Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
11/01/2024, 07:14
Static task
static1
Behavioral task
behavioral1
Sample
52e0c294963f6cd10e3104901c936a3e.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
52e0c294963f6cd10e3104901c936a3e.exe
Resource
win10v2004-20231215-en
General
-
Target
52e0c294963f6cd10e3104901c936a3e.exe
-
Size
2.0MB
-
MD5
52e0c294963f6cd10e3104901c936a3e
-
SHA1
fa78c9a910b904cfc412cef1b422934243f6f0ff
-
SHA256
77d8062a27308c826de456d4e430ebcfb9315f87ae792bb23d8f21365c8b4fe7
-
SHA512
972bb0dbd66f984c41b64c09ff84fef138714929b13db0f03ca2e5257d92664dcf4fcf6d7e6fc99894b664bb9acbbbe5598787a2d10bf4e8d074dfd0487c5f3b
-
SSDEEP
49152:n0Le0UIxHI38h4kbJA9GOErel2MaHBKljpsREsSSUOmLY5sVQQ:ChJsIJAIMnaHBKcRoOusQ
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 8 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2836 2764 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2624 2764 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2552 2764 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2484 2764 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2584 2764 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3024 2764 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1644 2764 schtasks.exe 28 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2828 2764 schtasks.exe 28 -
resource yara_rule behavioral1/memory/2040-4-0x0000000000390000-0x00000000007E2000-memory.dmp dcrat behavioral1/memory/2040-6-0x0000000000390000-0x00000000007E2000-memory.dmp dcrat behavioral1/memory/2908-60-0x0000000000A50000-0x0000000000EA2000-memory.dmp dcrat behavioral1/memory/2908-65-0x0000000077080000-0x0000000077170000-memory.dmp dcrat behavioral1/memory/2908-73-0x0000000000920000-0x0000000000960000-memory.dmp dcrat behavioral1/memory/2040-72-0x0000000000390000-0x00000000007E2000-memory.dmp dcrat behavioral1/memory/2908-57-0x0000000000A50000-0x0000000000EA2000-memory.dmp dcrat behavioral1/memory/2908-89-0x0000000000A50000-0x0000000000EA2000-memory.dmp dcrat -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 52e0c294963f6cd10e3104901c936a3e.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 52e0c294963f6cd10e3104901c936a3e.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 52e0c294963f6cd10e3104901c936a3e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 52e0c294963f6cd10e3104901c936a3e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 52e0c294963f6cd10e3104901c936a3e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 52e0c294963f6cd10e3104901c936a3e.exe -
Executes dropped EXE 1 IoCs
pid Process 2908 52e0c294963f6cd10e3104901c936a3e.exe -
Identifies Wine through registry keys 2 TTPs 2 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Wine 52e0c294963f6cd10e3104901c936a3e.exe Key opened \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Wine 52e0c294963f6cd10e3104901c936a3e.exe -
Loads dropped DLL 2 IoCs
pid Process 2040 52e0c294963f6cd10e3104901c936a3e.exe 2040 52e0c294963f6cd10e3104901c936a3e.exe -
Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\9064cc02-9ba8-11ee-8a7b-e6b52eba4e86\\csrss.exe\"" 52e0c294963f6cd10e3104901c936a3e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Windows\\System32\\msvcp140_codecvt_ids\\winlogon.exe\"" 52e0c294963f6cd10e3104901c936a3e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\52e0c294963f6cd10e3104901c936a3e = "\"C:\\Windows\\CSC\\52e0c294963f6cd10e3104901c936a3e.exe\"" 52e0c294963f6cd10e3104901c936a3e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\52e0c294963f6cd10e3104901c936a3e = "\"C:\\Recovery\\9064cc02-9ba8-11ee-8a7b-e6b52eba4e86\\52e0c294963f6cd10e3104901c936a3e.exe\"" 52e0c294963f6cd10e3104901c936a3e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Windows\\System32\\winrs\\lsass.exe\"" 52e0c294963f6cd10e3104901c936a3e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\Documents and Settings\\audiodg.exe\"" 52e0c294963f6cd10e3104901c936a3e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\52e0c294963f6cd10e3104901c936a3e = "\"C:\\ProgramData\\Templates\\52e0c294963f6cd10e3104901c936a3e.exe\"" 52e0c294963f6cd10e3104901c936a3e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\lsass.exe\"" 52e0c294963f6cd10e3104901c936a3e.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\msvcp140_codecvt_ids\winlogon.exe 52e0c294963f6cd10e3104901c936a3e.exe File opened for modification C:\Windows\SysWOW64\msvcp140_codecvt_ids\winlogon.exe 52e0c294963f6cd10e3104901c936a3e.exe File created C:\Windows\SysWOW64\msvcp140_codecvt_ids\cc11b995f2a76da408ea6a601e682e64743153ad 52e0c294963f6cd10e3104901c936a3e.exe File created C:\Windows\SysWOW64\winrs\lsass.exe 52e0c294963f6cd10e3104901c936a3e.exe File created C:\Windows\SysWOW64\winrs\6203df4a6bafc7c328ee7f6f8ca0a8a838a8a1b9 52e0c294963f6cd10e3104901c936a3e.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2040 52e0c294963f6cd10e3104901c936a3e.exe 2908 52e0c294963f6cd10e3104901c936a3e.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\6203df4a6bafc7c328ee7f6f8ca0a8a838a8a1b9 52e0c294963f6cd10e3104901c936a3e.exe File created C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\lsass.exe 52e0c294963f6cd10e3104901c936a3e.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\CSC\52e0c294963f6cd10e3104901c936a3e.exe 52e0c294963f6cd10e3104901c936a3e.exe File created C:\Windows\CSC\6549cf8edb9cd534ae12f3fdf9c0825b51906463 52e0c294963f6cd10e3104901c936a3e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 8 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2584 schtasks.exe 3024 schtasks.exe 1644 schtasks.exe 2828 schtasks.exe 2836 schtasks.exe 2624 schtasks.exe 2552 schtasks.exe 2484 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2040 52e0c294963f6cd10e3104901c936a3e.exe 2040 52e0c294963f6cd10e3104901c936a3e.exe 2040 52e0c294963f6cd10e3104901c936a3e.exe 2908 52e0c294963f6cd10e3104901c936a3e.exe 2908 52e0c294963f6cd10e3104901c936a3e.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2040 52e0c294963f6cd10e3104901c936a3e.exe Token: SeDebugPrivilege 2908 52e0c294963f6cd10e3104901c936a3e.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2040 wrote to memory of 2908 2040 52e0c294963f6cd10e3104901c936a3e.exe 37 PID 2040 wrote to memory of 2908 2040 52e0c294963f6cd10e3104901c936a3e.exe 37 PID 2040 wrote to memory of 2908 2040 52e0c294963f6cd10e3104901c936a3e.exe 37 PID 2040 wrote to memory of 2908 2040 52e0c294963f6cd10e3104901c936a3e.exe 37 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\52e0c294963f6cd10e3104901c936a3e.exe"C:\Users\Admin\AppData\Local\Temp\52e0c294963f6cd10e3104901c936a3e.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Recovery\9064cc02-9ba8-11ee-8a7b-e6b52eba4e86\52e0c294963f6cd10e3104901c936a3e.exe"C:\Recovery\9064cc02-9ba8-11ee-8a7b-e6b52eba4e86\52e0c294963f6cd10e3104901c936a3e.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2908
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\System32\msvcp140_codecvt_ids\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2836
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "52e0c294963f6cd10e3104901c936a3e" /sc ONLOGON /tr "'C:\Windows\CSC\52e0c294963f6cd10e3104901c936a3e.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2624
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "52e0c294963f6cd10e3104901c936a3e" /sc ONLOGON /tr "'C:\Recovery\9064cc02-9ba8-11ee-8a7b-e6b52eba4e86\52e0c294963f6cd10e3104901c936a3e.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2552
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\System32\winrs\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2484
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Documents and Settings\audiodg.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2584
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "52e0c294963f6cd10e3104901c936a3e" /sc ONLOGON /tr "'C:\ProgramData\Templates\52e0c294963f6cd10e3104901c936a3e.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3024
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1644
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\9064cc02-9ba8-11ee-8a7b-e6b52eba4e86\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2828
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD5039c0b09a18b2a673474d94c33c07f8f
SHA15fce11a083396c33e4865b626bc3faf1264ce138
SHA25647b4506510d4d7537cbfce050a6e6df797cca00a01730a49d823e9337dcdf31e
SHA512ae0dcc78cc20f873a6fe0cfe02ad01b0e8fa81534fa87468473147f235630ef786cc58b37cc554ab71363d4fd2fb31d47193542289a2283a6f7f8a19ad26e88c
-
Filesize
45KB
MD5b55264ced55df93a668adfd4f23ff6d1
SHA111c24874e21b7080d265e2d1571588e88f49a6c5
SHA256c3ed713d90c68fdda20a521f64e0263a74b327072d2b802c7146221d8bf98021
SHA5126933fd9e4203be71a761cb87136fca76d012f34a8bbce85e143f650ab6725a30ec05bc20f0f9e09f7d6a9f7cc1837d5ed38ad99ba40b06c34a309e856a81f067
-
Filesize
1.4MB
MD58d8a4a83184fe72c917f411c43599bac
SHA157b4038efc7fea813781601e0eec23d98fdcb1b4
SHA256345af5aa8670dbe09720214694ee66bcb20c74666bc25b3133a9a5952235f8ce
SHA512ab6385d8defc3f6ec9ec6472e24b425bae8b79e417abbab73cda7becef45b491d0a7d275dc9dc9cf05bc9e7367f1c4164a2d5cc9406c18e70fd5e2cf2a2bc142
-
Filesize
296KB
MD59e11470d492063a353d3d5733eee1422
SHA197490cd66ba5a46f90ffffafa469d987f707a195
SHA2560cb822f308eebc408078fde406e03886716737ba47b82317ad04d7d969cfb885
SHA512b5ad69ae3c6923089f63061e63d49b905dd00a71b796be849971ddf941db49dc79a9f03aa92486e1d514d05e639e9b6e9d9c2cccaa7bf9dc549052c5e249152e
-
Filesize
314KB
MD5efa37baf697451ed3b7d949a7acd2fcb
SHA156e4b9905799a1f5dc8883691a6afcc7987fdcdf
SHA256afc4835eeb5186800e1971346e1f1087608996621ed326bc2c5bf239c3a6aa4c
SHA5122e5bbfb9575e41743cac01d60fe5573f821d8843603db90f69edccf391de936b02f70e20c2f4dc2eafc6fa307458e86e4bc3ea81b719efda853efac04d099eee