Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
95s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
17/04/2024, 14:46
Behavioral task
behavioral1
Sample
fed72a470e5c75ecdf5eabb18de614f7caeaa4a4f629989c0477fdf28d7a2f90.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fed72a470e5c75ecdf5eabb18de614f7caeaa4a4f629989c0477fdf28d7a2f90.exe
Resource
win10v2004-20240412-en
General
-
Target
fed72a470e5c75ecdf5eabb18de614f7caeaa4a4f629989c0477fdf28d7a2f90.exe
-
Size
828KB
-
MD5
b553593ddafa968aa68b16a806f2598b
-
SHA1
8de10ee8f4d29475d5ceb4f4974e7dc08bae31c3
-
SHA256
fed72a470e5c75ecdf5eabb18de614f7caeaa4a4f629989c0477fdf28d7a2f90
-
SHA512
da10426fd8471d8fabe63cdc41121d37accf821bd39bc26d822b96766a677ca8173e7cb697542c8f3d73bd20ea112ba0853cd865c6cd7ae6aa6f33bde39a9ffb
-
SSDEEP
12288:CuZLhFZJ3Rz1L7YDvlUFfPrs+LluzBEZMSneuW1Se13+ymHy:CuFTZHz1L7YhofPA+LJZMOHW3O/S
Malware Config
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process 27 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3600 2072 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4676 2072 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1916 2072 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4988 2072 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2848 2072 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2432 2072 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4380 2072 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4264 2072 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3844 2072 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4884 2072 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1844 2072 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3604 2072 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3892 2072 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3280 2072 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4924 2072 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2256 2072 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4692 2072 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3880 2072 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4024 2072 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2924 2072 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4720 2072 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2332 2072 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 688 2072 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1300 2072 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2760 2072 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5100 2072 schtasks.exe 87 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2900 2072 schtasks.exe 87 -
resource yara_rule behavioral2/memory/3444-0-0x0000000000A20000-0x0000000000AF6000-memory.dmp dcrat behavioral2/files/0x0007000000023412-11.dat dcrat -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation fed72a470e5c75ecdf5eabb18de614f7caeaa4a4f629989c0477fdf28d7a2f90.exe -
Executes dropped EXE 1 IoCs
pid Process 3404 unsecapp.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\ServiceState\WinHttpAutoProxySvc\Data\fed72a470e5c75ecdf5eabb18de614f7caeaa4a4f629989c0477fdf28d7a2f90.exe fed72a470e5c75ecdf5eabb18de614f7caeaa4a4f629989c0477fdf28d7a2f90.exe File created C:\Windows\IdentityCRL\INT\backgroundTaskHost.exe fed72a470e5c75ecdf5eabb18de614f7caeaa4a4f629989c0477fdf28d7a2f90.exe File created C:\Windows\IdentityCRL\INT\eddb19405b7ce1 fed72a470e5c75ecdf5eabb18de614f7caeaa4a4f629989c0477fdf28d7a2f90.exe File created C:\Windows\ShellComponents\winlogon.exe fed72a470e5c75ecdf5eabb18de614f7caeaa4a4f629989c0477fdf28d7a2f90.exe File created C:\Windows\ShellComponents\cc11b995f2a76d fed72a470e5c75ecdf5eabb18de614f7caeaa4a4f629989c0477fdf28d7a2f90.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 27 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2332 schtasks.exe 3280 schtasks.exe 4024 schtasks.exe 2924 schtasks.exe 5100 schtasks.exe 4884 schtasks.exe 3892 schtasks.exe 2760 schtasks.exe 1844 schtasks.exe 4720 schtasks.exe 688 schtasks.exe 2900 schtasks.exe 4676 schtasks.exe 4380 schtasks.exe 3844 schtasks.exe 2256 schtasks.exe 4692 schtasks.exe 4988 schtasks.exe 2848 schtasks.exe 3604 schtasks.exe 1916 schtasks.exe 3880 schtasks.exe 3600 schtasks.exe 2432 schtasks.exe 1300 schtasks.exe 4264 schtasks.exe 4924 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3444 fed72a470e5c75ecdf5eabb18de614f7caeaa4a4f629989c0477fdf28d7a2f90.exe 3444 fed72a470e5c75ecdf5eabb18de614f7caeaa4a4f629989c0477fdf28d7a2f90.exe 3444 fed72a470e5c75ecdf5eabb18de614f7caeaa4a4f629989c0477fdf28d7a2f90.exe 3444 fed72a470e5c75ecdf5eabb18de614f7caeaa4a4f629989c0477fdf28d7a2f90.exe 3444 fed72a470e5c75ecdf5eabb18de614f7caeaa4a4f629989c0477fdf28d7a2f90.exe 3404 unsecapp.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3444 fed72a470e5c75ecdf5eabb18de614f7caeaa4a4f629989c0477fdf28d7a2f90.exe Token: SeDebugPrivilege 3404 unsecapp.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3444 wrote to memory of 3404 3444 fed72a470e5c75ecdf5eabb18de614f7caeaa4a4f629989c0477fdf28d7a2f90.exe 115 PID 3444 wrote to memory of 3404 3444 fed72a470e5c75ecdf5eabb18de614f7caeaa4a4f629989c0477fdf28d7a2f90.exe 115 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\fed72a470e5c75ecdf5eabb18de614f7caeaa4a4f629989c0477fdf28d7a2f90.exe"C:\Users\Admin\AppData\Local\Temp\fed72a470e5c75ecdf5eabb18de614f7caeaa4a4f629989c0477fdf28d7a2f90.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Windows\Temp\Crashpad\reports\unsecapp.exe"C:\Windows\Temp\Crashpad\reports\unsecapp.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3404
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\Saved Games\services.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3600
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Admin\Saved Games\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4676
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\Saved Games\services.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1916
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 11 /tr "'C:\Users\Default\Saved Games\spoolsv.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4988
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Users\Default\Saved Games\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2848
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Saved Games\spoolsv.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2432
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4380
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4264
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "explorere" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3844
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4884
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1844
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3892
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 8 /tr "'C:\Windows\Temp\Crashpad\reports\unsecapp.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3604
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Windows\Temp\Crashpad\reports\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3280
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 13 /tr "'C:\Windows\Temp\Crashpad\reports\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4924
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Desktop\sihost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2256
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Users\All Users\Desktop\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3880
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sihosts" /sc MINUTE /mo 6 /tr "'C:\Users\All Users\Desktop\sihost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4692
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 12 /tr "'C:\Windows\IdentityCRL\INT\backgroundTaskHost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4024
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Windows\IdentityCRL\INT\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2924
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 7 /tr "'C:\Windows\IdentityCRL\INT\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2760
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\Windows\ShellComponents\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1300
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Windows\ShellComponents\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2332
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Windows\ShellComponents\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4720
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:688
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5100
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\backgroundTaskHost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2900
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
828KB
MD5b553593ddafa968aa68b16a806f2598b
SHA18de10ee8f4d29475d5ceb4f4974e7dc08bae31c3
SHA256fed72a470e5c75ecdf5eabb18de614f7caeaa4a4f629989c0477fdf28d7a2f90
SHA512da10426fd8471d8fabe63cdc41121d37accf821bd39bc26d822b96766a677ca8173e7cb697542c8f3d73bd20ea112ba0853cd865c6cd7ae6aa6f33bde39a9ffb