Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
13/02/2024, 02:28
Behavioral task
behavioral1
Sample
3e4493f78ba3b135a512c640d1aee8b6938f3613521d8a9262ef31b604fbf731.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3e4493f78ba3b135a512c640d1aee8b6938f3613521d8a9262ef31b604fbf731.exe
Resource
win10v2004-20231215-en
General
-
Target
3e4493f78ba3b135a512c640d1aee8b6938f3613521d8a9262ef31b604fbf731.exe
-
Size
828KB
-
MD5
af741ec427d46644c68572c50f87d61e
-
SHA1
7e31fdcd599478fe8e6b9b07be11ff307d79ce53
-
SHA256
3e4493f78ba3b135a512c640d1aee8b6938f3613521d8a9262ef31b604fbf731
-
SHA512
ae5a81bcf21c60b32e67be306daa8eeb6bfa5e24723e46c8519ea095fccaf3509ba6a3f0372a0e4412d75f1c16eb0e634a3f31a77bb68c248d238c45af5896e8
-
SSDEEP
12288:dKAvgOSpwbrYBil5nRRWZlN4CBe1bqOhSiXLu5uWWDKT+pDu:hvgOSpwYE53+4F+OhzlmT+pDu
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 21 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1616 1200 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3020 1200 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3328 1200 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2404 1200 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2556 1200 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4280 1200 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1584 1200 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2624 1200 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3404 1200 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3880 1200 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 456 1200 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3976 1200 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 940 1200 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 512 1200 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1124 1200 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1048 1200 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4364 1200 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2576 1200 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1324 1200 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 404 1200 schtasks.exe 84 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2476 1200 schtasks.exe 84 -
resource yara_rule behavioral2/memory/3408-0-0x0000000000CF0000-0x0000000000DC6000-memory.dmp dcrat behavioral2/files/0x0006000000023256-11.dat dcrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Control Panel\International\Geo\Nation 3e4493f78ba3b135a512c640d1aee8b6938f3613521d8a9262ef31b604fbf731.exe -
Executes dropped EXE 1 IoCs
pid Process 868 explorer.exe -
Drops file in Program Files directory 6 IoCs
description ioc Process File created C:\Program Files\Internet Explorer\es-ES\5940a34987c991 3e4493f78ba3b135a512c640d1aee8b6938f3613521d8a9262ef31b604fbf731.exe File created C:\Program Files\MSBuild\dllhost.exe 3e4493f78ba3b135a512c640d1aee8b6938f3613521d8a9262ef31b604fbf731.exe File created C:\Program Files\MSBuild\5940a34987c991 3e4493f78ba3b135a512c640d1aee8b6938f3613521d8a9262ef31b604fbf731.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\sysmon.exe 3e4493f78ba3b135a512c640d1aee8b6938f3613521d8a9262ef31b604fbf731.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\121e5b5079f7c0 3e4493f78ba3b135a512c640d1aee8b6938f3613521d8a9262ef31b604fbf731.exe File created C:\Program Files\Internet Explorer\es-ES\dllhost.exe 3e4493f78ba3b135a512c640d1aee8b6938f3613521d8a9262ef31b604fbf731.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Prefetch\ReadyBoot\dllhost.exe 3e4493f78ba3b135a512c640d1aee8b6938f3613521d8a9262ef31b604fbf731.exe File created C:\Windows\Prefetch\ReadyBoot\5940a34987c991 3e4493f78ba3b135a512c640d1aee8b6938f3613521d8a9262ef31b604fbf731.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 21 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2556 schtasks.exe 2624 schtasks.exe 3976 schtasks.exe 2576 schtasks.exe 404 schtasks.exe 1616 schtasks.exe 2404 schtasks.exe 3404 schtasks.exe 940 schtasks.exe 512 schtasks.exe 1124 schtasks.exe 3020 schtasks.exe 1584 schtasks.exe 1048 schtasks.exe 3328 schtasks.exe 4280 schtasks.exe 4364 schtasks.exe 1324 schtasks.exe 2476 schtasks.exe 3880 schtasks.exe 456 schtasks.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000_Classes\Local Settings 3e4493f78ba3b135a512c640d1aee8b6938f3613521d8a9262ef31b604fbf731.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 3408 3e4493f78ba3b135a512c640d1aee8b6938f3613521d8a9262ef31b604fbf731.exe 3408 3e4493f78ba3b135a512c640d1aee8b6938f3613521d8a9262ef31b604fbf731.exe 3408 3e4493f78ba3b135a512c640d1aee8b6938f3613521d8a9262ef31b604fbf731.exe 3408 3e4493f78ba3b135a512c640d1aee8b6938f3613521d8a9262ef31b604fbf731.exe 3408 3e4493f78ba3b135a512c640d1aee8b6938f3613521d8a9262ef31b604fbf731.exe 3408 3e4493f78ba3b135a512c640d1aee8b6938f3613521d8a9262ef31b604fbf731.exe 3408 3e4493f78ba3b135a512c640d1aee8b6938f3613521d8a9262ef31b604fbf731.exe 3408 3e4493f78ba3b135a512c640d1aee8b6938f3613521d8a9262ef31b604fbf731.exe 3408 3e4493f78ba3b135a512c640d1aee8b6938f3613521d8a9262ef31b604fbf731.exe 3408 3e4493f78ba3b135a512c640d1aee8b6938f3613521d8a9262ef31b604fbf731.exe 3408 3e4493f78ba3b135a512c640d1aee8b6938f3613521d8a9262ef31b604fbf731.exe 868 explorer.exe 868 explorer.exe 868 explorer.exe 868 explorer.exe 868 explorer.exe 868 explorer.exe 868 explorer.exe 868 explorer.exe 868 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 868 explorer.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3408 3e4493f78ba3b135a512c640d1aee8b6938f3613521d8a9262ef31b604fbf731.exe Token: SeDebugPrivilege 868 explorer.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3408 wrote to memory of 2496 3408 3e4493f78ba3b135a512c640d1aee8b6938f3613521d8a9262ef31b604fbf731.exe 106 PID 3408 wrote to memory of 2496 3408 3e4493f78ba3b135a512c640d1aee8b6938f3613521d8a9262ef31b604fbf731.exe 106 PID 2496 wrote to memory of 3124 2496 cmd.exe 108 PID 2496 wrote to memory of 3124 2496 cmd.exe 108 PID 2496 wrote to memory of 868 2496 cmd.exe 109 PID 2496 wrote to memory of 868 2496 cmd.exe 109 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3e4493f78ba3b135a512c640d1aee8b6938f3613521d8a9262ef31b604fbf731.exe"C:\Users\Admin\AppData\Local\Temp\3e4493f78ba3b135a512c640d1aee8b6938f3613521d8a9262ef31b604fbf731.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\nbwo7iYS6J.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:23⤵PID:3124
-
-
C:\odt\explorer.exe"C:\odt\explorer.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:868
-
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 6 /tr "'C:\odt\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1616
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\odt\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3020
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\odt\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3328
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2404
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2556
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4280
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Windows\Prefetch\ReadyBoot\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1584
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 6 /tr "'C:\Windows\Prefetch\ReadyBoot\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2624
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\Prefetch\ReadyBoot\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3404
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\sysmon.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3880
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:456
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sysmons" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\sysmon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3976
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "3e4493f78ba3b135a512c640d1aee8b6938f3613521d8a9262ef31b604fbf731" /sc ONLOGON /tr "'C:\odt\3e4493f78ba3b135a512c640d1aee8b6938f3613521d8a9262ef31b604fbf731.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:940
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "3e4493f78ba3b135a512c640d1aee8b6938f3613521d8a9262ef31b604fbf7313" /sc MINUTE /mo 10 /tr "'C:\odt\3e4493f78ba3b135a512c640d1aee8b6938f3613521d8a9262ef31b604fbf731.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:512
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "3e4493f78ba3b135a512c640d1aee8b6938f3613521d8a9262ef31b604fbf7313" /sc MINUTE /mo 5 /tr "'C:\odt\3e4493f78ba3b135a512c640d1aee8b6938f3613521d8a9262ef31b604fbf731.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1124
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Program Files\Internet Explorer\es-ES\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1048
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\es-ES\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4364
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Program Files\Internet Explorer\es-ES\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2576
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\MSBuild\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1324
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Program Files\MSBuild\dllhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:404
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files\MSBuild\dllhost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2476
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
184B
MD53246d70029d04d4b8aeefd50bf452212
SHA1a883c2b8cf660f91028ab325778485a910307929
SHA25657134f6df1cac5e4c423923efdba3027f707696298964a3691df85107a69b6e4
SHA5124577fc1fd4d0016a314944c0df1e1d3ed5f9c3b6eb60cffa01cd0fb3d3b310c8bae1ee928113e72d74cd570d14428a116ea1a097ff4d5b515910215a5468c167
-
Filesize
828KB
MD5af741ec427d46644c68572c50f87d61e
SHA17e31fdcd599478fe8e6b9b07be11ff307d79ce53
SHA2563e4493f78ba3b135a512c640d1aee8b6938f3613521d8a9262ef31b604fbf731
SHA512ae5a81bcf21c60b32e67be306daa8eeb6bfa5e24723e46c8519ea095fccaf3509ba6a3f0372a0e4412d75f1c16eb0e634a3f31a77bb68c248d238c45af5896e8