Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
03/02/2023, 06:38
Behavioral task
behavioral1
Sample
7a98f7ef44c559242006617e4da75dd9db63bbbf2712d2dde21b468266787ca3.exe
Resource
win10v2004-20221111-en
General
-
Target
7a98f7ef44c559242006617e4da75dd9db63bbbf2712d2dde21b468266787ca3.exe
-
Size
1.3MB
-
MD5
0ae19ae164fdbb2f0d14053576500479
-
SHA1
9580e4b15c9e90f01daf4104e68755d1ab41ccb1
-
SHA256
7a98f7ef44c559242006617e4da75dd9db63bbbf2712d2dde21b468266787ca3
-
SHA512
ce150c9aa11553aed1632607d24c310cd0b947fffa2974c990f7bd1841cebf73326aad5759fc82dc3577b5793d42854eb3a6a9b3c7ef1f2098f8b3cc0f8d53c0
-
SSDEEP
24576:U2G/nvxW3Ww0t6TnzGmVBDh4+aknuRRZJND0gFJ4rD/IjC:UbA30GnzV/q+DnsXg
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 12 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4548 4956 schtasks.exe 68 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1484 4956 schtasks.exe 68 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2704 4956 schtasks.exe 68 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4560 4956 schtasks.exe 68 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1436 4956 schtasks.exe 68 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1000 4956 schtasks.exe 68 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2560 4956 schtasks.exe 68 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4296 4956 schtasks.exe 68 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3608 4956 schtasks.exe 68 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1656 4956 schtasks.exe 68 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1960 4956 schtasks.exe 68 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3124 4956 schtasks.exe 68 -
resource yara_rule behavioral1/files/0x0006000000022d9a-137.dat dcrat behavioral1/files/0x0006000000022d9a-138.dat dcrat behavioral1/memory/4576-139-0x0000000000DA0000-0x0000000000EB0000-memory.dmp dcrat behavioral1/files/0x0006000000022da4-167.dat dcrat behavioral1/files/0x0006000000022da4-168.dat dcrat -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation 7a98f7ef44c559242006617e4da75dd9db63bbbf2712d2dde21b468266787ca3.exe Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation DllCommonsvc.exe -
Executes dropped EXE 2 IoCs
pid Process 4576 DllCommonsvc.exe 1884 csrss.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\csrss.exe DllCommonsvc.exe File created C:\Program Files\Common Files\microsoft shared\886983d96e3d3e DllCommonsvc.exe File created C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\dllhost.exe DllCommonsvc.exe File created C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\5940a34987c991 DllCommonsvc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 12 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2560 schtasks.exe 3124 schtasks.exe 4548 schtasks.exe 1484 schtasks.exe 2704 schtasks.exe 4296 schtasks.exe 3608 schtasks.exe 1656 schtasks.exe 1960 schtasks.exe 4560 schtasks.exe 1436 schtasks.exe 1000 schtasks.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings 7a98f7ef44c559242006617e4da75dd9db63bbbf2712d2dde21b468266787ca3.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings DllCommonsvc.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 4576 DllCommonsvc.exe 4576 DllCommonsvc.exe 4576 DllCommonsvc.exe 4576 DllCommonsvc.exe 4576 DllCommonsvc.exe 4576 DllCommonsvc.exe 4576 DllCommonsvc.exe 3164 powershell.exe 4228 powershell.exe 208 powershell.exe 212 powershell.exe 4228 powershell.exe 1548 powershell.exe 3164 powershell.exe 208 powershell.exe 212 powershell.exe 1548 powershell.exe 1884 csrss.exe 1884 csrss.exe 1884 csrss.exe 1884 csrss.exe 1884 csrss.exe 1884 csrss.exe 1884 csrss.exe 1884 csrss.exe 1884 csrss.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 4576 DllCommonsvc.exe Token: SeDebugPrivilege 3164 powershell.exe Token: SeDebugPrivilege 4228 powershell.exe Token: SeDebugPrivilege 208 powershell.exe Token: SeDebugPrivilege 212 powershell.exe Token: SeDebugPrivilege 1548 powershell.exe Token: SeDebugPrivilege 1884 csrss.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 552 wrote to memory of 4148 552 7a98f7ef44c559242006617e4da75dd9db63bbbf2712d2dde21b468266787ca3.exe 79 PID 552 wrote to memory of 4148 552 7a98f7ef44c559242006617e4da75dd9db63bbbf2712d2dde21b468266787ca3.exe 79 PID 552 wrote to memory of 4148 552 7a98f7ef44c559242006617e4da75dd9db63bbbf2712d2dde21b468266787ca3.exe 79 PID 4148 wrote to memory of 2260 4148 WScript.exe 80 PID 4148 wrote to memory of 2260 4148 WScript.exe 80 PID 4148 wrote to memory of 2260 4148 WScript.exe 80 PID 2260 wrote to memory of 4576 2260 cmd.exe 82 PID 2260 wrote to memory of 4576 2260 cmd.exe 82 PID 4576 wrote to memory of 3164 4576 DllCommonsvc.exe 95 PID 4576 wrote to memory of 3164 4576 DllCommonsvc.exe 95 PID 4576 wrote to memory of 212 4576 DllCommonsvc.exe 96 PID 4576 wrote to memory of 212 4576 DllCommonsvc.exe 96 PID 4576 wrote to memory of 208 4576 DllCommonsvc.exe 102 PID 4576 wrote to memory of 208 4576 DllCommonsvc.exe 102 PID 4576 wrote to memory of 4228 4576 DllCommonsvc.exe 97 PID 4576 wrote to memory of 4228 4576 DllCommonsvc.exe 97 PID 4576 wrote to memory of 1548 4576 DllCommonsvc.exe 99 PID 4576 wrote to memory of 1548 4576 DllCommonsvc.exe 99 PID 4576 wrote to memory of 1520 4576 DllCommonsvc.exe 105 PID 4576 wrote to memory of 1520 4576 DllCommonsvc.exe 105 PID 1520 wrote to memory of 3936 1520 cmd.exe 107 PID 1520 wrote to memory of 3936 1520 cmd.exe 107 PID 1520 wrote to memory of 1884 1520 cmd.exe 111 PID 1520 wrote to memory of 1884 1520 cmd.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a98f7ef44c559242006617e4da75dd9db63bbbf2712d2dde21b468266787ca3.exe"C:\Users\Admin\AppData\Local\Temp\7a98f7ef44c559242006617e4da75dd9db63bbbf2712d2dde21b468266787ca3.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\providercommon\yTUdeXjbLOhnrN32dgrxVg.vbe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\providercommon\1zu9dW.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\providercommon\DllCommonsvc.exe"C:\providercommon\DllCommonsvc.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\providercommon\DllCommonsvc.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3164
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\conhost.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:212
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Common Files\microsoft shared\csrss.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4228
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\dllhost.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1548
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\odt\services.exe'5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:208
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\p5GqN7CVuU.bat"5⤵
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:26⤵PID:3936
-
-
C:\Program Files\Common Files\microsoft shared\csrss.exe"C:\Program Files\Common Files\microsoft shared\csrss.exe"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1884
-
-
-
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\odt\conhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4548
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\odt\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1484
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\odt\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2704
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\odt\services.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4560
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\odt\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1436
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\odt\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1000
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Program Files\Common Files\microsoft shared\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2560
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\Common Files\microsoft shared\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4296
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files\Common Files\microsoft shared\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3608
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1656
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1960
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3124
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
Filesize
221B
MD50de202ae440ce101c273744268fc7cdf
SHA172efeab92f0f107823eeffa678b604e3938f2223
SHA2568c44396d3e8ef4e4a8e8a9c0b8186371052e0c0c283838f33efd0bd08c43dbc2
SHA512e2f306c9d1a58127618a916397f19ae547a682acf142f3bc3cda2186c4c0bc132516eae1784070a783bae6feef8438dac62cbe37cdb57f2c83f9185c0127739c
-
Filesize
36B
MD56783c3ee07c7d151ceac57f1f9c8bed7
SHA117468f98f95bf504cc1f83c49e49a78526b3ea03
SHA2568ab782f0f327a2021530e7230d3aee8abbecb7eed59482a3a46e78b9e3862322
SHA512c6012d4bfac1ed14d0fd9f0eabd0e1c3d647b343db292a907b246271d52a4b7469c809db43910ddba2e8c5045f9cb3d24d0af62d363281e6cb8b39ee94a183e8
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
1.0MB
MD5bd31e94b4143c4ce49c17d3af46bcad0
SHA1f8c51ff3ff909531d9469d4ba1bbabae101853ff
SHA256b5199d3eb28e7de8ec4a5de66cb339a03d90b297e2292473badaab98ade15c63
SHA512f96658bd19b672fd84038bd7e95c89e14f4e6f84e3ce9c6fe3216861a41203406148c6a809c2ab350d0d6c5919c845f619deb1fc9b1f1814dfce87e566bc2394
-
Filesize
197B
MD58088241160261560a02c84025d107592
SHA1083121f7027557570994c9fc211df61730455bb5
SHA2562072cc9a4a3b84d4c5178ab41c5588eea7d0103e3928e34d64f17bf97f3d1cc1
SHA51220d9369dd359315848ea30144383a0bb479d86059fdbc3b3256ac84f998193512feb3b1799ab663619920c99fe7e0ebba33ada31a3855094b956fcd351c90478