Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
-
submitted
17/11/2023, 02:40
General
-
Target
NEAS.1220f47113fd521c4bfeda028fdf1660.exe
-
Size
783KB
-
MD5
1220f47113fd521c4bfeda028fdf1660
-
SHA1
f7979a95d15a206ec51a39a5ccbceafd22f2989e
-
SHA256
e0a2d9c43e6b5ff3b4afd330f80170c9eda39ea9a326d78d5c247f22becfdbf5
-
SHA512
19639401f4475c27182e6ee014f632a6c8d0eb438032745dae68df51b9dbcfe91bf648ec64c699478b49b3997d84528f208a3e9f88150e31c523e49bf1e70eeb
-
SSDEEP
12288:GqnOYxdAgpoNeF91rg5iFdr0yQ9gYx+EIpakCYJRU7Q9bWoFzqK:G+OQbpbgsFdAyQvzSqaq8q
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 4 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
UAC bypass 3 TTPs 6 IoCs
-
DCRat payload 5 IoCs
Detects payload of DCRat, commonly dropped by NSIS installers.
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Drops file in System32 directory 8 IoCs
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies system certificate store 2 TTPs 6 IoCs
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
-
System policy modification 1 TTPs 6 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.1220f47113fd521c4bfeda028fdf1660.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.1220f47113fd521c4bfeda028fdf1660.exe"1⤵
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\ieetwproxystub\services.exe"C:\Windows\System32\ieetwproxystub\services.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Windows\inf\.NET Data Provider for Oracle\040C\dwm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Windows\System32\NlsData001a\taskhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\System32\ieetwproxystub\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\PerfLogs\Admin\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
344B
MD5f866ec52f66e509d0e7e1963117b682f
SHA1179bb0691dea71dce1243b22be6131d756981ab2
SHA256710bc072606ded4ea35d6c995b0670e7cc681743f6c646356e25fccb64eb9723
SHA512c5eee209776e88faf840c3817e3d6233eb8934c60f545fe0cb2fb255b0d731dac4f9df288ecfbdfa88e49add4f570143fe1e9d6fbcf2a72968350bc47608cb9d
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
Filesize
163KB
MD59441737383d21192400eca82fda910ec
SHA1725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA5127608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf
-
Filesize
783KB
MD51220f47113fd521c4bfeda028fdf1660
SHA1f7979a95d15a206ec51a39a5ccbceafd22f2989e
SHA256e0a2d9c43e6b5ff3b4afd330f80170c9eda39ea9a326d78d5c247f22becfdbf5
SHA51219639401f4475c27182e6ee014f632a6c8d0eb438032745dae68df51b9dbcfe91bf648ec64c699478b49b3997d84528f208a3e9f88150e31c523e49bf1e70eeb
-
Filesize
783KB
MD51220f47113fd521c4bfeda028fdf1660
SHA1f7979a95d15a206ec51a39a5ccbceafd22f2989e
SHA256e0a2d9c43e6b5ff3b4afd330f80170c9eda39ea9a326d78d5c247f22becfdbf5
SHA51219639401f4475c27182e6ee014f632a6c8d0eb438032745dae68df51b9dbcfe91bf648ec64c699478b49b3997d84528f208a3e9f88150e31c523e49bf1e70eeb
-
Filesize
783KB
MD51220f47113fd521c4bfeda028fdf1660
SHA1f7979a95d15a206ec51a39a5ccbceafd22f2989e
SHA256e0a2d9c43e6b5ff3b4afd330f80170c9eda39ea9a326d78d5c247f22becfdbf5
SHA51219639401f4475c27182e6ee014f632a6c8d0eb438032745dae68df51b9dbcfe91bf648ec64c699478b49b3997d84528f208a3e9f88150e31c523e49bf1e70eeb
-
Filesize
32KB
-
Filesize
512KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
808KB
-
Filesize
48KB
-
Filesize
32KB
-
Filesize
48KB
-
Filesize
512KB
-
Filesize
32KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
64KB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
32KB
-
Filesize
9.9MB
-
Filesize
32KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
808KB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
9.9MB