Overview
overview
10Static
static
81.bin/1.bin.exe
windows7_x64
101.bin/1.bin.exe
windows10_x64
102019-09-02...10.exe
windows7_x64
102019-09-02...10.exe
windows10_x64
1031.exe
windows7_x64
1031.exe
windows10_x64
103DMark 11 ...on.exe
windows7_x64
13DMark 11 ...on.exe
windows10_x64
15da0116af4...18.exe
windows7_x64
85da0116af4...18.exe
windows10_x64
8Archive.zi...3e.exe
windows7_x64
8Archive.zi...3e.exe
windows10_x64
8CVE-2018-1...oC.swf
windows7_x64
3CVE-2018-1...oC.swf
windows10_x64
3CVWSHSetup...1].exe
windows7_x64
3CVWSHSetup...1].exe
windows10_x64
3DiskIntern...en.exe
windows7_x64
1DiskIntern...en.exe
windows10_x64
1ForceOp 2....ce.exe
windows7_x64
10ForceOp 2....ce.exe
windows10_x64
10HYDRA.exe
windows7_x64
10HYDRA.exe
windows10_x64
10Keygen.exe
windows7_x64
10Keygen.exe
windows10_x64
10Lonelyscre...ox.exe
windows7_x64
1Lonelyscre...ox.exe
windows10_x64
1LtHv0O2KZDK4M637.exe
windows7_x64
10LtHv0O2KZDK4M637.exe
windows10_x64
10Magic_File...ja.exe
windows7_x64
1Magic_File...ja.exe
windows10_x64
1OnlineInstaller.exe
windows7_x64
8OnlineInstaller.exe
windows10_x64
8Analysis
-
max time kernel
114s -
max time network
148s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
18-11-2020 16:58
Static task
static1
Behavioral task
behavioral1
Sample
1.bin/1.bin.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral2
Sample
1.bin/1.bin.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral3
Sample
2019-09-02_22-41-10.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral4
Sample
2019-09-02_22-41-10.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral5
Sample
31.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral6
Sample
31.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral7
Sample
3DMark 11 Advanced Edition.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral8
Sample
3DMark 11 Advanced Edition.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral9
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral10
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral11
Sample
Archive.zip__ccacaxs2tbz2t6ob3e.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral12
Sample
Archive.zip__ccacaxs2tbz2t6ob3e.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral13
Sample
CVE-2018-15982_PoC.swf
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral14
Sample
CVE-2018-15982_PoC.swf
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral15
Sample
CVWSHSetup[1].bin/WSHSetup[1].exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral16
Sample
CVWSHSetup[1].bin/WSHSetup[1].exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral17
Sample
DiskInternals_Uneraser_v5_keygen.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral18
Sample
DiskInternals_Uneraser_v5_keygen.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral19
Sample
ForceOp 2.8.7 - By RaiSence.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral20
Sample
ForceOp 2.8.7 - By RaiSence.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral21
Sample
HYDRA.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral22
Sample
HYDRA.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral23
Sample
Keygen.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral24
Sample
Keygen.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral25
Sample
Lonelyscreen.1.2.9.keygen.by.Paradox/Lonelyscreen.1.2.9.keygen.by.Paradox.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral26
Sample
Lonelyscreen.1.2.9.keygen.by.Paradox/Lonelyscreen.1.2.9.keygen.by.Paradox.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral27
Sample
LtHv0O2KZDK4M637.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral28
Sample
LtHv0O2KZDK4M637.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral29
Sample
Magic_File_v3_keygen_by_KeygenNinja.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral30
Sample
Magic_File_v3_keygen_by_KeygenNinja.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral31
Sample
OnlineInstaller.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral32
Sample
OnlineInstaller.exe
Resource
win10v20201028
windows10_x64
General
-
Target
ForceOp 2.8.7 - By RaiSence.exe
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Executes dropped EXE 2 IoCs
pid Process 628 wincommon.exe 1856 WmiPrvSE.exe -
Loads dropped DLL 1 IoCs
pid Process 384 cmd.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Uninstall Information\System.exe wincommon.exe File created C:\Program Files\Uninstall Information\27d1bcfc3c54e0e44ea423ffd4ee81fe73670a2a wincommon.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\SchCache\Idle.exe wincommon.exe File created C:\Windows\SchCache\6ccacd8608530fba3a93e87ae2225c7032aa18c1 wincommon.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 900 schtasks.exe 1304 schtasks.exe 1452 schtasks.exe 340 schtasks.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 WmiPrvSE.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde WmiPrvSE.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 628 wincommon.exe 1856 WmiPrvSE.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 628 wincommon.exe Token: SeDebugPrivilege 1856 WmiPrvSE.exe -
Suspicious use of WriteProcessMemory 31 IoCs
description pid Process procid_target PID 1828 wrote to memory of 1292 1828 ForceOp 2.8.7 - By RaiSence.exe 26 PID 1828 wrote to memory of 1292 1828 ForceOp 2.8.7 - By RaiSence.exe 26 PID 1828 wrote to memory of 1292 1828 ForceOp 2.8.7 - By RaiSence.exe 26 PID 1828 wrote to memory of 1292 1828 ForceOp 2.8.7 - By RaiSence.exe 26 PID 1828 wrote to memory of 1356 1828 ForceOp 2.8.7 - By RaiSence.exe 27 PID 1828 wrote to memory of 1356 1828 ForceOp 2.8.7 - By RaiSence.exe 27 PID 1828 wrote to memory of 1356 1828 ForceOp 2.8.7 - By RaiSence.exe 27 PID 1828 wrote to memory of 1356 1828 ForceOp 2.8.7 - By RaiSence.exe 27 PID 1292 wrote to memory of 384 1292 WScript.exe 31 PID 1292 wrote to memory of 384 1292 WScript.exe 31 PID 1292 wrote to memory of 384 1292 WScript.exe 31 PID 1292 wrote to memory of 384 1292 WScript.exe 31 PID 384 wrote to memory of 628 384 cmd.exe 33 PID 384 wrote to memory of 628 384 cmd.exe 33 PID 384 wrote to memory of 628 384 cmd.exe 33 PID 384 wrote to memory of 628 384 cmd.exe 33 PID 628 wrote to memory of 1304 628 wincommon.exe 35 PID 628 wrote to memory of 1304 628 wincommon.exe 35 PID 628 wrote to memory of 1304 628 wincommon.exe 35 PID 628 wrote to memory of 1452 628 wincommon.exe 37 PID 628 wrote to memory of 1452 628 wincommon.exe 37 PID 628 wrote to memory of 1452 628 wincommon.exe 37 PID 628 wrote to memory of 340 628 wincommon.exe 39 PID 628 wrote to memory of 340 628 wincommon.exe 39 PID 628 wrote to memory of 340 628 wincommon.exe 39 PID 628 wrote to memory of 900 628 wincommon.exe 41 PID 628 wrote to memory of 900 628 wincommon.exe 41 PID 628 wrote to memory of 900 628 wincommon.exe 41 PID 628 wrote to memory of 1856 628 wincommon.exe 43 PID 628 wrote to memory of 1856 628 wincommon.exe 43 PID 628 wrote to memory of 1856 628 wincommon.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\ForceOp 2.8.7 - By RaiSence.exe"C:\Users\Admin\AppData\Local\Temp\ForceOp 2.8.7 - By RaiSence.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\intofont\1Udi0TDz635jTrMWFNrE4kqnOIuYIi.vbe"2⤵
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\intofont\xLg6v1j1ZJy5DZ1pz826KfZq2BmfLM.bat" "3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:384 -
C:\intofont\wincommon.exe"C:\intofont\wincommon.exe"4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "taskhost" /sc ONLOGON /tr "'C:\PerfLogs\Admin\taskhost.exe'" /rl HIGHEST /f5⤵
- Creates scheduled task(s)
PID:1304
-
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\SchCache\Idle.exe'" /rl HIGHEST /f5⤵
- Creates scheduled task(s)
PID:1452
-
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\System.exe'" /rl HIGHEST /f5⤵
- Creates scheduled task(s)
PID:340
-
-
C:\Windows\system32\schtasks.exe"schtasks" /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\intofont\WmiPrvSE.exe'" /rl HIGHEST /f5⤵
- Creates scheduled task(s)
PID:900
-
-
C:\intofont\WmiPrvSE.exe"C:\intofont\WmiPrvSE.exe"5⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1856
-
-
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\intofont\msg.vbs"2⤵PID:1356
-