Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    297s
  • max time network
    299s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    25/09/2022, 22:17

General

  • Target

    53bab521e261f13706ab05fa6820ef5a7e5e446c1bbdc7ff3a0b0f79349bdbf0.exe

  • Size

    610KB

  • MD5

    1813103203337607b90a3a1e82147667

  • SHA1

    7b3273e539dd8eb6e5f432bbe760b864c6e39257

  • SHA256

    53bab521e261f13706ab05fa6820ef5a7e5e446c1bbdc7ff3a0b0f79349bdbf0

  • SHA512

    738a691218edd74c597a51855fb40e32cdf28ae28b86253076007109b2de89a394c927cf99e3da8cb3e632a81b05d861b93b5f2459a389f36d6390fe56216799

  • SSDEEP

    6144:F2baYZtolbaLl36GRWKbSmM41lhMrTVT5Hv3Shd6yPLNfMDgquK96iF1UcFnVOws:FmzaNzUQS5

Malware Config

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • DCRat payload 3 IoCs

    Detects payload of DCRat, commonly dropped by NSIS installers.

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\53bab521e261f13706ab05fa6820ef5a7e5e446c1bbdc7ff3a0b0f79349bdbf0.exe
    "C:\Users\Admin\AppData\Local\Temp\53bab521e261f13706ab05fa6820ef5a7e5e446c1bbdc7ff3a0b0f79349bdbf0.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4324
    • C:\Users\Admin\AppData\Local\Temp\662661963-CF1181JIP3HRtQK7X5p.exe
      "C:\Users\Admin\AppData\Local\Temp\662661963-CF1181JIP3HRtQK7X5p.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      PID:3436

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\662661963-CF1181JIP3HRtQK7X5p.exe

    Filesize

    951KB

    MD5

    c0934d15fb14685ee7e2dc49b1e4a542

    SHA1

    7f1dd57cb3d8da8c37d42b2de4e1e920272bc3a9

    SHA256

    cbfa467c07aae4e0df550d0f5127896961bfc9fcbe30254b1df913c3bf47be52

    SHA512

    653671dcc20de26d183024786aedb65ae8ffcb0d2132006a09e9f9637ec75e791cafc767a94054c2e8f5157c7c172169d8eb1c45d8ad826b6d626fd6fa9bac4d

  • C:\Users\Admin\AppData\Local\Temp\662661963-CF1181JIP3HRtQK7X5p.exe

    Filesize

    951KB

    MD5

    c0934d15fb14685ee7e2dc49b1e4a542

    SHA1

    7f1dd57cb3d8da8c37d42b2de4e1e920272bc3a9

    SHA256

    cbfa467c07aae4e0df550d0f5127896961bfc9fcbe30254b1df913c3bf47be52

    SHA512

    653671dcc20de26d183024786aedb65ae8ffcb0d2132006a09e9f9637ec75e791cafc767a94054c2e8f5157c7c172169d8eb1c45d8ad826b6d626fd6fa9bac4d

  • memory/3436-216-0x0000000000B90000-0x0000000000C84000-memory.dmp

    Filesize

    976KB

  • memory/3436-218-0x0000000002E10000-0x0000000002E2C000-memory.dmp

    Filesize

    112KB

  • memory/3436-226-0x000000001D1A0000-0x000000001D362000-memory.dmp

    Filesize

    1.8MB

  • memory/3436-225-0x0000000002EE0000-0x0000000002EEE000-memory.dmp

    Filesize

    56KB

  • memory/3436-224-0x0000000002ED0000-0x0000000002EDE000-memory.dmp

    Filesize

    56KB

  • memory/3436-223-0x0000000002E70000-0x0000000002E80000-memory.dmp

    Filesize

    64KB

  • memory/3436-222-0x000000001C5A0000-0x000000001CAC6000-memory.dmp

    Filesize

    5.1MB

  • memory/3436-221-0x0000000001430000-0x0000000001442000-memory.dmp

    Filesize

    72KB

  • memory/3436-220-0x0000000002E30000-0x0000000002E46000-memory.dmp

    Filesize

    88KB

  • memory/3436-219-0x0000000002E80000-0x0000000002ED0000-memory.dmp

    Filesize

    320KB

  • memory/4324-151-0x00000000011D0000-0x000000000126C000-memory.dmp

    Filesize

    624KB

  • memory/4324-159-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-128-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-129-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-130-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-131-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-132-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-133-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-134-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-135-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-136-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-137-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-138-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-139-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-140-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-141-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-142-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-143-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-144-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-145-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-146-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-147-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-148-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-149-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-150-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-126-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-152-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-153-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-154-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-155-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-156-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-157-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-158-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-127-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-160-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-161-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-162-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-163-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-164-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-165-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-166-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-167-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-168-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-169-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-170-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-171-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-172-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-173-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-174-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-175-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-176-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-177-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-125-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-124-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-123-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-122-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-121-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-120-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-119-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-118-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-178-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-179-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-180-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-181-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB

  • memory/4324-182-0x00000000776D0000-0x000000007785E000-memory.dmp

    Filesize

    1.6MB