Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
73s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
25/09/2022, 02:21
Behavioral task
behavioral1
Sample
02da4648a2941f1f70f9dc3d59f72595.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
02da4648a2941f1f70f9dc3d59f72595.exe
Resource
win10v2004-20220812-en
General
-
Target
02da4648a2941f1f70f9dc3d59f72595.exe
-
Size
2.6MB
-
MD5
02da4648a2941f1f70f9dc3d59f72595
-
SHA1
f04ff761eea9313ebaa1cf5d2914c3de7fe0b1c0
-
SHA256
b90c52219d8c75357133266f06849a804b0995d3e20e9e0672c78bc94ebc8c9d
-
SHA512
3b12be79bb99744155b09e34fb392cda54f2f9d55a2da4d930012800fe96d472028c2c09c8c4f5b008257864e8fe50d783f6ec7091f6eff6413054ec762c664f
-
SSDEEP
49152:+pTn80rAHkSrvT7yEBpojAGw3fo+5D0gRbfGNW8UlbSpDCP2XF:+ZpktrvTOqp2Nw3L0gRbfGI8sepeu1
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 12 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1372 1000 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1204 1000 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1684 1000 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1524 1000 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1228 1000 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1800 1000 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2028 1000 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1976 1000 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1960 1000 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1628 1000 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1536 1000 schtasks.exe 27 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1032 1000 schtasks.exe 27 -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 02da4648a2941f1f70f9dc3d59f72595.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 02da4648a2941f1f70f9dc3d59f72595.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 02da4648a2941f1f70f9dc3d59f72595.exe -
resource yara_rule behavioral1/memory/1600-54-0x00000000011E0000-0x0000000001484000-memory.dmp dcrat behavioral1/files/0x0009000000012324-101.dat dcrat behavioral1/files/0x0009000000012324-100.dat dcrat behavioral1/memory/1800-105-0x0000000001070000-0x0000000001314000-memory.dmp dcrat -
Executes dropped EXE 1 IoCs
pid Process 1800 lsass.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 02da4648a2941f1f70f9dc3d59f72595.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 02da4648a2941f1f70f9dc3d59f72595.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 12 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1628 schtasks.exe 1684 schtasks.exe 1524 schtasks.exe 1228 schtasks.exe 1800 schtasks.exe 1960 schtasks.exe 1032 schtasks.exe 1372 schtasks.exe 1204 schtasks.exe 2028 schtasks.exe 1976 schtasks.exe 1536 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 63 IoCs
pid Process 1600 02da4648a2941f1f70f9dc3d59f72595.exe 1600 02da4648a2941f1f70f9dc3d59f72595.exe 1600 02da4648a2941f1f70f9dc3d59f72595.exe 1600 02da4648a2941f1f70f9dc3d59f72595.exe 1600 02da4648a2941f1f70f9dc3d59f72595.exe 1600 02da4648a2941f1f70f9dc3d59f72595.exe 1600 02da4648a2941f1f70f9dc3d59f72595.exe 1600 02da4648a2941f1f70f9dc3d59f72595.exe 1600 02da4648a2941f1f70f9dc3d59f72595.exe 1600 02da4648a2941f1f70f9dc3d59f72595.exe 1600 02da4648a2941f1f70f9dc3d59f72595.exe 1600 02da4648a2941f1f70f9dc3d59f72595.exe 1600 02da4648a2941f1f70f9dc3d59f72595.exe 1600 02da4648a2941f1f70f9dc3d59f72595.exe 1600 02da4648a2941f1f70f9dc3d59f72595.exe 1600 02da4648a2941f1f70f9dc3d59f72595.exe 1600 02da4648a2941f1f70f9dc3d59f72595.exe 1600 02da4648a2941f1f70f9dc3d59f72595.exe 1600 02da4648a2941f1f70f9dc3d59f72595.exe 1600 02da4648a2941f1f70f9dc3d59f72595.exe 1600 02da4648a2941f1f70f9dc3d59f72595.exe 1600 02da4648a2941f1f70f9dc3d59f72595.exe 1600 02da4648a2941f1f70f9dc3d59f72595.exe 1600 02da4648a2941f1f70f9dc3d59f72595.exe 1600 02da4648a2941f1f70f9dc3d59f72595.exe 1600 02da4648a2941f1f70f9dc3d59f72595.exe 1600 02da4648a2941f1f70f9dc3d59f72595.exe 1600 02da4648a2941f1f70f9dc3d59f72595.exe 1600 02da4648a2941f1f70f9dc3d59f72595.exe 1600 02da4648a2941f1f70f9dc3d59f72595.exe 1600 02da4648a2941f1f70f9dc3d59f72595.exe 1600 02da4648a2941f1f70f9dc3d59f72595.exe 1600 02da4648a2941f1f70f9dc3d59f72595.exe 1600 02da4648a2941f1f70f9dc3d59f72595.exe 1600 02da4648a2941f1f70f9dc3d59f72595.exe 1600 02da4648a2941f1f70f9dc3d59f72595.exe 1600 02da4648a2941f1f70f9dc3d59f72595.exe 1600 02da4648a2941f1f70f9dc3d59f72595.exe 1600 02da4648a2941f1f70f9dc3d59f72595.exe 1600 02da4648a2941f1f70f9dc3d59f72595.exe 1600 02da4648a2941f1f70f9dc3d59f72595.exe 1600 02da4648a2941f1f70f9dc3d59f72595.exe 1600 02da4648a2941f1f70f9dc3d59f72595.exe 1600 02da4648a2941f1f70f9dc3d59f72595.exe 1600 02da4648a2941f1f70f9dc3d59f72595.exe 1600 02da4648a2941f1f70f9dc3d59f72595.exe 1600 02da4648a2941f1f70f9dc3d59f72595.exe 1600 02da4648a2941f1f70f9dc3d59f72595.exe 1600 02da4648a2941f1f70f9dc3d59f72595.exe 1600 02da4648a2941f1f70f9dc3d59f72595.exe 1600 02da4648a2941f1f70f9dc3d59f72595.exe 1600 02da4648a2941f1f70f9dc3d59f72595.exe 1600 02da4648a2941f1f70f9dc3d59f72595.exe 1600 02da4648a2941f1f70f9dc3d59f72595.exe 1600 02da4648a2941f1f70f9dc3d59f72595.exe 1600 02da4648a2941f1f70f9dc3d59f72595.exe 1600 02da4648a2941f1f70f9dc3d59f72595.exe 1600 02da4648a2941f1f70f9dc3d59f72595.exe 952 powershell.exe 1804 powershell.exe 284 powershell.exe 1616 powershell.exe 2044 powershell.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 1600 02da4648a2941f1f70f9dc3d59f72595.exe Token: SeDebugPrivilege 1800 lsass.exe Token: SeDebugPrivilege 952 powershell.exe Token: SeDebugPrivilege 1804 powershell.exe Token: SeDebugPrivilege 284 powershell.exe Token: SeDebugPrivilege 1616 powershell.exe Token: SeDebugPrivilege 2044 powershell.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1600 wrote to memory of 284 1600 02da4648a2941f1f70f9dc3d59f72595.exe 40 PID 1600 wrote to memory of 284 1600 02da4648a2941f1f70f9dc3d59f72595.exe 40 PID 1600 wrote to memory of 284 1600 02da4648a2941f1f70f9dc3d59f72595.exe 40 PID 1600 wrote to memory of 2044 1600 02da4648a2941f1f70f9dc3d59f72595.exe 42 PID 1600 wrote to memory of 2044 1600 02da4648a2941f1f70f9dc3d59f72595.exe 42 PID 1600 wrote to memory of 2044 1600 02da4648a2941f1f70f9dc3d59f72595.exe 42 PID 1600 wrote to memory of 952 1600 02da4648a2941f1f70f9dc3d59f72595.exe 44 PID 1600 wrote to memory of 952 1600 02da4648a2941f1f70f9dc3d59f72595.exe 44 PID 1600 wrote to memory of 952 1600 02da4648a2941f1f70f9dc3d59f72595.exe 44 PID 1600 wrote to memory of 1804 1600 02da4648a2941f1f70f9dc3d59f72595.exe 46 PID 1600 wrote to memory of 1804 1600 02da4648a2941f1f70f9dc3d59f72595.exe 46 PID 1600 wrote to memory of 1804 1600 02da4648a2941f1f70f9dc3d59f72595.exe 46 PID 1600 wrote to memory of 1616 1600 02da4648a2941f1f70f9dc3d59f72595.exe 47 PID 1600 wrote to memory of 1616 1600 02da4648a2941f1f70f9dc3d59f72595.exe 47 PID 1600 wrote to memory of 1616 1600 02da4648a2941f1f70f9dc3d59f72595.exe 47 PID 1600 wrote to memory of 1816 1600 02da4648a2941f1f70f9dc3d59f72595.exe 50 PID 1600 wrote to memory of 1816 1600 02da4648a2941f1f70f9dc3d59f72595.exe 50 PID 1600 wrote to memory of 1816 1600 02da4648a2941f1f70f9dc3d59f72595.exe 50 PID 1816 wrote to memory of 2028 1816 cmd.exe 52 PID 1816 wrote to memory of 2028 1816 cmd.exe 52 PID 1816 wrote to memory of 2028 1816 cmd.exe 52 PID 1816 wrote to memory of 1800 1816 cmd.exe 53 PID 1816 wrote to memory of 1800 1816 cmd.exe 53 PID 1816 wrote to memory of 1800 1816 cmd.exe 53 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 02da4648a2941f1f70f9dc3d59f72595.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 02da4648a2941f1f70f9dc3d59f72595.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 02da4648a2941f1f70f9dc3d59f72595.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\02da4648a2941f1f70f9dc3d59f72595.exe"C:\Users\Admin\AppData\Local\Temp\02da4648a2941f1f70f9dc3d59f72595.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1600 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\02da4648a2941f1f70f9dc3d59f72595.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:284
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\sppsvc.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2044
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Local Settings\Idle.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:952
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\02da4648a2941f1f70f9dc3d59f72595.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1804
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsass.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1616
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\pXlQnQd1ki.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵PID:2028
-
-
C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsass.exe"C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsass.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1800
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\sppsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1372
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1204
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1684
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Local Settings\Idle.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1524
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Default\Local Settings\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1228
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Local Settings\Idle.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1800
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "02da4648a2941f1f70f9dc3d59f725950" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\02da4648a2941f1f70f9dc3d59f72595.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2028
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "02da4648a2941f1f70f9dc3d59f72595" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\02da4648a2941f1f70f9dc3d59f72595.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1976
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "02da4648a2941f1f70f9dc3d59f725950" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\02da4648a2941f1f70f9dc3d59f72595.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1960
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1628
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1536
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1032
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.6MB
MD56ed130f3dc3fbf298b9bf30fa684254e
SHA11ae9db311dab0798d92f5e4690ad8c5cbd663e49
SHA2563a874398e9dff72103801cde1c175ff86e169b5c455a99af32c57c7983e1be22
SHA512003f8982a351a7d7691bede2fd3d3b9926a8dc570d683c2c4171f21c994f6187ae0471c33528edf2d3acd5a6465ada309ea2259fe9fd50de14d09f8ed5759d0c
-
Filesize
2.6MB
MD56ed130f3dc3fbf298b9bf30fa684254e
SHA11ae9db311dab0798d92f5e4690ad8c5cbd663e49
SHA2563a874398e9dff72103801cde1c175ff86e169b5c455a99af32c57c7983e1be22
SHA512003f8982a351a7d7691bede2fd3d3b9926a8dc570d683c2c4171f21c994f6187ae0471c33528edf2d3acd5a6465ada309ea2259fe9fd50de14d09f8ed5759d0c
-
Filesize
237B
MD5e87b5aa9fb73edd63a13e9b916bdf92a
SHA126935231a180cb553986963f6464aca4695c4c71
SHA2567eea682106a40dcfaadfef0bd5f52de8e63ec80338dc91cfb16a96322da9a1d1
SHA512439af90203aba1a1fde3b1c6cce9408a0603d6504609fddfd82e87ac7768c63becc2aa0a8a777b29919b848862731f7c867d1c3ac746b275c2c60e4aa6b716e4
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD5ab5677e489f74d1140e580591e9c5c64
SHA1180fd4daac3283498c9db451a4373ab2e1b6f606
SHA256bbb5a6c63525081c6dc29b673d5c4e558af85e526eb88db7d87746e3d98e7370
SHA5121370cfa4816bcd59808ce46561a08a8ec85cf26933fcbaec3e6553e3ef13ca3344df76485d477c8cda44f42c1e201157388e39c0b73ea6ce7ecd5e6f40f926b5
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD5ab5677e489f74d1140e580591e9c5c64
SHA1180fd4daac3283498c9db451a4373ab2e1b6f606
SHA256bbb5a6c63525081c6dc29b673d5c4e558af85e526eb88db7d87746e3d98e7370
SHA5121370cfa4816bcd59808ce46561a08a8ec85cf26933fcbaec3e6553e3ef13ca3344df76485d477c8cda44f42c1e201157388e39c0b73ea6ce7ecd5e6f40f926b5
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD5ab5677e489f74d1140e580591e9c5c64
SHA1180fd4daac3283498c9db451a4373ab2e1b6f606
SHA256bbb5a6c63525081c6dc29b673d5c4e558af85e526eb88db7d87746e3d98e7370
SHA5121370cfa4816bcd59808ce46561a08a8ec85cf26933fcbaec3e6553e3ef13ca3344df76485d477c8cda44f42c1e201157388e39c0b73ea6ce7ecd5e6f40f926b5
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD5ab5677e489f74d1140e580591e9c5c64
SHA1180fd4daac3283498c9db451a4373ab2e1b6f606
SHA256bbb5a6c63525081c6dc29b673d5c4e558af85e526eb88db7d87746e3d98e7370
SHA5121370cfa4816bcd59808ce46561a08a8ec85cf26933fcbaec3e6553e3ef13ca3344df76485d477c8cda44f42c1e201157388e39c0b73ea6ce7ecd5e6f40f926b5