Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
31/10/2022, 23:26
Behavioral task
behavioral1
Sample
a29a93f383f766d7764f2974c9a24414095768a44f76195d4e854203d364cba0.exe
Resource
win10v2004-20220812-en
General
-
Target
a29a93f383f766d7764f2974c9a24414095768a44f76195d4e854203d364cba0.exe
-
Size
1.3MB
-
MD5
538b71c16a2ea9f6b97ab5b12f4572cf
-
SHA1
c76ad3f456045f9b174ef13d264e8e0a388e220e
-
SHA256
a29a93f383f766d7764f2974c9a24414095768a44f76195d4e854203d364cba0
-
SHA512
5b21a0db9fa80704e5653043d94de1a642db4820c121ae813ba1ada7f485d0fa0797bb1623300b7db75daca7b79a4cf8e94e1ebc3fe28a5517eeffba74c3f75e
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 12 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4784 3812 schtasks.exe 16 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4768 3812 schtasks.exe 16 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3284 3812 schtasks.exe 16 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4616 3812 schtasks.exe 16 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2752 3812 schtasks.exe 16 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3024 3812 schtasks.exe 16 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2428 3812 schtasks.exe 16 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2560 3812 schtasks.exe 16 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1888 3812 schtasks.exe 16 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3728 3812 schtasks.exe 16 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3628 3812 schtasks.exe 16 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2372 3812 schtasks.exe 16 -
resource yara_rule behavioral1/files/0x0008000000022e50-137.dat dcrat behavioral1/files/0x0008000000022e50-138.dat dcrat behavioral1/memory/1976-139-0x0000000000BB0000-0x0000000000CC0000-memory.dmp dcrat behavioral1/files/0x0008000000022e5d-163.dat dcrat behavioral1/files/0x0008000000022e5d-164.dat dcrat -
Executes dropped EXE 2 IoCs
pid Process 1976 DllCommonsvc.exe 3204 dllhost.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation a29a93f383f766d7764f2974c9a24414095768a44f76195d4e854203d364cba0.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in Program Files directory 5 IoCs
description ioc Process File created C:\Program Files (x86)\Google\Update\Download\24dbde2999530e DllCommonsvc.exe File created C:\Program Files (x86)\Windows Mail\dllhost.exe DllCommonsvc.exe File opened for modification C:\Program Files (x86)\Windows Mail\dllhost.exe DllCommonsvc.exe File created C:\Program Files (x86)\Windows Mail\5940a34987c991 DllCommonsvc.exe File created C:\Program Files (x86)\Google\Update\Download\WmiPrvSE.exe DllCommonsvc.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\ModemLogs\69ddcba757bf72 DllCommonsvc.exe File created C:\Windows\ModemLogs\smss.exe DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 12 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4784 schtasks.exe 3284 schtasks.exe 3024 schtasks.exe 2560 schtasks.exe 1888 schtasks.exe 3728 schtasks.exe 3628 schtasks.exe 2372 schtasks.exe 4768 schtasks.exe 4616 schtasks.exe 2752 schtasks.exe 2428 schtasks.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings a29a93f383f766d7764f2974c9a24414095768a44f76195d4e854203d364cba0.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings DllCommonsvc.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 1976 DllCommonsvc.exe 2360 powershell.exe 4372 powershell.exe 4380 powershell.exe 648 powershell.exe 2344 powershell.exe 2344 powershell.exe 2360 powershell.exe 4372 powershell.exe 4380 powershell.exe 648 powershell.exe 3204 dllhost.exe 3204 dllhost.exe 3204 dllhost.exe 3204 dllhost.exe 3204 dllhost.exe 3204 dllhost.exe 3204 dllhost.exe 3204 dllhost.exe 3204 dllhost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3204 dllhost.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 1976 DllCommonsvc.exe Token: SeDebugPrivilege 2360 powershell.exe Token: SeDebugPrivilege 4372 powershell.exe Token: SeDebugPrivilege 4380 powershell.exe Token: SeDebugPrivilege 2344 powershell.exe Token: SeDebugPrivilege 648 powershell.exe Token: SeDebugPrivilege 3204 dllhost.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 4572 wrote to memory of 5088 4572 a29a93f383f766d7764f2974c9a24414095768a44f76195d4e854203d364cba0.exe 80 PID 4572 wrote to memory of 5088 4572 a29a93f383f766d7764f2974c9a24414095768a44f76195d4e854203d364cba0.exe 80 PID 4572 wrote to memory of 5088 4572 a29a93f383f766d7764f2974c9a24414095768a44f76195d4e854203d364cba0.exe 80 PID 5088 wrote to memory of 2312 5088 WScript.exe 81 PID 5088 wrote to memory of 2312 5088 WScript.exe 81 PID 5088 wrote to memory of 2312 5088 WScript.exe 81 PID 2312 wrote to memory of 1976 2312 cmd.exe 83 PID 2312 wrote to memory of 1976 2312 cmd.exe 83 PID 1976 wrote to memory of 2344 1976 DllCommonsvc.exe 96 PID 1976 wrote to memory of 2344 1976 DllCommonsvc.exe 96 PID 1976 wrote to memory of 4380 1976 DllCommonsvc.exe 97 PID 1976 wrote to memory of 4380 1976 DllCommonsvc.exe 97 PID 1976 wrote to memory of 2360 1976 DllCommonsvc.exe 102 PID 1976 wrote to memory of 2360 1976 DllCommonsvc.exe 102 PID 1976 wrote to memory of 4372 1976 DllCommonsvc.exe 101 PID 1976 wrote to memory of 4372 1976 DllCommonsvc.exe 101 PID 1976 wrote to memory of 648 1976 DllCommonsvc.exe 100 PID 1976 wrote to memory of 648 1976 DllCommonsvc.exe 100 PID 1976 wrote to memory of 1304 1976 DllCommonsvc.exe 106 PID 1976 wrote to memory of 1304 1976 DllCommonsvc.exe 106 PID 1304 wrote to memory of 4480 1304 cmd.exe 108 PID 1304 wrote to memory of 4480 1304 cmd.exe 108 PID 1304 wrote to memory of 3204 1304 cmd.exe 109 PID 1304 wrote to memory of 3204 1304 cmd.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\a29a93f383f766d7764f2974c9a24414095768a44f76195d4e854203d364cba0.exe"C:\Users\Admin\AppData\Local\Temp\a29a93f383f766d7764f2974c9a24414095768a44f76195d4e854203d364cba0.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2344
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Mail\dllhost.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4380
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\Pictures\OfficeClickToRun.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:648
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\ModemLogs\smss.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4372
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\Update\Download\WmiPrvSE.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2360
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Yt7RvnjQdj.bat"5⤵
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:26⤵PID:4480
-
-
C:\Program Files (x86)\Windows Mail\dllhost.exe"C:\Program Files (x86)\Windows Mail\dllhost.exe"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3204
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Mail\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4784
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4768
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Mail\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3284
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Google\Update\Download\WmiPrvSE.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4616
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\Update\Download\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2752
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Google\Update\Download\WmiPrvSE.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3024
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Windows\ModemLogs\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2428
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\ModemLogs\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2560
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Windows\ModemLogs\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1888
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Pictures\OfficeClickToRun.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3728
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Users\Public\Pictures\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3628
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Pictures\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2372
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
212B
MD5c1c913d377ba257472a74ddb5a489a25
SHA12ecdaa8f5178712954b110fbdb77a0b938ef3bac
SHA2564ee44db2893f68843759ad065070feec00e79ad5e306eef8e81101adce29c287
SHA51219d5db9d124809ca38b3d69da2ba82d0bb7c7d0bfde0896d417a4e4a3d8ef06d209837df595bd42b6098d876e07e95fc354165a8b134203079bcc9890dd26db5
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478