Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
104s -
max time network
86s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
28/12/2022, 09:22
General
-
Target
HEUR-Trojan-Spy.MSIL.Stealer.gen-cfc44518bea24306b5439c2a076aca4fed2a744c68fe0124074d5fee3fc0857f.exe
-
Size
1.6MB
-
MD5
3378bb01af514e4220b658beeb1472fd
-
SHA1
c59f060b067dbdfc61592fc8b5a8bc1d7c025a3c
-
SHA256
cfc44518bea24306b5439c2a076aca4fed2a744c68fe0124074d5fee3fc0857f
-
SHA512
fb8e57a58034db378b5c4ca69ae198be47b94b02ffbe965edda5f4078e16a210cb1599e93f4512e5251cf874eb129576d0853eed4de1cc8bc0d64afb6c33d916
-
SSDEEP
24576:+XGq9fNAehxNnn+MsgnUQ0+vgd9Ulk5R/+VKkccpScpuw72sEeh8Sx8y:vqVNxhxFVKQKHgk5RmVKG7dr
Malware Config
Signatures
-
DcRat 8 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Modifies WinLogon for persistence 2 TTPs 6 IoCs
-
Process spawned unexpected child process 6 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Executes dropped EXE 5 IoCs
-
Adds Run key to start application 2 TTPs 12 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in System32 directory 15 IoCs
-
Drops file in Program Files directory 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 7 IoCs
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Spy.MSIL.Stealer.gen-cfc44518bea24306b5439c2a076aca4fed2a744c68fe0124074d5fee3fc0857f.exe"C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Spy.MSIL.Stealer.gen-cfc44518bea24306b5439c2a076aca4fed2a744c68fe0124074d5fee3fc0857f.exe"1⤵
- DcRat
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\dd_SetupUtility\HEUR-Trojan-Spy.MSIL.Stealer.gen-cfc44518bea24306b5439c2a076aca4fed2a744c68fe0124074d5fee3fc0857f.exe"C:\Users\Admin\AppData\Local\Temp\dd_SetupUtility\HEUR-Trojan-Spy.MSIL.Stealer.gen-cfc44518bea24306b5439c2a076aca4fed2a744c68fe0124074d5fee3fc0857f.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1b4daaac-5ca5-4de5-9dea-87d85f6b83a6.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dd_SetupUtility\HEUR-Trojan-Spy.MSIL.Stealer.gen-cfc44518bea24306b5439c2a076aca4fed2a744c68fe0124074d5fee3fc0857f.exeC:\Users\Admin\AppData\Local\Temp\dd_SetupUtility\HEUR-Trojan-Spy.MSIL.Stealer.gen-cfc44518bea24306b5439c2a076aca4fed2a744c68fe0124074d5fee3fc0857f.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\54627216-3d6a-4262-ac53-564624b58ace.vbs"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dd_SetupUtility\HEUR-Trojan-Spy.MSIL.Stealer.gen-cfc44518bea24306b5439c2a076aca4fed2a744c68fe0124074d5fee3fc0857f.exeC:\Users\Admin\AppData\Local\Temp\dd_SetupUtility\HEUR-Trojan-Spy.MSIL.Stealer.gen-cfc44518bea24306b5439c2a076aca4fed2a744c68fe0124074d5fee3fc0857f.exe6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9b5b3635-240c-4b98-9a9b-b94d6f609947.vbs"5⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6x2cfOw3ED.bat"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:26⤵
-
-
C:\Users\Admin\AppData\Local\Temp\dd_SetupUtility\HEUR-Trojan-Spy.MSIL.Stealer.gen-cfc44518bea24306b5439c2a076aca4fed2a744c68fe0124074d5fee3fc0857f.exe"C:\Users\Admin\AppData\Local\Temp\dd_SetupUtility\HEUR-Trojan-Spy.MSIL.Stealer.gen-cfc44518bea24306b5439c2a076aca4fed2a744c68fe0124074d5fee3fc0857f.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\54d9cd5c-db79-4a4d-a28a-625fc750d7d6.vbs"3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\DCuC0H4DXb.bat"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:24⤵
-
-
C:\Users\Admin\AppData\Local\Temp\dd_SetupUtility\HEUR-Trojan-Spy.MSIL.Stealer.gen-cfc44518bea24306b5439c2a076aca4fed2a744c68fe0124074d5fee3fc0857f.exe"C:\Users\Admin\AppData\Local\Temp\dd_SetupUtility\HEUR-Trojan-Spy.MSIL.Stealer.gen-cfc44518bea24306b5439c2a076aca4fed2a744c68fe0124074d5fee3fc0857f.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Uninstall Information\wininit.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\System32\inetppui\lsass.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\System32\C_21025\csrss.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "HEUR-Trojan-Spy.MSIL.Stealer.gen-cfc44518bea24306b5439c2a076aca4fed2a744c68fe0124074d5fee3fc0857f" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\dd_SetupUtility\HEUR-Trojan-Spy.MSIL.Stealer.gen-cfc44518bea24306b5439c2a076aca4fed2a744c68fe0124074d5fee3fc0857f.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\ProgramData\Mozilla\updates\308046B0AF4A39CB\services.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\System32\SensorsClassExtension\services.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
827B
MD5851ab31eb592c79b7dd5526fdb6e5914
SHA1765b9647f4af6d94fc8b3472927e62621adc63a4
SHA2569c7b5773a89f2e6fd4c8794f5c1ae52573ccdf5f5e878beadb6df7bafcee7865
SHA51253249c9102e1797c0448a7ec273e1912346dcd0201d9759e96671c648ef021c2edf527be680d26d41249a208109e69028dd9a61021eab6d1dd242d83fccc168e
-
Filesize
826B
MD53d467cd900daa93d19789a201578e760
SHA1d55935cd91903d1b37c4e25b61df94d1d1904782
SHA256a39cf4748c5d61152c7147cd0120b2902ebf09d98869cc3373e1c2f9bf5d8f5d
SHA512fe126c398925316e71a5e48436e1a38c6934d1e73f37a8643dca7c8f44e9844f106d6c1d678350f8c933a05b52b8ab9527f207f01ca593fed3f919f8c95ba2d3
-
Filesize
603B
MD5c56269bbdabe763e2d7a7a18c22e038f
SHA163b058e96b960714ea9b477d08a2229e1dd06240
SHA25697bcef09ee2ef107cd84d58dd8b8bba28451af8ad5a43e1089b0c74761bfef77
SHA512ffc915eb4dad8b57111369c2257a1d4f1fd3cb82cfb3f6d84ef573b6eb4a08f7c7b1a0163a12147969ee5a6db64092ee1b042bad8994fa14ba49199ae21e0c0d
-
Filesize
315B
MD5040314e42ba5fa772751743a3f136a04
SHA1c71fb1c137c4260559f9364fd8c7751f6f3e7b3c
SHA256cf13104a8ba681be928deb359a1af8c33a8fd37794e589025f978872c7aad852
SHA512185eb916a6f793350eb97d134be20c3f788698797f79821886468b98a8606edb025bef96b3edeb663b6ef7c970e7743709397a99e38c91be3b2967f87bd3e0d0
-
Filesize
603B
MD5c56269bbdabe763e2d7a7a18c22e038f
SHA163b058e96b960714ea9b477d08a2229e1dd06240
SHA25697bcef09ee2ef107cd84d58dd8b8bba28451af8ad5a43e1089b0c74761bfef77
SHA512ffc915eb4dad8b57111369c2257a1d4f1fd3cb82cfb3f6d84ef573b6eb4a08f7c7b1a0163a12147969ee5a6db64092ee1b042bad8994fa14ba49199ae21e0c0d
-
Filesize
315B
MD5c31e2a1b16a38925db9e25daf7d9a6c5
SHA1df633e519b09c858b18fa37c54f4772680800b8b
SHA25694e096109043f67b527c074cf4d429d292c2abcf937083fb2fdf4a7ee5ad2464
SHA512f0e207d1098eb3555a0c27126fdb6139d62fe3e0c5dbd766db7ebc758882164111a8b679a7e283baf24dc148b3b97ff3d22df9003d9431b591a269472cdb9cbe
-
Filesize
1.6MB
MD5c9e0b8961f095953ac7f230572dc1874
SHA11a56ae777cc5231cf604385c77b8bf4cc0c79321
SHA25624ab534a3078e2d5ef795a774dc768dec14ac2d9fc85e68d1a8871c9d4268d0f
SHA512ca78583054a6ec28bcc86238a1431bbe3e299f517082b2ebb31ce326b137395132768545d9b788f78884031b6cf0d21713b78b176e5105e52047b597c85c8962
-
Filesize
1.6MB
MD5c9e0b8961f095953ac7f230572dc1874
SHA11a56ae777cc5231cf604385c77b8bf4cc0c79321
SHA25624ab534a3078e2d5ef795a774dc768dec14ac2d9fc85e68d1a8871c9d4268d0f
SHA512ca78583054a6ec28bcc86238a1431bbe3e299f517082b2ebb31ce326b137395132768545d9b788f78884031b6cf0d21713b78b176e5105e52047b597c85c8962
-
Filesize
1.6MB
MD5c9e0b8961f095953ac7f230572dc1874
SHA11a56ae777cc5231cf604385c77b8bf4cc0c79321
SHA25624ab534a3078e2d5ef795a774dc768dec14ac2d9fc85e68d1a8871c9d4268d0f
SHA512ca78583054a6ec28bcc86238a1431bbe3e299f517082b2ebb31ce326b137395132768545d9b788f78884031b6cf0d21713b78b176e5105e52047b597c85c8962
-
Filesize
1.6MB
MD5c9e0b8961f095953ac7f230572dc1874
SHA11a56ae777cc5231cf604385c77b8bf4cc0c79321
SHA25624ab534a3078e2d5ef795a774dc768dec14ac2d9fc85e68d1a8871c9d4268d0f
SHA512ca78583054a6ec28bcc86238a1431bbe3e299f517082b2ebb31ce326b137395132768545d9b788f78884031b6cf0d21713b78b176e5105e52047b597c85c8962
-
Filesize
1.6MB
MD5c9e0b8961f095953ac7f230572dc1874
SHA11a56ae777cc5231cf604385c77b8bf4cc0c79321
SHA25624ab534a3078e2d5ef795a774dc768dec14ac2d9fc85e68d1a8871c9d4268d0f
SHA512ca78583054a6ec28bcc86238a1431bbe3e299f517082b2ebb31ce326b137395132768545d9b788f78884031b6cf0d21713b78b176e5105e52047b597c85c8962
-
Filesize
1.6MB
MD5c9e0b8961f095953ac7f230572dc1874
SHA11a56ae777cc5231cf604385c77b8bf4cc0c79321
SHA25624ab534a3078e2d5ef795a774dc768dec14ac2d9fc85e68d1a8871c9d4268d0f
SHA512ca78583054a6ec28bcc86238a1431bbe3e299f517082b2ebb31ce326b137395132768545d9b788f78884031b6cf0d21713b78b176e5105e52047b597c85c8962
-
Filesize
1.6MB
MD5c9e0b8961f095953ac7f230572dc1874
SHA11a56ae777cc5231cf604385c77b8bf4cc0c79321
SHA25624ab534a3078e2d5ef795a774dc768dec14ac2d9fc85e68d1a8871c9d4268d0f
SHA512ca78583054a6ec28bcc86238a1431bbe3e299f517082b2ebb31ce326b137395132768545d9b788f78884031b6cf0d21713b78b176e5105e52047b597c85c8962
-
Filesize
124KB
-
Filesize
1.6MB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
1.6MB
-
Filesize
124KB
-
Filesize
11.4MB
-
Filesize
124KB
-
Filesize
12KB
-
Filesize
12KB
-
Filesize
10.1MB
-
Filesize
8KB
-
Filesize
48KB
-
Filesize
64KB
-
Filesize
1.6MB
-
Filesize
40KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
32KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
72KB
-
Filesize
124KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
124KB
-
Filesize
112KB
-
Filesize
124KB
-
Filesize
32KB