Analysis
-
max time kernel
48s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
31-01-2023 21:08
Behavioral task
behavioral1
Sample
8w.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
8w.exe
Resource
win10v2004-20221111-en
General
-
Target
8w.exe
-
Size
952KB
-
MD5
573241336c4b94a72fbce6aaa484a30e
-
SHA1
6324cd79e099023ec6b9e677f694340ec47357b7
-
SHA256
2ce7891884274f9749df0faf46bca81cb0bb8e120ef5367053689c7438ea54dc
-
SHA512
95718232e1fcbc8ad405a83f00031219c18a29dacb76780dabdb6b97984c02518620599384a6683ebd9f0333a14e3ea98bdaa36779021600e5ccf63e8cbe803c
-
SSDEEP
24576:u+O7F9smBDJwWmIezBLwsHuWbxR4AK5ZJXX:p8/KfRTK
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Modifies WinLogon for persistence 2 TTPs 8 IoCs
Processes:
8w.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\msieftp\\smss.exe\", \"C:\\Windows\\System32\\wshqos\\smss.exe\", \"C:\\Windows\\System32\\usercpl\\spoolsv.exe\", \"C:\\Windows\\System32\\NlsLexicons0026\\csrss.exe\", \"C:\\Recovery\\31001cc2-2a3d-11ed-9244-9c23e66b04e4\\WMIADAP.exe\"" 8w.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\msieftp\\smss.exe\", \"C:\\Windows\\System32\\wshqos\\smss.exe\", \"C:\\Windows\\System32\\usercpl\\spoolsv.exe\", \"C:\\Windows\\System32\\NlsLexicons0026\\csrss.exe\", \"C:\\Recovery\\31001cc2-2a3d-11ed-9244-9c23e66b04e4\\WMIADAP.exe\", \"C:\\Program Files\\Windows Portable Devices\\explorer.exe\"" 8w.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\msieftp\\smss.exe\", \"C:\\Windows\\System32\\wshqos\\smss.exe\", \"C:\\Windows\\System32\\usercpl\\spoolsv.exe\", \"C:\\Windows\\System32\\NlsLexicons0026\\csrss.exe\", \"C:\\Recovery\\31001cc2-2a3d-11ed-9244-9c23e66b04e4\\WMIADAP.exe\", \"C:\\Program Files\\Windows Portable Devices\\explorer.exe\", \"C:\\Windows\\System32\\vcomp140\\wininit.exe\"" 8w.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\msieftp\\smss.exe\", \"C:\\Windows\\System32\\wshqos\\smss.exe\", \"C:\\Windows\\System32\\usercpl\\spoolsv.exe\", \"C:\\Windows\\System32\\NlsLexicons0026\\csrss.exe\", \"C:\\Recovery\\31001cc2-2a3d-11ed-9244-9c23e66b04e4\\WMIADAP.exe\", \"C:\\Program Files\\Windows Portable Devices\\explorer.exe\", \"C:\\Windows\\System32\\vcomp140\\wininit.exe\", \"C:\\Windows\\System32\\odbccr32\\csrss.exe\"" 8w.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\msieftp\\smss.exe\"" 8w.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\msieftp\\smss.exe\", \"C:\\Windows\\System32\\wshqos\\smss.exe\"" 8w.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\msieftp\\smss.exe\", \"C:\\Windows\\System32\\wshqos\\smss.exe\", \"C:\\Windows\\System32\\usercpl\\spoolsv.exe\"" 8w.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\System32\\msieftp\\smss.exe\", \"C:\\Windows\\System32\\wshqos\\smss.exe\", \"C:\\Windows\\System32\\usercpl\\spoolsv.exe\", \"C:\\Windows\\System32\\NlsLexicons0026\\csrss.exe\"" 8w.exe -
Process spawned unexpected child process 8 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1784 584 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1096 584 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1512 584 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 988 584 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2016 584 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1968 584 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1492 584 schtasks.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 344 584 schtasks.exe -
Processes:
8w.execsrss.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 8w.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 8w.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 8w.exe -
Processes:
resource yara_rule behavioral1/memory/860-54-0x0000000000C10000-0x0000000000D04000-memory.dmp dcrat C:\Windows\System32\NlsLexicons0026\csrss.exe dcrat C:\Windows\System32\NlsLexicons0026\csrss.exe dcrat behavioral1/memory/1008-67-0x0000000000020000-0x0000000000114000-memory.dmp dcrat -
Executes dropped EXE 1 IoCs
Processes:
csrss.exepid process 1008 csrss.exe -
Adds Run key to start application 2 TTPs 16 IoCs
Processes:
8w.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Windows\\System32\\wshqos\\smss.exe\"" 8w.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\WMIADAP = "\"C:\\Recovery\\31001cc2-2a3d-11ed-9244-9c23e66b04e4\\WMIADAP.exe\"" 8w.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files\\Windows Portable Devices\\explorer.exe\"" 8w.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\System32\\vcomp140\\wininit.exe\"" 8w.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\System32\\odbccr32\\csrss.exe\"" 8w.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Windows\\System32\\wshqos\\smss.exe\"" 8w.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\System32\\usercpl\\spoolsv.exe\"" 8w.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\System32\\usercpl\\spoolsv.exe\"" 8w.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WMIADAP = "\"C:\\Recovery\\31001cc2-2a3d-11ed-9244-9c23e66b04e4\\WMIADAP.exe\"" 8w.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files\\Windows Portable Devices\\explorer.exe\"" 8w.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\System32\\NlsLexicons0026\\csrss.exe\"" 8w.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\System32\\NlsLexicons0026\\csrss.exe\"" 8w.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\System32\\odbccr32\\csrss.exe\"" 8w.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Windows\\System32\\msieftp\\smss.exe\"" 8w.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Windows\\System32\\msieftp\\smss.exe\"" 8w.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\System32\\vcomp140\\wininit.exe\"" 8w.exe -
Processes:
8w.execsrss.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 8w.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 8w.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe -
Drops file in System32 directory 30 IoCs
Processes:
8w.exedescription ioc process File created C:\Windows\System32\NlsLexicons0026\csrss.exe 8w.exe File opened for modification C:\Windows\System32\odbccr32\RCX8AD4.tmp 8w.exe File opened for modification C:\Windows\System32\msieftp\smss.exe 8w.exe File created C:\Windows\System32\odbccr32\886983d96e3d3e31032c679b2d4ea91b6c05afef 8w.exe File opened for modification C:\Windows\System32\wshqos\RCX43AB.tmp 8w.exe File created C:\Windows\System32\wshqos\69ddcba757bf72f7d36c464c71f42baab150b2b9 8w.exe File created C:\Windows\System32\vcomp140\wininit.exe 8w.exe File opened for modification C:\Windows\System32\vcomp140\RCX7F00.tmp 8w.exe File created C:\Windows\System32\msieftp\69ddcba757bf72f7d36c464c71f42baab150b2b9 8w.exe File opened for modification C:\Windows\System32\msieftp\RCX37D6.tmp 8w.exe File opened for modification C:\Windows\System32\vcomp140\RCX7B85.tmp 8w.exe File created C:\Windows\System32\usercpl\spoolsv.exe 8w.exe File opened for modification C:\Windows\System32\wshqos\RCX4040.tmp 8w.exe File opened for modification C:\Windows\System32\wshqos\smss.exe 8w.exe File opened for modification C:\Windows\System32\usercpl\RCX4C15.tmp 8w.exe File opened for modification C:\Windows\System32\NlsLexicons0026\RCX5B63.tmp 8w.exe File opened for modification C:\Windows\System32\NlsLexicons0026\csrss.exe 8w.exe File created C:\Windows\System32\NlsLexicons0026\886983d96e3d3e31032c679b2d4ea91b6c05afef 8w.exe File opened for modification C:\Windows\System32\usercpl\spoolsv.exe 8w.exe File created C:\Windows\System32\vcomp140\560854153607923c4c5f107085a7db67be01f252 8w.exe File created C:\Windows\System32\wshqos\smss.exe 8w.exe File created C:\Windows\System32\odbccr32\csrss.exe 8w.exe File opened for modification C:\Windows\System32\msieftp\RCX346C.tmp 8w.exe File opened for modification C:\Windows\System32\usercpl\RCX4F7F.tmp 8w.exe File opened for modification C:\Windows\System32\NlsLexicons0026\RCX57F9.tmp 8w.exe File opened for modification C:\Windows\System32\odbccr32\RCX8769.tmp 8w.exe File created C:\Windows\System32\msieftp\smss.exe 8w.exe File opened for modification C:\Windows\System32\vcomp140\wininit.exe 8w.exe File opened for modification C:\Windows\System32\odbccr32\csrss.exe 8w.exe File created C:\Windows\System32\usercpl\f3b6ecef712a24f33798f5d2fb3790c3d9b894c4 8w.exe -
Drops file in Program Files directory 6 IoCs
Processes:
8w.exedescription ioc process File created C:\Program Files\Windows Media Player\Icons\Idle.exe 8w.exe File created C:\Program Files\Windows Portable Devices\explorer.exe 8w.exe File created C:\Program Files\Windows Portable Devices\7a0fd90576e08807bde2cc57bcf9854bbce05fe3 8w.exe File opened for modification C:\Program Files\Windows Portable Devices\RCX6FA1.tmp 8w.exe File opened for modification C:\Program Files\Windows Portable Devices\RCX731C.tmp 8w.exe File opened for modification C:\Program Files\Windows Portable Devices\explorer.exe 8w.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 8 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 1968 schtasks.exe 1492 schtasks.exe 344 schtasks.exe 1784 schtasks.exe 1096 schtasks.exe 1512 schtasks.exe 988 schtasks.exe 2016 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
8w.exepid process 860 8w.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
8w.execsrss.exedescription pid process Token: SeDebugPrivilege 860 8w.exe Token: SeDebugPrivilege 1008 csrss.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
8w.exedescription pid process target process PID 860 wrote to memory of 1008 860 8w.exe csrss.exe PID 860 wrote to memory of 1008 860 8w.exe csrss.exe PID 860 wrote to memory of 1008 860 8w.exe csrss.exe -
System policy modification 1 TTPs 6 IoCs
Processes:
csrss.exe8w.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" csrss.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 8w.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 8w.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 8w.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" csrss.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8w.exe"C:\Users\Admin\AppData\Local\Temp\8w.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\NlsLexicons0026\csrss.exe"C:\Windows\System32\NlsLexicons0026\csrss.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\System32\msieftp\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Windows\System32\wshqos\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\System32\usercpl\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\System32\NlsLexicons0026\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "WMIADAP" /sc ONLOGON /tr "'C:\Recovery\31001cc2-2a3d-11ed-9244-9c23e66b04e4\WMIADAP.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\System32\vcomp140\wininit.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\System32\odbccr32\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\System32\NlsLexicons0026\csrss.exeFilesize
952KB
MD59e3e7b6bc99fd1f3ff2ebca8724997d9
SHA13e023260dec0fdac83841124853d69e1932cbfab
SHA25618959f001e44d6dfb67a0d122f61845fadb732ee18de48efc278b54878e89445
SHA512cbf6789f43e92acb85721fac0095c2013868c7c34ab331977a1d77c4b78bb6de8038fd3cb35c3657fd32a9662f8de61f6b88bd645e01bcd6a48f4cb46618a53a
-
C:\Windows\System32\NlsLexicons0026\csrss.exeFilesize
952KB
MD59e3e7b6bc99fd1f3ff2ebca8724997d9
SHA13e023260dec0fdac83841124853d69e1932cbfab
SHA25618959f001e44d6dfb67a0d122f61845fadb732ee18de48efc278b54878e89445
SHA512cbf6789f43e92acb85721fac0095c2013868c7c34ab331977a1d77c4b78bb6de8038fd3cb35c3657fd32a9662f8de61f6b88bd645e01bcd6a48f4cb46618a53a
-
memory/860-60-0x00000000004C0000-0x00000000004C8000-memory.dmpFilesize
32KB
-
memory/860-57-0x0000000000460000-0x000000000046A000-memory.dmpFilesize
40KB
-
memory/860-58-0x00000000004B0000-0x00000000004BC000-memory.dmpFilesize
48KB
-
memory/860-59-0x0000000000480000-0x000000000048A000-memory.dmpFilesize
40KB
-
memory/860-54-0x0000000000C10000-0x0000000000D04000-memory.dmpFilesize
976KB
-
memory/860-61-0x00000000004D0000-0x00000000004DA000-memory.dmpFilesize
40KB
-
memory/860-62-0x00000000004E0000-0x00000000004EC000-memory.dmpFilesize
48KB
-
memory/860-63-0x0000000000940000-0x000000000094C000-memory.dmpFilesize
48KB
-
memory/860-56-0x0000000000450000-0x0000000000460000-memory.dmpFilesize
64KB
-
memory/860-55-0x00000000003C0000-0x00000000003D0000-memory.dmpFilesize
64KB
-
memory/1008-64-0x0000000000000000-mapping.dmp
-
memory/1008-67-0x0000000000020000-0x0000000000114000-memory.dmpFilesize
976KB