Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
15/06/2024, 10:59
240615-m3p8es1hnj 10General
-
Target
NeverCry.exe
-
Size
1.6MB
-
Sample
240615-m3p8es1hnj
-
MD5
7d90121240d8da918d6370c81f6649f7
-
SHA1
d3e344ce25305e9168790f462698d9cbc90b23d3
-
SHA256
689100d4db441ae245b7b6edc85cb739c15ab3a972653483c122ba174032b2db
-
SHA512
d9675eba8aacf2d876400d9d4e22ae4f2af666ee1b72aa21a36b5f7e1518111ccf434e6a5cc08ae3f52fce4855b7baf90037614e358b2df392a2e20f3db9a319
-
SSDEEP
24576:P2G/nvxW3WY0eWu+KIrnB46Yz5R6jIdQX4FcixLckFcBtcuuGzdxX7p1W0ppwl+b:PbA3cnjB4xZi0NGtcuzdV7pLrA+GkeMB
Behavioral task
behavioral1
Sample
NeverCry.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
NeverCry.exe
Resource
win10v2004-20240611-en
Malware Config
Targets
-
-
Target
NeverCry.exe
-
Size
1.6MB
-
MD5
7d90121240d8da918d6370c81f6649f7
-
SHA1
d3e344ce25305e9168790f462698d9cbc90b23d3
-
SHA256
689100d4db441ae245b7b6edc85cb739c15ab3a972653483c122ba174032b2db
-
SHA512
d9675eba8aacf2d876400d9d4e22ae4f2af666ee1b72aa21a36b5f7e1518111ccf434e6a5cc08ae3f52fce4855b7baf90037614e358b2df392a2e20f3db9a319
-
SSDEEP
24576:P2G/nvxW3WY0eWu+KIrnB46Yz5R6jIdQX4FcixLckFcBtcuuGzdxX7p1W0ppwl+b:PbA3cnjB4xZi0NGtcuzdV7pLrA+GkeMB
Score10/10-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Disables Task Manager via registry modification
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Scheduled Task/Job
1