Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
90s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
28/12/2022, 09:22
General
-
Target
HEUR-Trojan-Spy.MSIL.Stealer.gen-cfc44518bea24306b5439c2a076aca4fed2a744c68fe0124074d5fee3fc0857f.exe
-
Size
1.6MB
-
MD5
3378bb01af514e4220b658beeb1472fd
-
SHA1
c59f060b067dbdfc61592fc8b5a8bc1d7c025a3c
-
SHA256
cfc44518bea24306b5439c2a076aca4fed2a744c68fe0124074d5fee3fc0857f
-
SHA512
fb8e57a58034db378b5c4ca69ae198be47b94b02ffbe965edda5f4078e16a210cb1599e93f4512e5251cf874eb129576d0853eed4de1cc8bc0d64afb6c33d916
-
SSDEEP
24576:+XGq9fNAehxNnn+MsgnUQ0+vgd9Ulk5R/+VKkccpScpuw72sEeh8Sx8y:vqVNxhxFVKQKHgk5RmVKG7dr
Malware Config
Signatures
-
DcRat 8 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Modifies WinLogon for persistence 2 TTPs 6 IoCs
-
Process spawned unexpected child process 6 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Executes dropped EXE 7 IoCs
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application 2 TTPs 12 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in System32 directory 10 IoCs
-
Drops file in Windows directory 10 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 9 IoCs
-
Suspicious use of WriteProcessMemory 40 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Spy.MSIL.Stealer.gen-cfc44518bea24306b5439c2a076aca4fed2a744c68fe0124074d5fee3fc0857f.exe"C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan-Spy.MSIL.Stealer.gen-cfc44518bea24306b5439c2a076aca4fed2a744c68fe0124074d5fee3fc0857f.exe"1⤵
- DcRat
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\write\explorer.exe"C:\Windows\write\explorer.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5b9f1e56-a708-412d-8322-242571a8c05d.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\write\explorer.exeC:\Windows\write\explorer.exe4⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1b5526ce-fa29-408f-b586-fcb6fdeedb32.vbs"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\write\explorer.exeC:\Windows\write\explorer.exe6⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\88e0e190-0f02-487c-bf87-ab56c8173d42.vbs"7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\write\explorer.exeC:\Windows\write\explorer.exe8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4ca60611-a296-4d74-a4ab-095bcc401cf7.vbs"7⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\HiXkD60p2N.bat"7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:28⤵
-
-
C:\Windows\write\explorer.exe"C:\Windows\write\explorer.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\3e8b70b0-64e8-4f10-9333-d227ac7ee832.vbs"5⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\LgxiiauvsB.bat"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:26⤵
-
-
C:\Windows\write\explorer.exe"C:\Windows\write\explorer.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ed8b5919-c5a3-4239-ae2c-2c91240029b5.vbs"3⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Zcl4dB2r8y.bat"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:24⤵
-
-
C:\Windows\write\explorer.exe"C:\Windows\write\explorer.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Search.Core\SearchApp.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\System32\ngctasks\lsass.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\write\explorer.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\odt\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\scrptadm\dllhost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\PerfLogs\sihost.exe'" /rl HIGHEST /f1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD54bbcb48b1e11c4c1152197ee29f6dc56
SHA1de55c69709e00c7f5944cea9c1b353a8e8a002d2
SHA25661aac74a0152ca5c2003d18586de70cdb756d32b02937a1c3931db94c4d5e0dc
SHA51236d8125ac7eab84f5fbb24e2e9b97d936a111bca8bbeeaea85783fef2a6dff16cf51ebfd9b27d3357a2dbbf292b02447520eb95351807dd5de493628e33f395b
-
Filesize
705B
MD560bbffee78ad9db0f15b9c037271b192
SHA18fee912f73cb67b4b68209443a563ec0656099d2
SHA256a17f10e19a9248910ce1fe51e9904fa639d2ce99ecd21f435dc83a2a887993cf
SHA512a1ca6010ca5c735a353ab71fd9cbfddfa3f78ea271f74e182b774a9de9a93afff8940e561e475582e7c89ed83ccfa85b12e534f74d7aeaac0dbe86babcb3654b
-
Filesize
481B
MD58b2dc27ddef7ece007d1ba39af8f7c13
SHA18879747e844e5e0e338d830ac9d7d7af00293491
SHA2562fbec05bbd530ed91e5741a651abf369b0c9f3f9ae20a6e6c98d63fd0c5545f2
SHA5125fc875c03fd029fd55c1c5abc20f9fca8dceb868dbcbb31babc022fef96aa6897d6fcef09109d44fe651e7e0d22c2afc8c211419085734ba0a8192aad3f00e2c
-
Filesize
481B
MD58b2dc27ddef7ece007d1ba39af8f7c13
SHA18879747e844e5e0e338d830ac9d7d7af00293491
SHA2562fbec05bbd530ed91e5741a651abf369b0c9f3f9ae20a6e6c98d63fd0c5545f2
SHA5125fc875c03fd029fd55c1c5abc20f9fca8dceb868dbcbb31babc022fef96aa6897d6fcef09109d44fe651e7e0d22c2afc8c211419085734ba0a8192aad3f00e2c
-
Filesize
704B
MD5528494ad0f37469d4d8f2b49febecebb
SHA1cdfa8bd23d1bf275187727134eaba449bd4504df
SHA2568079b4e3ee0b6e84882871bb3dc347c405f4228e3c4823a7cc979aa58e9d56b5
SHA5121ba9cf2665508aaec3ebe12b984196584a182ec0ffc23b23fb98e68bb7fb8ee79584281e4c36eaf9e873c18148be20cb243be9dc484ed89f4b7e6584771f4e8a
-
Filesize
1.6MB
MD507ab34a42af0c244e8cc859db53e8961
SHA12845b9a94570fd4cb321f9c91c6db52ad1465998
SHA256b61f7a286c9cb3d305ee3bd80c6dfc72bae3fd6826e792f710ed316be6e63791
SHA512eae8b93ded0e68e88b984e632b3203430c2582c9536c4ed542bfc14bdca450578459165c9aad27b4f3a25f6d7160ab2e88b80090632afdcf9b74463a165ac4c3
-
Filesize
1.6MB
MD507ab34a42af0c244e8cc859db53e8961
SHA12845b9a94570fd4cb321f9c91c6db52ad1465998
SHA256b61f7a286c9cb3d305ee3bd80c6dfc72bae3fd6826e792f710ed316be6e63791
SHA512eae8b93ded0e68e88b984e632b3203430c2582c9536c4ed542bfc14bdca450578459165c9aad27b4f3a25f6d7160ab2e88b80090632afdcf9b74463a165ac4c3
-
Filesize
705B
MD57493aeb580e71d2b45974578c5c1000a
SHA1b4184d27ba32921da7d6352bf150b3adeccecde0
SHA2563ff3f491350ba3f9a363da160730bcabd613a8b26399c4f26efb2294447309a1
SHA512b1fd6f8f8ecf5b2444b8a669c3eb58ac5fe2addce58f4847622fa673dc3c449b5c2b03cf7b1c7bcd41c97492baff34a3ce1813e44105fd158e34b499dbf98eb5
-
Filesize
193B
MD5a98d7d55d7666a732a86f9360fe4278a
SHA18dae7c9aa84a1b74a4e1285da0a2a99460ef0f73
SHA256ca2d63b6ebb25380d330d65a7fe709d8ff4be76255ef44e6de01d2b483d93c38
SHA512cb1de449bb3baec912d9352bcd5be06c0c14081dcaad1eba4931e4134fff2059c66f00f12eb13cd9ff55c53c912c7f0ba07c71a29c5b5162e69ae1801f80c7cd
-
Filesize
193B
MD5305492aac492d4c25bc3d5ca837918ea
SHA1a40872e2f06c6cffaa3a4492e81e341c0545f05f
SHA256e6e87464cd2f7568fb4a435950cb8b99bb7c51495fde3a716dcfd2f33548e813
SHA5127d5b32d46d55af6f8e602607e3b7e445cb4360b18575dac97ac64af5bb7c43d185e4cc7e6c27cad53d040c3de0b2d35d52d7d8c506366a2b642e196ee595c471
-
Filesize
193B
MD576e4c6a92b56a87ed9d817700df9d5f4
SHA1b40a417a6456cc9e47f563c3e772f151ddbbca02
SHA25641724a16638084b3c94d935c3d82b17a8fd860b38f94c4688a64b8ffd9ce51d1
SHA512715487c4f1d909a5e82d0dcb6a9cd773e43574ae3f85b82b7866e5d3620940284f6fa6336b4a00042c026b2313d6ef6936fdc56ac340404ac919fb9df44612b0
-
Filesize
481B
MD58b2dc27ddef7ece007d1ba39af8f7c13
SHA18879747e844e5e0e338d830ac9d7d7af00293491
SHA2562fbec05bbd530ed91e5741a651abf369b0c9f3f9ae20a6e6c98d63fd0c5545f2
SHA5125fc875c03fd029fd55c1c5abc20f9fca8dceb868dbcbb31babc022fef96aa6897d6fcef09109d44fe651e7e0d22c2afc8c211419085734ba0a8192aad3f00e2c
-
Filesize
1.6MB
MD507ab34a42af0c244e8cc859db53e8961
SHA12845b9a94570fd4cb321f9c91c6db52ad1465998
SHA256b61f7a286c9cb3d305ee3bd80c6dfc72bae3fd6826e792f710ed316be6e63791
SHA512eae8b93ded0e68e88b984e632b3203430c2582c9536c4ed542bfc14bdca450578459165c9aad27b4f3a25f6d7160ab2e88b80090632afdcf9b74463a165ac4c3
-
Filesize
1.6MB
MD507ab34a42af0c244e8cc859db53e8961
SHA12845b9a94570fd4cb321f9c91c6db52ad1465998
SHA256b61f7a286c9cb3d305ee3bd80c6dfc72bae3fd6826e792f710ed316be6e63791
SHA512eae8b93ded0e68e88b984e632b3203430c2582c9536c4ed542bfc14bdca450578459165c9aad27b4f3a25f6d7160ab2e88b80090632afdcf9b74463a165ac4c3
-
Filesize
1.6MB
MD507ab34a42af0c244e8cc859db53e8961
SHA12845b9a94570fd4cb321f9c91c6db52ad1465998
SHA256b61f7a286c9cb3d305ee3bd80c6dfc72bae3fd6826e792f710ed316be6e63791
SHA512eae8b93ded0e68e88b984e632b3203430c2582c9536c4ed542bfc14bdca450578459165c9aad27b4f3a25f6d7160ab2e88b80090632afdcf9b74463a165ac4c3
-
Filesize
1.6MB
MD507ab34a42af0c244e8cc859db53e8961
SHA12845b9a94570fd4cb321f9c91c6db52ad1465998
SHA256b61f7a286c9cb3d305ee3bd80c6dfc72bae3fd6826e792f710ed316be6e63791
SHA512eae8b93ded0e68e88b984e632b3203430c2582c9536c4ed542bfc14bdca450578459165c9aad27b4f3a25f6d7160ab2e88b80090632afdcf9b74463a165ac4c3
-
Filesize
1.6MB
MD507ab34a42af0c244e8cc859db53e8961
SHA12845b9a94570fd4cb321f9c91c6db52ad1465998
SHA256b61f7a286c9cb3d305ee3bd80c6dfc72bae3fd6826e792f710ed316be6e63791
SHA512eae8b93ded0e68e88b984e632b3203430c2582c9536c4ed542bfc14bdca450578459165c9aad27b4f3a25f6d7160ab2e88b80090632afdcf9b74463a165ac4c3
-
Filesize
1.6MB
MD507ab34a42af0c244e8cc859db53e8961
SHA12845b9a94570fd4cb321f9c91c6db52ad1465998
SHA256b61f7a286c9cb3d305ee3bd80c6dfc72bae3fd6826e792f710ed316be6e63791
SHA512eae8b93ded0e68e88b984e632b3203430c2582c9536c4ed542bfc14bdca450578459165c9aad27b4f3a25f6d7160ab2e88b80090632afdcf9b74463a165ac4c3
-
Filesize
1.6MB
MD507ab34a42af0c244e8cc859db53e8961
SHA12845b9a94570fd4cb321f9c91c6db52ad1465998
SHA256b61f7a286c9cb3d305ee3bd80c6dfc72bae3fd6826e792f710ed316be6e63791
SHA512eae8b93ded0e68e88b984e632b3203430c2582c9536c4ed542bfc14bdca450578459165c9aad27b4f3a25f6d7160ab2e88b80090632afdcf9b74463a165ac4c3
-
Filesize
1.6MB
MD507ab34a42af0c244e8cc859db53e8961
SHA12845b9a94570fd4cb321f9c91c6db52ad1465998
SHA256b61f7a286c9cb3d305ee3bd80c6dfc72bae3fd6826e792f710ed316be6e63791
SHA512eae8b93ded0e68e88b984e632b3203430c2582c9536c4ed542bfc14bdca450578459165c9aad27b4f3a25f6d7160ab2e88b80090632afdcf9b74463a165ac4c3
-
Filesize
10.8MB
-
Filesize
320KB
-
Filesize
10.8MB
-
Filesize
16KB
-
Filesize
12KB
-
Filesize
16KB
-
Filesize
1.6MB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
1.6MB
-
Filesize
16KB
-
Filesize
12KB
-
Filesize
24KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
12KB
-
Filesize
16KB
-
Filesize
24KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
136KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
12KB
-
Filesize
24KB
-
Filesize
16KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
24KB
-
Filesize
16KB
-
Filesize
10.8MB
-
Filesize
10.8MB