e8e120c575abbf2b864b9f505dc856f80678d226c669708856f6c1cb51916cc8d0ac945e873ddfa
-
Filesize
208KB
MD5d82b3fb861129c5d71f0cd2874f97216
SHA1f3fe341d79224126e950d2691d574d147102b18d
SHA256107b32c5b789be9893f24d5bfe22633d25b7a3cae80082ef37b30e056869cc5c
SHA512244b7675e70ab12aa5776f26e30577268573b725d0f145bfc6b848d2bd8f014c9c6eab0fc0e4f0a574ed9ca1d230b2094dd88a2146ef0a6db70dbd815f9a5f5b
-
Filesize
872KB
MD5c56b5f0201a3b3de53e561fe76912bfd
SHA12a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA256237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
SHA512195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
-
Filesize
918KB
MD560d8df5ea03564aeac5f5bbf691cd5e6
SHA1df6d901f1bb1703f3c06673fc017a3d435497236
SHA2567f1d046ef74b7fce10b836e96c11fd3819aab11382255791f83ff033b7a85c96
SHA5120364d78cbbf35dd75c1768344a64cd50639a42dd55601969b4de518ac534fad6632d8bf957071bd66b5d47ed6e7c0633851e562337abda9301b58e16800fe6d0
-
Filesize
6KB
MD5147f8a16eb90d20fc04e932ef60be446
SHA1e077b46537ffb79fec8810a384fbb65371477d48
SHA256834b856ef39a15693a22c6b0c120c183d46d6d699642010a7263fee77363a6db
SHA5122b1e20ed89da7b2084ca1dece9fd2c0e650ec5f5d43596f6b6b68dec828b05d4a27bd8d5828bab9296be93c177b17f97d52f2c57a40c17adc5ab5d5866ab96b2
-
Filesize
473KB
MD533ca8bc4ac593027fd3e83ba44be54fc
SHA107e2e129a5b0a694d38ac29bc21f74eda100519f
SHA2562296f929340976c680d199ce8e47bd7136d9f4c1f7abc9df79843e094f894236
SHA51205f6f03e69a7d31686f422e422d61161bde45173a6453fdf0392a7a084c9bd69c7c0ed11eb7a37281481eea14497e95c51dfaded21e2ff943fee3f371592db61
-
Filesize
76B
MD5e0cb113b19ce53ef7b72edbb0a4937dc
SHA12499a76ad9ec4a44571bfd8083e09b23373f9f69
SHA25603bed76f17b8574d05e84b81f81c09a33b1ae1555c2caf4783e059b689879ab6
SHA5120b046a6d16d22c0faa3eb729d9b74bfbc87f3cc847fd5ddfa89e573893d215841bae320f0697090b9a30778a07210929ac9c440fca884e920b369698d90a17ca
-
Filesize
15.8MB
-
Filesize
3.4MB
-
Filesize
3.4MB
-
Filesize
1.6MB
-
Filesize
3.7MB
-
Filesize
1.6MB